Privacy policy

1. Who we are

regulation.nz operates as an independent platform hosted on infrastructure in New Zealand / the European Union (Hetzner). We are not a New Zealand government agency.

2. Information we collect

We may collect:

• Email address (for magic-link sign-in and account identity)
• Name and message content (contact form)
• Correspondence you submit to regulators via Engage, My Account, or AI consultation
• Payment metadata via Stripe (we do not store card numbers)
• Technical logs: IP address, browser user-agent, timestamps (security and abuse prevention)
• Terms and Privacy Policy acceptance records (version, timestamp, email)

3. Purpose of collection (IPP 1–4)

We collect personal information only for lawful purposes connected with operating the platform: authentication, delivering services you request, processing payments, forwarding submissions to regulators, support, and improving security.

Where practicable, information is collected directly from you. Some regulator directory data comes from official public sources, not from you personally.

4. Disclosure (IPP 9–11)

We may disclose information to:

• Regulators you choose to engage (OIA, complaints, applications)
• Stripe (payment processing)
• Email delivery providers (magic links, notifications)
• Infrastructure providers hosting our servers (under contract)
• Authorities when required by law

5. We do not sell your data

We do not sell, rent, or trade personal information to marketers or data brokers.

6. Storage, security, and retention (IPP 5)

Data is held in encrypted databases with access controls. Active threads are retained while your account is in use. Statutory correspondence may be retained longer for dispute resolution and legal compliance. Contact us to request deletion subject to legal and audit obligations.

7. Overseas disclosure (IPP 12)

Some subprocessors (e.g. Stripe, email) may process data outside New Zealand. We use providers with appropriate contractual safeguards. AI inference may use configured model providers; citizen consultation content is processed to deliver your roadmap and is not sold for advertising.

8. Unique identifiers (IPP 13)

We assign internal identifiers (session tokens, thread IDs) solely for platform operation, not to merge your data with unrelated third-party datasets.

9. Access and correction (IPPs 6–7)

You may request access to or correction of personal information we hold. Use regulation.nz/contact or My Account where available. We will respond within a reasonable time as required by the Privacy Act 2020.

10. Cookies and analytics

We do not use advertising or cross-site tracking cookies. Session cookies are set when you sign in. We may collect aggregate server logs and privacy-respecting analytics on our own infrastructure — not third-party ad trackers. We do not use Vercel hosting or Vercel Analytics.

11. Automated processing and AI

AI consultation processes your inputs to generate roadmaps and drafts. You review outputs before submission. We do not make solely automated decisions with legal or similarly significant effects without human review on your side.

12. Privacy breaches (IPP 12)

If a notifiable privacy breach occurs, we will comply with the Privacy Act 2020 notification requirements and contact affected users where required.

13. Children

The platform is intended for users 16 and over. If you believe a child has provided personal information without appropriate consent, contact us to request deletion.

14. Changes to this policy

We may update this Privacy Policy. The version and effective date appear below. Material changes may require re-acceptance before sign-in.

15. Privacy enquiries and complaints

Privacy enquiries: regulation.nz/contact (subject: privacy). You may also complain to the Office of the Privacy Commissioner (privacy.org.nz) if unsatisfied with our response.