Privacy
Privacy statement
Last updated 1 October 2026
This statement explains how AI New Zealand Limited (NZBN 9429046253156) collects, uses, shares and keeps personal information on certify.newzealand.ai, our course and certificate platform. It covers learners, people who manage seats or sign agreements for an employer, and anyone who checks a certificate. It follows the Privacy Act 2020 and its information privacy principles.
The short version
- A person at AI New Zealand decides your final assessment. AI prepares draft feedback and notes. It never decides a result.
- If your employer arranged your seat, they see your progress and outcome. They do not see your answers, transcripts or assessor comments unless you ask us in writing to share them, or the law requires it.
- Your data is stored in Sydney, Australia. Some services we use process data in the United States. We name them below.
- We do not use your material to train any AI model.
- You can download your data, and ask us to correct or delete it, at any time.
Who we are
AI New Zealand Limited, 16a Gazelle Ave, Beach Haven, Auckland 0626. Our privacy officer is Justin Flitter, Founder. Email privacy@newzealand.ai.
What we collect
| Information | Where it comes from |
|---|---|
| Your name and email address | You, when you register or accept a seat. Your employer, if it invites you or approves a seat request |
| The role and organisation you give at enrolment | You |
| Course progress: lessons completed, quiz answers and scores | You, as you learn |
| Practical checkpoint answers, and any PDF you attach | You |
| AI-generated draft feedback on those checkpoints | Created by us |
| Final assessment answers: your written critique and your typed answers, with timing | You |
| Assessor decisions and comments, and any AI-prepared notes for the assessor | Created by us |
| Certificate records: the name on the certificate, course, issue date, credential code, status, and how often it has been checked | Created by us |
| Payment records: amount, GST, coupon used, receipt and tax invoice | You and Stripe. We never see your full card number |
| Your acceptance of these terms and notices, with the time, IP address and browser | Your device |
| Sign-in and security records: sign-in times, IP address, browser, and actions you take in your account | Your device |
| Your choices: whether redacted extracts of your marked final assessment may be used to calibrate the AI-prepared assessor notes | You |
| Messages you send us: support questions, refund requests, complaints and privacy requests | You |
| Safety alerts: a record that an answer was flagged as suggesting a possible risk to you or someone else, and any follow-up | Created by us |
| If you manage seats or sign an agreement for an employer: your name, title, work email, drawn signature, IP address, browser, and the actions you take as an administrator | You, or your organisation |
| If you check a certificate: the name and code you enter, and when | You |
We do not use voice, face or writing to identify you, or to infer emotion, mood or personality. This means we do not carry out biometric processing under the Biometric Processing Privacy Code 2025.
Why we use it
- To run your account and sign you in.
- To deliver the course, track your progress and unlock sections.
- To give feedback on checkpoints and mark your final assessment.
- To issue, verify and, where necessary, revoke certificates.
- To take payment, issue tax invoices and meet our tax record-keeping duties.
- To show your employer the limited information described below, if your employer arranged your seat.
- To keep the platform secure and prevent misuse.
- To alert a named person at AI New Zealand if an answer suggests that you or someone else may be at risk (see Safety alerts below).
- To answer your questions, handle refunds and complaints, and respond to privacy requests.
- To look into suspected breaches of our terms, such as work that is not your own, and to meet our legal obligations.
- To calibrate the AI-prepared assessor notes, so marking stays consistent, an assessor may choose short extracts from marked final assessments and remove names, employers and any identifying detail. We use extracts only from learners who opted in by ticking the box in their profile. It is off unless you tick it, and if you untick it we stop using your extracts and remove them from the calibration set within 30 days.
We collect only what these purposes need (IPP 1). We collect it from you wherever we can (IPP 2), and we tell you this before we collect it (IPP 3). Giving us information is up to you, but without your name and email we cannot enrol you, and without your answers we cannot assess you or issue a certificate. The notice before the final assessment repeats the key points.
How AI is used
- Checkpoint feedback. Your checkpoint answers, and the text of any PDF you attach, are sent to Anthropic's Claude to generate draft feedback. It is labelled as AI-generated draft feedback. It decides nothing, and it is never shown to your employer or used on your certificate.
- Final assessment. Your assessment answers may be sent to Claude to prepare notes for your assessor. The assessor records their own view first. The notes never include a score or verdict, and a person decides every result. The notes may flag things for the assessor to check, such as an answer that seems off-topic, or one that might not be your own work. A flag is never a decision.
- Employer AI guidelines. If your employer supplies its AI guidelines, Claude helps turn them into an extra assessment criterion. Your employer confirms it and we approve it before it is used.
- We do not send your name or email address to Claude with your answers. Your answers can still contain details you choose to write, so please do not include other people's personal information.
- We do not use your material to train any AI model, and Anthropic's commercial terms do not allow it to train on what we send. Anthropic keeps what we send only for a limited period, mainly for safety and abuse monitoring, and then deletes it.
If you think a result is wrong, you can use "Query this result". A different assessor then reviews your work.
Safety alerts
If something you write suggests that you or someone else may be at risk of serious harm, our system alerts a named person at AI New Zealand. The alert does not copy your words. That person reads the answer and may contact you. If we believe on reasonable grounds that it is necessary to prevent or lessen a serious threat to someone's life, health or safety, we may share the minimum information needed with emergency services or another appropriate person (IPP 11). We keep alert records for 12 months after the alert is closed.
