top of page

Version effective: September 2026​​

Privacy Policy

Line_edited.jpg
About this Privacy Policy

1. About this Privacy Policy

 

This Privacy Policy explains how Victory & Grace Limited (V&G, we, us) collects, uses, stores and protects personal information in connection with V&G Teams, our website and our customer and business relationships.

 

V&G Teams is provided to organisations and the staff who belong to the Team or Teams covered by an organisation’s membership.

 

Our registered address is:

Victory & Grace Limited
905/86 The Strand
Parnell, Auckland
New Zealand

 

For privacy questions, requests or concerns, contact support@victoryandgrace.co​.

​

This Privacy Policy applies together with the V&G Teams Terms.

​

​

What information we collect

2. What information we collect
 

We may collect and process the following types of information.

​

Account and membership information

​

This may include:

  • names;

  • work email addresses;

  • organisation names;

  • Team names;

  • job titles or roles where provided;

  • membership details;

  • membership start and end dates;

  • renewal and cancellation information;

  • authorised customer contacts; and

  • communications with V&G.

​

Team and Hub information

​

Team members may add information while using V&G Teams. This may include:

  • priorities;

  • actions;

  • decisions;

  • commitments;

  • notes;

  • responses;

  • activity outputs; and

  • other information entered into the V&G Teams Hub.

​

We refer to this as Customer Content.

​

Customer Content belongs to the customer or the relevant organisation. V&G does not acquire ownership of Customer Content merely because we store or process it.

​

Access and security information

​

We may collect information about access to V&G Teams, including:

  • user identity;

  • access permissions;

  • account or sign-in information;

  • invitations and membership changes;

  • administrative actions;

  • security events;

  • suspected misuse; and

  • audit information made available through the platform.

​

Billing and payment information

​

Stripe processes payments and billing information for V&G.

​

V&G may receive:

  • billing contact details;

  • subscription information;

  • invoices;

  • payment status;

  • transaction references; and

  • limited payment information.

​

V&G does not generally receive or store full payment-card details submitted through Stripe.

​

Usage and analytics information

​

Superhuman may provide workspace-level analytics and other platform information to V&G administrators. This may include:

  • Hub and document activity;

  • feature usage;

  • access activity;

  • performance information;

  • administration information;

  • aggregated usage information; and

  • audit events.

​

We do not currently enable Google Analytics for the V&G Teams Hub.

​

​

Information not to provide

3. Information customers should not provide

​

V&G Teams is designed for Team and organisational work. It is not intended for:

  • health or medical information;

  • bank account, payment-card or other sensitive financial-account information;

  • information about children;

  • highly sensitive personal information;

  • confidential third-party information that the customer or Team member is not authorised to provide; or

  • information that the customer is not authorised to provide.

​

Customers and Team members should not enter this information into V&G Teams unless V&G has expressly agreed to receive and process it.

​

This does not prevent ordinary personal information from appearing in Customer Content, such as a person’s name, role, action or work-related comment.

​

​

How we collect information

4. How we collect information
 

We may collect information:

  • directly from the customer;

  • from an organisation’s authorised representative;

  • from Team members;

  • through sign-up and membership forms;

  • through the V&G Teams Hub;

  • through customer support communications;

  • through payment and billing activity;

  • through Zoho CRM Plus;

  • through platform administration and security functions; and

  • from service providers used to operate V&G Teams.

     

How we use information

5. How we use information

 

We may use information to:

  • provide and administer V&G Teams;

  • create and manage memberships;

  • provide Hub access;

  • manage Team-member permissions;

  • provide customer support;

  • respond to privacy and Customer Content requests;

  • process payments and manage billing;

  • send service, account and operational communications;

  • send marketing communications where permitted by law;

  • maintain security;

  • investigate suspected misuse;

  • prevent fraud and unauthorised access;

  • improve V&G Teams;

  • understand how Teams use V&G;

  • create aggregated or de-identified insights;

  • publish aggregated or de-identified insights;

  • comply with legal obligations;

  • establish, exercise or defend legal claims; and

  • manage V&G’s business and customer relationships.

