Legal

Privacy Policy

Template. This document is a starting point and has not been reviewed by a lawyer. Have it reviewed before you rely on it. Last updated July 2026.

This policy explains what we collect, why, and your choices. We handle personal information in line with the New Zealand Privacy Act 2020.

What we collect

Account details — your email address (and name, if you provide one) via passwordless sign-in.
Project data — the drawings you upload and the reviews, findings and settings you create.
Usage & billing — basic operational logs and, if you buy credits, payment records held by our payment processor (we don’t store card numbers).

How we use it

To provide the Service — read your drawings, run reviews, and keep your projects.
To operate, secure and improve the Service.
Not to train AI models. Your drawings and project data are used to produce your review; they are not used to train any model.
Aggregate, de-identified insights. We may compile anonymised, aggregate statistics — for example how often a particular standard clause is flagged across all reviews — to improve the Service and to share such aggregate insights (including with the publishers of the standards). These contain no project, client or personal identifiers, and are only produced at a volume that prevents any individual project from being identified.

Storage & access

Data is stored with our infrastructure provider (Supabase). Records are protected by row-level security so each account can access only its own projects and reviews. Access by us is limited to what’s needed to operate and support the Service.

Third parties

Authentication — Google sign-in and email links, for account access.
AI provider — drawings are sent to our AI provider to be read; under our arrangement they are not used to train models.
Payments — a payment processor (e.g. Stripe) handles purchases; they receive the data needed to take payment.

Retention & deletion

You can delete a project at any time — this immediately removes its review and findings and permanently deletes the original uploaded drawings from storage. Separately, uploaded drawings are automatically deleted from storage 30 days after a review completes; your saved reports remain in your account. Ask us and we’ll delete your account and associated data, except where we must retain records to meet legal obligations.

Your rights

You may request access to, or correction of, the personal information we hold about you. Contact us and we’ll respond within the timeframes the Privacy Act requires.

Cookies

We use only essential cookies — your session (to keep you signed in) and your theme preference (day/night). No third-party advertising cookies.

Contact

Privacy questions or requests: contact@dccopilot.co.nz.