what we keep, why, and how to get it back.

two:am is a creative technology and event production studio based in queenstown, new zealand. we are the "agency" for the purposes of the privacy act 2020. questions about this policy go to minds@twoam.co.nz.

we only collect what we need to talk to you, do the work, and get paid.

• contact details you give us — name, email, phone, company — when you email, call, or work with us.
• project information — briefs, files, footage, feedback, approvals and anything else you share so we can deliver a job.
• billing details — the name and address we invoice, payment references, and the records tax law makes us keep. we do not store card numbers.
• website usage — anonymous, aggregated page-view and performance data via vercel analytics and speed insights. it does not use cookies and does not identify you.
• preferences — this site remembers your light/dark and sound choices in your own browser (local storage). nothing is sent to us.

• to reply to you and scope, quote, plan and deliver work.
• to invoice, collect payment and keep the accounts the inland revenue department requires.
• to run and improve this website.
• to meet legal obligations — tax, health and safety on event sites, and lawful requests.

we do not sell personal information, and we do not use it for third-party advertising.

two:am runs its own internal tooling against google workspace — for example a file-sync client that moves the studio's own files between our drives and our google drive accounts. that app is used only by two:am for two:am's own accounts. it does not access, collect or process any other person's google data.

where any two:am app accesses google user data, its use of information received from google apis adheres to the google api services user data policy, including the limited use requirements. data is used only to provide the file-management function the account owner asked for; it is never transferred to third parties except as needed to provide that function, never used for advertising, and never read by a human except with the account owner's consent, for security, or to comply with law.

only the services that make the studio run, and only what each one needs:

• hosting and infrastructure — vercel, cloudflare and supabase (our own hub database).
• email, calendar and file storage — google workspace.
• accounting and payments — our accounting platform, our bank, and payment providers such as wise, for invoicing and receiving payment.
• production partners — crew, venues and suppliers on a specific job, when the job needs them to have your details.
• ai tooling — we use ai assistants (such as anthropic's claude) to help draft and organise our work. we do not feed them your personal information beyond what a task genuinely needs, and we do not train models on your data.

some of these providers store data outside new zealand (mainly australia, the united states and the eu). we only use providers with comparable privacy safeguards, as the privacy act requires.

project files and correspondence for as long as we are working together and a reasonable period after, so we can support what we delivered. financial records for seven years, because tax law says so. anonymous analytics are kept in aggregate only. when we no longer need something, we delete it or anonymise it.

accounts are protected with strong passwords and multi-factor authentication, access is limited to the people who need it, and data lives with the providers above rather than on unencrypted portable drives. no system is perfect; if a breach is likely to cause you serious harm we will tell you and the office of the privacy commissioner, as the law requires.

under the privacy act 2020 you can ask us for a copy of the personal information we hold about you and ask us to correct it. email minds@twoam.co.nz and we will respond within 20 working days. if you are not happy with how we handled it, you can complain to the office of the privacy commissioner at privacy.org.nz.

if you are in the eu, uk or australia and local law gives you extra rights (erasure, portability, objection), ask and we will honour them where they apply.

this site and our services are for adults and businesses. we do not knowingly collect information from anyone under 16.

when this policy changes we update the date at the top. material changes to how we use data we will tell existing clients about directly.

two:am · queenstown, new zealand · minds@twoam.co.nz