​

​

Aggregated information

6. Aggregated and de-identified information

​

V&G may use information to create aggregated or de-identified information about how V&G Teams is used and what may help Teams work effectively.

 

This may include information about:

  • usage patterns;

  • feature use;

  • common themes;

  • Team activities;

  • product performance; and

  • general outcomes or trends.

​

We may use this information to:

  • improve V&G Teams;

  • develop new products or features;

  • understand product effectiveness;

  • build evidence about what helps Teams;

  • prepare reports; and

  • publish insights, research or other materials.

​

V&G will not publish this information in a way that identifies an individual, Team, customer or organisation unless the relevant customer or person has separately agreed to that use.De-identification is not always irreversible in every possible circumstance. V&G will take reasonable steps to reduce the risk that published or shared information identifies a customer or individual.

​

Aggregated or de-identified information does not give V&G ownership of the underlying Customer Content.

​

​​

Service providers

7. Service providers

​

V&G uses service providers to operate, support and administer V&G Teams.

 

These may include:

​

Superhuman Docs

 

Superhuman Docs provides the Hub and related platform functionality.

 

Superhuman and its service providers may process information through the infrastructure used to provide the Superhuman service. This may include Amazon Web Services or other infrastructure providers.

 

V&G does not directly operate AWS for V&G Teams.

 

Zoho CRM Plus

 

V&G uses Zoho CRM Plus for activities such as:

  • customer relationship management;

  • customer and organisation records;

  • sales and onboarding;

  • account administration;

  • customer communications; and

  • marketing campaigns.

​

Stripe

​

V&G uses Stripe for:

  • payment processing;

  • billing;

  • subscription management;

  • invoices;

  • payment status; and

  • payment-related risk management.

​

Google Workspace services

​

V&G uses Google email services for business email, customer communications, support and operational notices.

​

Other providers

​

V&G may use other providers for:

  • email delivery;

  • customer support;

  • security;

  • hosting;

  • data storage;

  • analytics;

  • administration; and

  • business operations.

  • ​

We require service providers processing information for V&G to handle it consistently with their contractual obligations, applicable privacy requirements and the services they provide.

​

​

Marketing communications

8. Marketing communications

​

V&G may use Zoho CRM Plus to send marketing communications.

​

Marketing communications may include information about:

  • V&G Teams;

  • other V&G products or services;

  • events;

  • resources;

  • research; and

  • relevant product updates.

​

We will send marketing communications in accordance with applicable law.

Recipients may unsubscribe using the unsubscribe option in the communication or by contacting support@victoryandgrace.co.

​

Unsubscribing from marketing communications will not stop important service, account, billing, security or legal communications.

​

​

Customer Content

9. Customer Content and organisational responsibility

​

The organisation that purchases V&G Teams is responsible for:

  • ensuring it is authorised to provide personal information to V&G;

  • telling its staff how their information will be used;

  • ensuring Team members use V&G Teams appropriately;

  • ensuring information entered into the Hub is suitable for the service; and

  • responding to requests from its staff where the organisation controls the relevant information.

​

V&G may process Customer Content where reasonably necessary to:

  • provide and support V&G Teams;

  • manage Hub access;

  • maintain security;

  • investigate misuse;

  • respond to customer requests;

  • maintain and improve the service; and

  • comply with legal obligations.

​

V&G does not acquire ownership of Customer Content through this processing.

​

​

Analytics, deletion, and retention

10. Analytics, deletion, and retention

​

When a membership ends, V&G removes access to the relevant Hub.

​

The customer may request separable Customer Content by contacting support@victoryandgrace.co within 60 days after the membership ends.

​

After that 60-day period, V&G may delete the relevant Hub through Superhuman.

