Privacy Policy

Last updated: [date]

1. About This Policy

1.1 This policy explains how Fractional Law Limited (we, us, our) collects, uses, shares and protects personal information when you use CPD Log (the Service). It should be read with our Terms of Use.

1.2 We comply with the Privacy Act 2020 and its information privacy principles. Fractional Law Limited is the agency responsible for your personal information.

1.3 Our Privacy Officer is [name]. You can contact them at [privacy email] or Fractional Law Limited, PO Box 102 144, North Shore Mail Centre 0745.

2. The Short Version

• We collect what we need to keep your CPD records and run your account. Nothing more.

• Your records and reflections are private to you. We don't read them, sell them, advertise with them, or use them to train AI.

• We never see your full card number. Our payment provider handles that.

• We use a small number of service providers, some overseas. They are listed in clause 6.

• You can see, correct, export or delete your information at any time.

3. What We Collect

3.1 Account information: your name, email address, profession, and the CPD framework and year you use (for example, NZLS, with a 1 April to 31 March year).

3.2 Your content: activity records, hours, dates, providers, learning plans, reflections, notes, uploaded files and photos, and emails you forward to your CPD Log address (including attachments).

3.3 Billing information: if you buy a paid plan, your billing name and email, plan, payment history, and the card type and last four digits. Your full card details are collected and held by our payment provider, not by us.

3.4 Technical information: sign-in records, IP address, browser and device type, and logs of errors and security events. We use this to run and protect the Service.

3.5 Messages to us: anything you send us in support requests or feedback.

3.6 You don't have to give us any of this. But we can't provide the Service without an email address, and we can't keep your records without your content.

4. Information About Other People

4.1 Your content may include information about other people. For example, a forwarded course confirmation or certificate may include a presenter's or provider's name and contact details, or other attendees' names.

4.2 We hold that information only as part of your record, and use it only to provide the Service to you. We don't contact those people, build profiles about them, or use their information for any other purpose.

4.3 If you think we hold information about you because a CPD Log user forwarded or uploaded it, you can contact our Privacy Officer.

4.4 If you are a user: please don't upload more information about other people than your record needs (see Terms of Use clause 4.4).

5. How We Use Your Information

5.1 We use your information to:

• (a) create and run your account, and sign you in;

• (b) store, organise and display your CPD records, and produce exports and reports you ask for;

• (c) turn forwarded emails, photos and chat messages into draft records, using automated tools and AI;

• (d) send you service messages, such as sign-in links, reminders you have set, renewal notices and changes to our terms;

• (e) process payments and keep financial records;

• (f) respond to support requests;

• (g) keep the Service secure, and prevent and investigate misuse; and

• (h) comply with the law.

5.2 We may use information about how the Service is used (for example, which features are used and how often) to improve it. We do this using aggregated or de-identified usage data, not the content of your records or reflections.

5.3 We will only send you marketing emails if you have agreed. Every marketing email will have an unsubscribe link.

6. Who We Share It With

6.1 We don't sell personal information. We share it only as set out below.

6.2 Service providers. We use these providers to run the Service. They act on our behalf and may only use your information to provide their services to us:

Provider	What they do for us	Where data is held
Supabase	Database, sign-in and file storage	[Sydney, Australia — confirm region]
Vercel	Website hosting	[United States / global — confirm]
Postmark	Receiving forwarded emails; sending service emails	[United States — confirm]
Anthropic	AI processing of forwarded emails, photos and chat messages	[United States — confirm]
[Stripe]	Payment processing	[United States and other locations — confirm]

6.3 Your professional body or employer. Only if you choose to send them your records, for example by exporting a report and giving it to them. We don't share your records with them directly.

6.4 Where the law requires. If we are legally required to disclose information (for example, under a court order or statutory notice). Where we can, we will tell you first (see Terms of Use clause 5.5).

6.5 If our business is sold. To a buyer of all or part of our business, who must protect your information in line with this policy.

6.6 With your agreement. In any other case, only if you ask us to or agree.

7. Storage and Transfers Outside New Zealand

7.1 Some of our service providers store or process information outside New Zealand, in the places listed in clause 6.2.

7.2 Where we send personal information overseas, we take reasonable steps to make sure it is protected in a way that is comparable to the Privacy Act 2020, for example through contractual commitments from the provider.

8. AI Processing

8.1 When you forward an email, upload a photo or use chat to log an activity, the content is sent to our AI provider to be read and turned into a draft record.

8.2 Our AI provider may not use your content to train its models. [It keeps submitted content for no more than x days, for safety and abuse monitoring, and then deletes it — confirm against provider terms.]

8.3 Reflections you write are not sent to our AI provider unless you use a feature that asks AI to help with them. [Confirm this matches how the app is built.]

8.4 The AI produces drafts only. Nothing is finalised in your record without you being able to check it.

9. Reflections and Sensitive Information

9.1 Reflections can be personal. We treat them as private to you (see Terms of Use clause 5.4).

9.2 The Service doesn't need health information or other sensitive personal details. Please don't include them in your records or reflections, or information that is confidential to a client or employer.

9.3 Our staff and contractors can only access your content where you ask us to (for a support request), where it is necessary to keep the Service secure or working, or where the law requires it. Any access is limited to what is needed and is logged.

10. Security

10.1 We protect your information with measures including:

• (a) encryption in transit and at rest;

• (b) database rules that stop one user's records being visible to another user;

• (c) passwordless sign-in links sent to your email; and

• (d) limited, logged access for our own staff and contractors, with multi-factor authentication.

10.2 No system is completely secure. If a privacy breach is likely to cause serious harm, we will notify the Privacy Commissioner and affected users as soon as practicable, as the Privacy Act 2020 requires.

11. How Long We Keep It

11.1 We keep your account information and content while your account is open.

11.2 When your account closes, we keep your content for an export period and then delete it, as set out in Terms of Use clause 14. Backup copies are deleted within [90] days after that.

11.3 We keep billing and tax records for 7 years, as New Zealand tax law requires.

11.4 We keep security logs for up to [12] months.

12. Your Rights

12.1 You can ask for a copy of the personal information we hold about you, and ask us to correct it. Most of it you can see, correct, export or delete yourself in the Service.

12.2 For anything else, contact our Privacy Officer. We will respond within 20 working days. We may need to confirm your identity first.

12.3 If you are not happy with how we have handled your information, please contact us first so we can try to fix it. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

13. Cookies

13.1 We use only the cookies we need to sign you in and keep the Service working. We don't use advertising or cross-site tracking cookies. [If we add analytics, describe them here.]

14. Age

14.1 The Service is for adults. We don't knowingly collect information from anyone under 18.

15. Changes to This Policy

15.1 We may update this policy. If a change materially affects how we use your information, we will email you before it takes effect. The date at the top shows when the policy was last updated.

16. Contact Us

16.1 Privacy Officer, Fractional Law Limited, PO Box 102 144, North Shore Mail Centre 0745. Email: [privacy email].