Privacy Policy

Last updated: 23 August 2026

This policy explains what personal information is collected through tim.mudford.me and through the AI voice and messaging systems operated by Tim Mudford Consulting Limited, why it is collected, who it is shared with, and what you can do about it. It is written to meet the New Zealand Privacy Act 2020.

1.Who this policy is from

This website and the services described in it are operated by Tim Mudford Consulting Limited (NZBN 9429053901118), a company registered in New Zealand, trading as Tim Mudford — referred to below as “we”, “us” or “I”.

We are the “agency” responsible for the personal information described here for the purposes of the Privacy Act 2020. Questions, requests and complaints all go to the same place: tim@mudford.me.

2.Information collected through this website

The contact form

The form on the front page asks for your name, email address, and optionally your company, the kind of help you are after, and a message. At present that form does not transmit anything to a server of ours: submitting it opens a pre-filled message in your own email client, and nothing is sent until you press send there. Once you do, the message sits in our email inbox like any other email.

Server logs

The web server records ordinary request information — your IP address, the page or file requested, the time, and your browser's user-agent string. This is standard web server logging, used to keep the site working and to spot abuse.

Media hosting

The video that plays as you scroll is served from Amazon Web Services (Amazon S3, in the us-east-1 region in the United States) rather than from this host. When your browser fetches those files, AWS receives your IP address and request details under its own logging.

3.The AI voice assistant on this site

The orb on the contact section starts a live voice conversation with an AI assistant. It does nothing until you tap it. When you do:

Your browser asks for permission to use your microphone. If you decline, no audio is captured and no call takes place.
Your audio is streamed in real time over WebRTC to our voice server at voice.mudford.me, where it is converted to text, answered by a language model, and answered back to you as synthesised speech. Transcripts of the conversation are produced as part of that process.
Establishing the connection uses public STUN servers operated by Cloudflare and Google. Those servers see network connection information (such as your IP address) but not the contents of the call.
The call ends when you tap the orb again or leave the page. Audio is processed for the duration of the call; we keep conversation transcripts only where we need them to follow up on an enquiry you made, or to diagnose a fault.

Please treat it as a conversation with a business, not a confidential channel: do not give the assistant sensitive personal information such as health information, financial account details, passwords or government identifiers.

4.Phone calls, SMS and mobile numbers

We build and operate AI voice assistants that answer the phone for client businesses. One of those is deployed for Vertical Arborists, which answers calls to its 0800 number. This section covers the personal information handled in that workflow, and applies to any similar deployment we operate.

How consent to receive an SMS is obtained

During a phone call that you placed to the business, the voice assistant may offer to text you a piece of information you have asked for — for example, the email address to send photos to. It asks first. If you say yes and provide your mobile number, that verbal agreement is your consent to receive that one message. If you say no, nothing is sent. Consent is never assumed, pre-ticked, bought, or inferred from a list.

What is collected

The mobile number you read out during the call.
A record that you consented, and when — kept as proof of consent.
The content of the single message sent to you, and its delivery status.
Call audio and transcript, as described in section 3.

How mobile numbers are handled

No mobile information will be sold or shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party.

Mobile numbers are disclosed only to the telecommunications provider that is required to deliver the message you asked for — currently Telnyx — and to your own mobile carrier. That is a delivery function, not a marketing one.

One message, not a subscription

This is a one-time transactional message sent at your request. It is not a marketing programme and there is no recurring campaign. You will not receive further messages as a result of opting in, so there is nothing to unsubscribe from — but you can still reply STOP to any message to block future ones, and HELP for assistance. Standard message and data rates from your carrier may apply.

Where we sit

Where a client business is the one calling customers and holding the relationship, that business is the agency responsible for the personal information, and we handle it on their behalf and on their instructions. Their own privacy policy applies to their customers alongside this one.

5.Why the information is collected

Personal information is collected only for purposes connected to running this business:

To answer your enquiry and, if it goes that way, to quote for and deliver consulting work.
To send you the single SMS you asked for during a call, and to prove that you asked for it.
To operate, secure, debug and improve the website and the voice systems.
To meet legal, tax and record-keeping obligations.

We do not use your information for automated decision-making that has a legal or similarly significant effect on you, and we do not sell personal information to anyone, for any purpose.

Information is shared only with the service providers needed to run the things described above, and only to the extent they need it:

Telnyx — voice call routing and SMS delivery.
Amazon Web Services — hosting of the site's video assets.
Speech and AI model providers — speech-to-text, language model and text-to-speech processing for the voice assistant.
Google — the email account our correspondence arrives in.
The client business whose phone line you called, where the assistant is answering on their behalf.

We may also disclose information where the law requires it, or where it is necessary to prevent a serious threat to someone's safety. Beyond that, it stays with us.

7.Overseas storage and disclosure

Several of the providers listed above are based outside New Zealand, principally in the United States, so your information may be stored or processed overseas. Before disclosing personal information to an overseas provider we take reasonable steps to satisfy ourselves that it is subject to comparable safeguards, as required by information privacy principle 12 of the Privacy Act 2020 — ordinarily through the provider's contractual data protection terms.

8.How long it is kept

Enquiries and correspondence: for as long as the relationship is live, and then for as long as we may need it for tax and legal record-keeping.
SMS consent records: retained as proof that consent was given, for as long as required by our telecommunications provider and applicable messaging rules.
Call audio and transcripts: kept only as long as needed to act on the call or diagnose a fault, then deleted.
Server logs: a short rolling window for security and troubleshooting.

We do not keep personal information for longer than we have a lawful purpose for it.

9.Security

The site is served over HTTPS, and voice calls are encrypted in transit. Access to enquiry email and to the voice systems is restricted and protected by strong authentication. No system is perfectly secure, but if a privacy breach occurs that is likely to cause serious harm, we will notify the people affected and the Office of the Privacy Commissioner as the Privacy Act requires.

10.Your rights: access, correction, complaints

Under the Privacy Act 2020 you have the right to ask what personal information we hold about you, to get a copy of it, and to ask us to correct it if it is wrong. Email tim@mudford.me and we will respond within 20 working days. There is normally no charge. We may need to confirm your identity before releasing anything.

You can also ask us to delete information we no longer need. If you are not happy with how we have handled your information or your request, you can complain to the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909).

11.Cookies and browser storage

This site sets no cookies and runs no analytics, advertising or tracking scripts. There is no tracking pixel, no ad network, and no third-party analytics account behind this page.

The site does use two ordinary browser storage features on your own device, purely so the film does not have to be downloaded again on every visit: a localStorage entry noting which clips have already been fetched, and the browser's Cache Storage holding the clips themselves. Neither contains personal information and neither is transmitted to us. Clearing your browser's site data removes both.

12.Children

This site and these services are aimed at businesses and are not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

13.Changes to this policy

We may update this policy as the site and the services change. The current version always lives at tim.mudford.me/privacy.html, and the date at the top tells you when it last changed. Material changes will be reflected there before they take effect.

14.Contact

Privacy officer: Tim Mudford
Tim Mudford Consulting Limited, NZBN 9429053901118
Email: tim@mudford.me
New Zealand