Privacy Policy

Contexta is operated by ELab Limited (NZBN 9429046954992), New Zealand. ELab is responsible for the personal information described in this policy.

This policy applies when you:

• visit the Contexta website or send us an enquiry through it;
• use the public skill builder on the website, with or without an account;
• sign in to the Contexta dashboard;
• connect an AI product to Contexta through the Contexta connection (MCP server) or a Contexta plugin.

It does not cover the AI products you connect to Contexta, such as Claude, ChatGPT, Cursor or Grok, or the storage that holds your documents, such as SharePoint or Google Drive. Those providers handle information under their own terms and privacy policies.

We collect:

• Account information: your name, email address, avatar (if you upload one), the organisation and spaces you belong to, and your role.
• Sign-in events: sign-in attempts and the one-time codes used to verify access.
• Workspace content: the skills, organisation rules, terminology, conventions, space settings, enabled features and related metadata that you or your organisation create or update, including version history.
• Usage and operational logs: how the Contexta connection is used, such as the tool and skill requested, the time, the AI product used and whether the request succeeded, together with request metadata, error traces and the audit history needed to run the service securely.
• Skill builder input: the task description or skill text you type or upload into the public skill builder, your answers to its questions, and the skill it produces.
• Enquiries and support: your name, email address, the topic you choose, your message and anything else you send us.
• Billing information: for paid plans, the billing contact, plan, seat count and payment status. Payment card details are entered on Stripe’s checkout and processed by Stripe; we don’t receive or store your full card number.
• Cookies, local storage and analytics: see section 13.

Please do not include passwords, API keys, confidential documents or personal information you are not authorised to share in the skill builder, an enquiry or a support request.

Your documents stay in your storage. Your knowledge base, such as SOPs, templates, decisions and past work, stays in your SharePoint, Google Drive or other storage, and skills in Contexta link to that material. Document processing, brand voice and similar tools return a method that your AI applies on your side, so your source files are not uploaded to Contexta as part of those flows.

Your AI product works with the documents it can access in its own setup and processes them under its provider’s terms. The public skill builder works differently: it sends the text you give it for generation, as described in section 6.

We use personal information to:

• authenticate you and protect your account;
• provide Contexta to you and your organisation, including delivering skills and company context to your connected AI products and managing rules, spaces, access and enabled features;
• generate or improve a skill when you use the public skill builder, and save it to your workspace when you ask us to;
• give your organisation’s admins usage reporting, such as which skills are used and where skills are missing;
• classify skills by business function so your organisation can see its coverage;
• manage plans, seats and billing;
• respond to enquiries and provide support;
• maintain audit trails of administrative changes, such as rule history and role changes;
• operate, maintain, troubleshoot and improve the service;
• investigate incidents, prevent abuse, meet legal obligations and enforce our terms.

We do not use your content to train general-purpose AI models.

Contexta involves AI providers in three different ways.

The public skill builder. When you use the skill builder on the website, the text you type or upload and your answers to its questions are sent to Google (the Gemini API) to generate or improve your skill. Your draft stays in your browser while you work and clears when you close the tab. We don’t keep the text you enter on our servers.

Your own AI product. When you use Contexta through Claude, ChatGPT, Cursor, Grok or another AI product, the skill content and company context your AI requests are sent to that provider, and your prompts, documents and results are processed under your own agreement with that provider. ELab does not control how those products present, store or reuse prompts, results or conversation history.

Skill classification. We use Google Gemini to classify your organisation’s skills by business function for coverage reporting. This sends skill text to Google for that purpose.

We use a small set of trusted providers to operate Contexta:

• Supabase: managed database, authentication and file storage.
• Vercel: website and application hosting and edge delivery.
• Axiom: usage and error logs.
• Google Gemini: classifying skills by business function, and generating and improving skills in the public skill builder.
• Upstash: usage limits for the public skill builder. It stores a one-way hashed identifier derived from your IP address and the times of your requests, not the text you enter.
• Stripe: billing and payments for paid plans.
• Email delivery: sending sign-in codes and administrator notifications.
• Website analytics and advertising: Google Tag Manager, Google Analytics, Google Ads and PostHog, and the LinkedIn Insight Tag if enabled.
• Enquiries: Brevo (email delivery), Twenty (our customer records) and Slack (internal notification to our team).