​

A deleted Hub may remain in Superhuman’s recovery system for up to seven days before permanent deletion. During that period, an authorised administrator may potentially restore it.

​

After the recovery period:

  • Hub Content is deleted;

  • native tracking information stored in the Hub is deleted; and

  • no further analytics are collected from that deleted Hub.

​

Deleting one Hub does not necessarily delete:

  • historical aggregated workspace analytics;

  • organisation-level audit records;

  • security records;

  • billing records;

  • legal records; or

  • information retained in backups or archives.

​

The deleted Hub will no longer be treated as an active document in relevant workspace analytics. However, historical aggregated information may remain where it forms part of wider workspace or organisation-level records.

 

V&G may retain information for as long as reasonably necessary for:

  • providing the service;

  • customer and account administration;

  • billing and accounting;

  • security;

  • fraud prevention;

  • legal compliance;

  • dispute resolution;

  • audit purposes; and

  • establishing, exercising or defending legal claims.

​

Retention periods may also depend on the requirements of our service providers.

​

​

Security

11. Security

​

V&G maintains reasonable technical and organisational measures designed to protect information against:

  • unauthorised access;

  • loss;

  • misuse;

  • alteration; and

  • unauthorised disclosure.

​

Measures may include:

  • access controls;

  • restricted administrator access;

  • authentication controls;

  • permission management;

  • removal of access when memberships end;

  • service-provider security controls; and

  • procedures for handling suspected incidents.

​

No online service can be guaranteed to be completely secure.

​

Customers and Team members should promptly report suspected unauthorised access, compromised credentials, accidental disclosure or other security incidents to support@victoryandgrace.co​.

​

If V&G becomes aware of a privacy or security incident affecting personal information, we will take reasonable steps to:

  • investigate and contain the incident;

  • mitigate its effects;

  • comply with applicable legal obligations; and

  • notify affected customers or individuals, and relevant privacy regulators, where required by law.

​

Information may be provided in stages while an investigation develops.

​

 

International processing

12. International processing

​

V&G, Superhuman, Zoho, Stripe, Google and other service providers may process information in New Zealand or other countries where they or their service providers operate.

 

This may include processing through overseas data centres, support functions, infrastructure providers or other service arrangements.

​

Some of our service providers process or store information outside New Zealand. Where a provider processes information on V&G's behalf, V&G remains responsible for taking appropriate steps to ensure the information is handled consistently with applicable privacy requirements.

​

 

Privacy righs and requests

13. Privacy rights and requests

​

Depending on the circumstances and applicable law, individuals may have rights to:

  • request access to personal information;

  • request correction of inaccurate information;

  • ask how information is being used;

  • raise a concern about privacy handling;

  • request information about service providers; and

  • make a complaint.

​

Requests should be sent to support@victoryandgrace.co​.

​

We may need to verify the requester’s identity and authority before responding.

 

A request for access to personal information is different from a request for Customer Content after a membership ends. Post-membership Customer Content requests are subject to the 60-day process in the V&G Teams Terms.

 

Where an organisation controls the relevant information, we may refer an individual to that organisation or ask the organisation to assist with the request.

​

​

Complaints

14. Complaints

​

If you have a privacy concern, please contact V&G first at support@victoryandgrace.co​.

​

We will review the concern and respond within a reasonable period.

 

If you are in New Zealand and remain dissatisfied, you may contact the Office of the New Zealand Privacy Commissioner. Their website is https://www.privacy.org.nz.

​

You may also have rights to complain to a privacy regulator in the country where you live or work.

​

​

Changes to this Privacy Policy

15. Changes to this Privacy Policy

​

V&G may update this Privacy Policy to reflect:

  • changes to V&G Teams;

  • changes to service providers;

  • legal or regulatory requirements;

  • security requirements;

  • changes to our information-handling practices; or

  • product and business developments.

​

The current version and effective date will be identified at the beginning of the Privacy Policy.

​

We will provide reasonable notice of material changes where appropriate.

​

 

bottom of page