Who sees your information
| Who | What they see |
|---|---|
| You | Everything we hold about you, through your account and the data download |
| AI New Zealand staff | Staff who deliver, mark and support courses. Assessors see your work to mark it. Staff opening a file you uploaded is logged |
| Your employer, if it arranged your seat | Your name, work email, the role you gave, the course, registration date, progress by section, completion date, outcome (Pass, Revision requested, Re-sit requested, Awaiting result or Not yet submitted) and certificate date. An outcome and the certificate date appear only once two working days have passed since we told you; until then your employer sees "Awaiting result". We do not give your employer your answers, transcripts, checkpoint feedback or assessor comments unless you ask us in writing to share them, or the law requires it. Every time an employer administrator opens their list of people, it is logged |
| Anyone you give your credential code to | Your name, course, issue date, course outline, the assessments you completed and whether the certificate is current, expired or revoked. They must enter both your name and the code. Never scores or comments |
| Our service providers | Only what each needs to do its job (see below) |
| Professional advisers and insurers | Our lawyers, accountants and insurers, where they need it to advise us or handle a claim, under a duty of confidence |
| Government agencies, courts and police | Only where the law requires or allows it, for example a court order, or to prevent a serious threat to someone's safety |
| A buyer of our business | If we sell or restructure the platform, the buyer, who must keep handling your information as this statement describes |
We do not sell your information. We do not share it for advertising. We disclose it outside these uses only if you agree, or if the law requires or allows it (IPP 11).
Where it is held and who processes it
Our database, file storage and servers are in Sydney, Australia. We use these providers:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | Sydney, Australia (Supabase Inc. is a US company) |
| Netlify | Hosts the website and runs our server code | Server code runs in Sydney. Web pages are delivered from locations near you. Netlify Inc. is a US company |
| Anthropic (Claude) | Draft checkpoint feedback, assessor notes, and turning employer guidelines into a criterion | United States |
| Stripe | Card payments | United States and other countries where Stripe operates |
| Resend | Sends our emails, including your sign-in codes | United States |
| Vimeo or YouTube | Plays course videos, where a lesson has one | United States. We use their privacy-enhanced players |
| Microsoft 365 | Our email and staff accounts. Messages you send us are held there | Australia (Microsoft Corporation is a US company) |
Most of these providers hold or process your information only on our behalf and under contract, and are not allowed to use it for their own purposes. Under section 11 of the Privacy Act we are treated as still holding that information. Two providers also use some information for their own purposes under their own privacy policies: Stripe, for example to prevent fraud and meet its legal obligations, and YouTube or Vimeo when you play a video. Those are disclosures overseas under IPP 12. Australia and the United States do not have privacy laws identical to ours, so we choose providers with published security certifications and contractual privacy and security commitments, send only what each needs, and remain responsible for your information.
How we keep it safe (IPP 5)
- Our database uses row-level security, so you can reach only your own records.
- Staff sign in through AI New Zealand's Microsoft accounts. You sign in with a one-time code.
- Files you upload and certificates are kept in private storage and downloaded through short-lived links.
- Important actions, such as results, certificates, exports and employer views, are logged.
- If a privacy breach is likely to cause serious harm, we will tell you and the Privacy Commissioner as soon as practicable after we become aware of it, as the Privacy Act requires.
How long we keep it (IPP 9)
| Information | How long |
|---|---|
| Final assessment answers and transcripts | 24 months after the attempt is decided, then the text is removed. A fingerprint (hash) of the evidence stays with the certificate record |
| Checkpoint answers, attached PDFs and their feedback | 24 months after you complete the course. If you never complete it, 24 months after your last activity in it |
| Certificate records | 7 years after issue, so the verification page can confirm a certificate was issued and when, including after it expires |
| Agreement and terms acceptances | 7 years |
| Payment records and tax invoices | 7 years, as tax law requires |
| Sign-in and security logs | 2 years, or longer if needed for an investigation or legal claim |
| Invitations you never accepted | 12 months after the invitation is sent, or sooner if your employer withdraws it |
| Messages, refund requests and complaints | 2 years after the matter is closed, or 7 years where it forms part of a payment record |
| Safety alert records | 12 months after the alert is closed |
| Calibration extracts | Until you untick the box, or 24 months after the extract is taken, whichever is sooner |
| Your account | While you have an enrolment or certificate with us. You can ask us to close it at any time |
Your rights (IPPs 6, 7 and 8)
- Access. Download your data from My account, Privacy and your data, or ask us for anything we hold, including assessor notes.
- Correction. Ask us to correct anything that is wrong. If we do not agree, you can ask us to attach a statement of the correction you wanted.
- Deletion (our commitment, not a legal requirement). Ask us to delete your information. We delete your answers and transcripts. We keep the records the law requires, and the record of any certificate issued so it can still be verified or shown as revoked.
- We respond to access and correction requests within 20 working days, as the Privacy Act requires (we may extend this in limited cases, and will tell you why), and usually much sooner.
- Before we use information, we take reasonable steps to check it is accurate (IPP 8). That is one reason a person decides every result.
Unique identifiers (IPP 13)
We give each certificate a credential code so it can be verified. We do not use any government identifier, and we do not ask for one.
Cookies
Our own platform uses only the cookies it needs: one that keeps you signed in and one that protects forms against forgery. We do not use advertising or tracking cookies. Two providers set their own cookies or similar browser storage: Stripe when you pay, to help prevent fraud, and YouTube or Vimeo when you play a course video, even though we use their privacy-enhanced players.
If your employer gave us your details
If your employer invited you or approved your seat, we received your name and work email from them. The invitation email tells you this, and a notice repeats it before you accept the seat. It names your employer, any guidelines of theirs that apply to your assessment, what they will see, why we have your details, and how you can access or correct them (IPP 3A). If you do not accept an invitation, we delete your details as set out in How long we keep it.
Complaints
Talk to us first: privacy@newzealand.ai. If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz using its online complaint form.
Changes
We will update this statement when our practices change, and email you before any significant change takes effect.