Each sub-processor is bound by data protection terms appropriate to its role. We will update this list when material changes occur.

We do not sell personal information or share it for third-party marketing. We share it only:

• with the sub-processors listed above, as needed to provide the service;
• with your organisation’s authorised admins, who can see membership, roles and usage information for the organisation;
• with the AI products you choose to connect, as described in section 6;
• where you direct or authorise us;
• where required by law, or where necessary to protect rights, security and users, or to enforce our terms.

Some providers may store or process information outside New Zealand. Where required, we take reasonable steps to ensure appropriate privacy safeguards apply. Personal information is hosted in regions chosen for performance and regulatory fit.

How long we keep information depends on what it is:

• Account, organisation and workspace content: for as long as your organisation uses Contexta, and for a reasonable period afterwards to meet legal, audit and dispute-resolution obligations.
• Version history: according to your plan.
• Audit logs: at least twelve months.
• Usage and error logs: for as long as we need them to run, secure and troubleshoot the service.
• Skill builder input and results: in your browser only, until you close the tab, unless you save the skill to your workspace.
• Enquiries and support messages: for as long as we need them to respond to you and keep a record of our dealings with you.
• Billing records: for seven years, as New Zealand tax law requires.

When we no longer reasonably need information, we delete or de-identify it, subject to legal, security, backup, dispute and operational requirements.

Access to production systems is restricted, authenticated and logged. You sign in with a one-time code rather than a password. Each request is resolved to your organisation, and other Contexta customers cannot see your organisation’s data. We use Row Level Security on the database, encrypted transport (HTTPS) and encrypted storage at rest, and we review access and audit trails regularly.

No internet-based service is completely secure. You can read more on our Security and data page.

If a privacy breach is likely to cause serious harm, we will notify affected individuals and the New Zealand Privacy Commissioner as required by the Privacy Act 2020.

Under the Privacy Act 2020, you may ask us to confirm whether we hold personal information about you, and to access or correct that information. Depending on where you are, you may also have rights to request deletion or restriction and to object to certain processing. We may need to verify your identity before acting on a request.

You can do some things yourself:

• update your name and avatar from your profile in the dashboard;
• copy your skills out of the dashboard;
• disconnect Contexta from your AI product in its connector or MCP settings at any time;
• if you are an admin, remove members and sign-in domains for your organisation.

For anything you can’t do in the product, including a request to export or delete your personal information, contact us using the details in section 15 and we will respond within a reasonable time. Deletion is subject to any information we are legally permitted or required to keep.

You can also make a complaint to the Office of the Privacy Commissioner.

The Contexta dashboard uses cookies and local storage to keep you signed in and to remember your interface preferences, such as light or dark mode. The dashboard does not use third-party advertising cookies.

The Contexta website uses Google Tag Manager to load Google Analytics, Google Ads conversion tracking and PostHog, which set cookies to measure visits and the results of our advertising. It also keeps a record in your browser of the first page you visited and how you arrived, so that if you send us an enquiry we know where it came from.

The skill builder keeps your draft in your browser’s session storage, so it stays while you move between pages and clears when you close the tab.

Our analytics are set up so they don’t record what you type into the skill builder. You can block or delete cookies in your browser settings; the website still works without analytics cookies.

We may update this policy as Contexta, our providers or legal requirements change. We will publish the revised policy with a new “last updated” date and give reasonable notice of material changes where practicable, through the service or by email to organisation admins.

Our Privacy Officer handles privacy questions, requests and complaints. Contact them at support@elab.co.nz. Mark the subject “Privacy request” if your enquiry concerns access to, correction of or deletion of your personal information.

ELab Limited, New Zealand. elab.co.nz