Iris is designed for organisations that manage screens and passenger information. Account administrators decide what content, users, screens and transport configurations are added to their workspace.
1. Who this policy covers
This policy applies when you visit the Iris website, create or use an Iris account, manage an organisation’s workspace, operate an Iris player or use related support, transport and API services.
In this policy, “Iris”, “we”, “our” and “us” refer to Iris C4 Hub. If your account is provided by an employer or another organisation, that organisation may also have its own privacy obligations and policies.
2. Information we collect
Account and contact information
We may collect your name, email address, organisation details, login and authentication information, account role, support messages and communication preferences.
Subscription and transaction information
We keep plan, subscription, invoice and payment-status information needed to administer paid services. Card details are handled by the payment provider and are not stored as full card numbers by Iris.
Content and configuration data
This includes screens, media, playlists, schedules, layouts, alerts, menu content, API settings, transport providers, stops, routes, onboard configurations, advertising assignments, audio settings and other material you add to the service.
Device, usage and security data
We may collect IP address, browser and device information, player identifiers, pairing and connection status, screen heartbeats, command activity, error details and security events. This helps us operate, protect and troubleshoot the service.
Information from connected sources
If you connect transport feeds, maps, media, websites or other services, Iris receives the information needed to provide that connection. Public transport data may come from government agencies and transport providers rather than from you directly.
3. How we use information
We use information where it is reasonably necessary to:
- create, authenticate and administer accounts;
- provide the CMS, players, media delivery, transport, onboard, audio and API features you configure;
- process subscriptions and maintain billing records;
- monitor availability, diagnose faults and improve reliability;
- protect accounts, players and the service from misuse or unauthorised access;
- respond to support, privacy and account requests;
- send essential service, security and billing notices; and
- meet legal, regulatory and record-keeping obligations.
We do not sell personal information.
4. Transport and location data
Onboard features can use device location, route, trip, direction, vehicle or fleet identifiers, stop progress and journey events. This information is used to select and update the passenger display, trigger configured announcements or advertising, detect off-route operation and support diagnostics.
Location access must be enabled on the player device before Iris can receive location data. Account administrators control whether diagnostic logging is enabled and are responsible for ensuring that deployed devices and notices meet their organisation’s obligations. Short-term GPS diagnostic logs are normally retained for the period shown in the CMS.
5. When information is shared
We may share information with service providers that help us operate Iris, such as hosting, storage, email delivery, payment processing, mapping, transport data and text-to-speech providers. They receive only the information needed for their role and are expected to protect it.
Information may also be disclosed when you direct us to connect or publish content, when required by law, to investigate security or misuse, to protect people or the service, or as part of a business restructuring where appropriate safeguards apply.
Some providers may process information outside New Zealand. We take reasonable steps to use reputable providers and appropriate protections for those disclosures.
6. Storage, security and retention
We use reasonable administrative and technical safeguards designed to protect information from loss, unauthorised access, misuse, alteration and disclosure. No online service can guarantee absolute security, so account owners should also use strong credentials, restrict user access and protect player and API keys.
We retain information for as long as it is needed to provide the service, maintain security and transaction records, resolve disputes and meet legal obligations. Retention periods vary by data type. Information may remain in protected backups for a limited period after deletion.
7. Your choices and rights
You can update much of your account and workspace information in the CMS. You may also ask us to confirm whether we hold personal information about you, request access or correction, or ask a privacy question.
You can control browser cookies and storage through your browser. Disabling essential storage may prevent sign-in, session and player features from working.
Account administrators can remove users and content and may request account deletion through the available account controls or by contacting us. Some information may be retained where required for security, billing, legal or backup purposes.
8. Changes to this policy
We may update this policy when the service, providers or legal requirements change. The effective date at the top of the page shows the latest version. We will provide additional notice where a change materially affects how personal information is handled.
9. Contact us
For privacy questions, access or correction requests, or concerns about how information has been handled, email hello@irisc4.com. We may need to verify your identity before providing or changing personal information.
You may also contact the New Zealand Office of the Privacy Commissioner if you are not satisfied with a response.