Privacy Policy

What we collect, why we collect it, and what we will never do with it. Written to be read, not to be survived.

Last updated: 5 October 2026

Who we are

This site and our services are run by Junction Central Limited, trading as Junction AI — a New Zealand company (company number 7879076, NZBN 9429047921313), registered at 17 Norfolk Street, Ponsonby, Auckland, New Zealand.

We build AI agents for businesses: you can run them yourself in your own Junction workspace, or we run them for you. That means we handle two very different things: information about you, and information that belongs to our customers and clients. Those are treated differently, and this policy keeps them separate.

The three kinds of information we handle

Most privacy policies blur these together. Ours doesn’t, because the rules genuinely differ.

When you visit this website

Analytics and ad measurement

If you choose “Allow analytics”, we load Google Analytics and the Meta Pixel. They help us count visits, understand which pages people read, measure which ads lead people to the site, and record when someone clicks through to book a call. We do not treat a click as a booked call or a sale.

These tools may set cookies and send page, browser, device, IP-address and advertising-attribution information to Google and Meta. We use that information to measure and improve our own marketing. We do not sell it. Choose “Essential only” to leave both tools off; the site works either way. You can change the choice later with the “Cookie choices” button.

If you join our email list

We ask for your email address, and optionally your website. We use them to send you what you asked for and a short series of follow-up emails about how we work. Every email has an unsubscribe link, and unsubscribing is instant and permanent. We do not sell, rent or share your email address with anyone.

If you book a call

Bookings run through Calendly, which collects your name, email and whatever you type into the booking form. We use it to hold the meeting and to follow up.

Server logs

Our host, Vercel, keeps standard access logs including IP addresses, for security and to keep the site running. These are short-lived.

If you use a Junction workspace

When you start a trial or subscribe, you get your own private workspace: a separate server with its own storage, hosted by Fly.io in Sydney, Australia. Your chats, uploaded files and context, agents, plans and Creative assets live there. No other customer’s data shares that server or its storage, and the storage is encrypted at rest by our host.

• Who can see it. The people you add to your workspace, who sign in with a one-time email code. Junction support can also sign in, and only does so to fix a problem or when you ask.
• Your AI provider. Your agents run on the AI you connect, using your own account or key: Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google), Grok (xAI), or another model through an OpenAI-compatible API you choose (for example OpenRouter, Mistral, DeepSeek, Groq, Together, or a model you run yourself). Your workspace sends that provider what an agent needs for the task, under your agreement with them. If you connect a personal account, check that provider’s data and training settings.
• Creative. When you generate images or video, your prompt and any reference images go to the generation service you choose (for example Vercel AI Gateway, OpenAI, Google Gemini, xAI or Higgsfield). The results are saved as assets in your workspace until you delete them.
• Connected apps. When you connect an app such as Gmail, Shopify or Klaviyo, the connection is held by Composio in a project that belongs to your workspace alone. You can disconnect an app at any time.
• Payments. Stripe handles your card. We never see or store your card number.

The four promises below apply to your workspace too: we don’t pool it, sell it, train models on it, or publish anything from it without asking.

If you use the Junction mobile apps

The iPhone and Android apps are companions to your workspace. They keep only your workspace’s address and a sign-in for that device, stored in the phone’s secure storage. Your sign-in email, and the messages, files and images you send, go to your workspace and are handled as described above.

• Optional permissions. The camera (to scan a pairing code or take a reference photo), the microphone and speech recognition (for dictation, handled by your phone’s built-in speech service from Apple or Google), and adding images to your photo library. Each one is asked for only when you use that feature.
• Voice replies. If you add your own ElevenLabs key in the app, the text of replies you choose to hear is sent to ElevenLabs under your account.
• No ads or tracking. The apps contain no advertising, no tracking and no third-party analytics.
• Deleting your account. In the app, go to Settings → Account → Delete account, or see Delete your account.

If we run your marketing for you

To do the work, we need access to your marketing platforms — things like Shopify, Klaviyo, Meta, Google Ads, Pinterest, Google Search Console and Google Analytics. We connect using the access you grant us, and you can revoke it at any time.

We copy data from those platforms into a database so our agents can read accurate numbers instead of guessing. That database is separated by client.

Four things we do not do with client data

• We do not pool it. One client’s data is never mixed with another’s, and never used to inform another client’s work.
• We do not sell it, to anyone, ever.
• We do not use it to train AI models. More on this below.
• We do not publish your results without asking. If we want to write about work we did for you, we ask first and you approve what gets said.

AI models, and whether your data trains them

When we run the work for you, our agents run on AI models from Anthropic, Google and OpenAI. Your information is sent to those models so they can do the work — read your numbers, draft your emails, analyse your ads.

We use these providers under commercial terms where business data is not used to train their models. We do not train any model on your data ourselves. We do not feed one client’s data into work for another.

This is the question we get asked most, so we’d rather answer it in writing than in a sales call.

Who else touches the information

We use other companies to run parts of the service. We only give each one what it needs. Here is the actual list, not a vague reference to “trusted partners”.

We may also disclose information if the law requires it.

Information going overseas

We are a New Zealand company, but the companies above are mostly in the United States, and some operate in Ireland and Australia. That means your information is stored and processed outside New Zealand.

Before using a provider we check that it offers comparable protections to those required under the New Zealand Privacy Act 2020, and we rely on the contractual terms each provider offers. If you are in Australia, this is our disclosure under Australian Privacy Principle 8.

How long we keep things

• Email subscribers: until you unsubscribe, then we keep a record of the unsubscribe so we don’t email you again by mistake.
• Enquiries and call notes: up to two years after we last spoke, unless you ask us to delete them sooner.
• Workspace data: for as long as your subscription runs. When it ends, your workspace is paused and kept for 30 days so you can come back or ask for an export. After that we delete it. You can ask us to delete it sooner.
• Client data: for as long as we work together. When we stop, we delete or return it at your direction, other than what we must keep for tax and legal records.
• Analytics and ad measurement: under the retention settings in our Google and Meta accounts.

Keeping it safe

Access is limited to the people who need it. Connections to your platforms use the platforms’ own secure methods, and credentials are stored separately from the data. Client data is separated by client in our database, and each workspace runs on its own server with its own storage. No system is perfectly secure, and we won’t pretend otherwise — but if something goes wrong that puts you at risk of serious harm, we will tell you and the Office of the Privacy Commissioner, as the law requires.

Your rights

You can ask us to:

• tell you what personal information we hold about you;
• give you a copy of it;
• correct it if it’s wrong;
• delete it, where we’re not required to keep it;
• stop emailing you.

Email tom@getjunction.ai and we’ll respond within 20 working days, which is the New Zealand legal limit. There’s no charge.

If you are a customer of one of our clients, we probably hold your information on their behalf — so contact them first. Ask us and we’ll point you to the right place.

Cookies

Google Analytics and the Meta Pixel stay off until you choose “Allow analytics”. “Essential only” leaves them off. We store your choice in your browser so we do not ask on every page, and the “Cookie choices” button lets you review it later.

Children

We sell to businesses. This site isn’t aimed at children and we don’t knowingly collect their information.

Changes to this policy

If we change how we handle information, we’ll update this page and change the date at the top. If the change is significant and we have your email address, we’ll tell you directly.

Contact us, or complain

Our privacy officer is Tom Hall-Taylor. Email tom@getjunction.ai, or write to Junction Central Limited, 17 Norfolk Street, Ponsonby, Auckland, New Zealand.

If you’re not happy with how we’ve handled it, you can complain to the New Zealand Office of the Privacy Commissioner. In Australia, you can complain to the Office of the Australian Information Commissioner.