Legal

Privacy Policy

ShiftCurve Ltd ("we", "us", "our") is committed to protecting the privacy of our clients and website visitors. This policy explains how we collect, use, store, and protect your personal information in accordance with the New Zealand Privacy Act 2020.

Last updated: 21 October 2026

Information We Collect

  • Contact details - name, email, phone number, and business details provided via our contact form or direct engagement
  • Project data - documents, financials, legal materials, and other inputs you provide for document generation
  • Website analytics - usage data, such as pages visited and how you found us, collected via Google Analytics (GA4)
  • We use Google Analytics and Google Ads conversion tracking. These set cookies to measure visits and enquiries. Google may also use them to show our ads to people who have visited this site. You can block or delete them in your browser settings.

How We Use Your Data

  • To deliver the services you have engaged us for, including document generation and website builds
  • To communicate with you about your project
  • To improve our services and measure our advertising

Important commitments

  • We do NOT use your data to train AI models
  • We do not sell your data. We share it only with our staff and contractors who work on it, the service providers we use to deliver our work (listed below), and where the law requires it.

Where Your Data Is Stored

  • Supabase - our databases and file storage, hosted on AWS. Japan (Tokyo) for enquiries from this website, our CRM and a retired test database; Australia (Sydney) for Dendra, Compound, Sightra and the client websites we host; India (Mumbai) for Bilimoria Consulting's leads and workflow records. We are moving the Japan and India databases to Australia.
  • Google Workspace - email communications
  • Some of our service providers store data overseas, mainly in the United States, Japan, Australia and India (see Third-Party Services below)
  • We use reasonable security measures, including encryption in transit and at rest with our main storage providers

Data Retention

  • When a service ends, we return or delete your customers' and leads' data within 30 days, unless we need to keep it by law or for our reasonable audit records
  • Final documents made for you are yours once they are paid for
  • You can ask us to delete your data at any time

Your Rights (NZ Privacy Act 2020)

Under the New Zealand Privacy Act 2020, you have the right to:

  • Access your personal information
  • Request correction of inaccurate information
  • Request deletion of your data
  • Know how your data is being used

For any privacy requests, contact us at privacy@shiftcurve.co.nz

If you are not satisfied with our response, you can complain to the NZ Privacy Commissioner at privacy.org.nz

Data Breach Notification

If a privacy breach involving personal information we hold is likely to cause serious harm, we will notify the people affected and the NZ Privacy Commissioner, as the Privacy Act 2020 requires. If a breach materially affects a client's data, we tell that client without undue delay and help them meet their own notification duties.

Third-Party Services

We use service providers in the following categories to run this website and deliver our work. We can give clients a current list of specific providers on request.

Hosting (Vercel)

Website and app hosting and deployment. United States, and Australia (Sydney) for our Compound and Sightra apps and our CRM.

Source control (GitHub)

Website and application code. United States.

Database and storage (Supabase)

Database and file storage, hosted on AWS. Japan (Tokyo) for this website's enquiries, our CRM and a retired test database; Australia (Sydney) for Dendra, Compound, Sightra and client websites; India (Mumbai) for Bilimoria Consulting's leads and workflow records. We are moving the Japan and India databases to Australia.

Analytics and advertising (Google)

Google Analytics 4, Google Tag Manager, Google Search Console and Google Ads, including the tags on this website. United States.

AI tooling (Anthropic, OpenAI)

Our services, and our tools for assessing and replying to enquiries and drafting content, use their commercial APIs. Our team also uses their subscription plans (Claude, and ChatGPT including Codex) for internal operations and development. United States.

AI document review (Google Gemini)

A second review of legal and contract documents, through Google's Gemini API on Google's paid terms. United States and other countries where Google or its providers have facilities.

Email (Google Workspace, Resend)

Email and notifications. Google Workspace: United States and other countries. Resend, a United States company, sends our email from Japan (Tokyo).

Error monitoring (Sentry)

Error reports, logs and performance data from our Compound and Sightra apps. For Compound, these may include your IP address, cookies and request headers. United States.

Internal notifications and workflow

The details you send through our contact form, such as your name, contact details and message, are saved in our database and emailed to our team. An AI model (Anthropic, through its commercial API) reviews your enquiry together with public information from your business's website, and may write and send our first reply and up to two follow-ups automatically, without a person checking them first, reading your replies to do so. Your name, contact details and a short AI summary of your enquiry, and short extracts of any emails we then exchange with you, are posted to our team's private alerts on Telegram, which stores messages outside New Zealand.

Emails sent to our team may also be posted to these alerts, with the sender, subject and a short extract. Some emails are read and acted on by our AI agents, and some of our replies are written and sent by them automatically.

Meeting voice and transcription (ElevenLabs)

When our AI assistant takes part in an online meeting, the meeting audio is sent to ElevenLabs to be transcribed, and ElevenLabs turns the assistant's replies into speech. United States.

Web search (Brave)

Our AI assistants search the web through Brave Search. Searches can include details from client work, such as a property address. United States.

Client CRM

Your existing CRM or lead pipeline tool, where you ask us to connect it. Location depends on the tool.

AI-Specific Data Handling

  • Our Dendra service uses Anthropic's commercial API, and some of our other tools use Anthropic's or OpenAI's commercial APIs. Under those terms, API data is not used by default to train their models, and they keep logs only for a limited time under their own policies
  • Our team also uses AI assistants on subscription plans (Anthropic's Claude, and OpenAI's ChatGPT including Codex) for internal operations and development. This work may involve information we hold, including client information, and is covered by those providers' consumer terms rather than their commercial API terms. The settings that allow Anthropic and OpenAI to use our Claude and ChatGPT conversations to train their models are switched off for our accounts
  • We also use Google's Gemini API as a second reviewer of legal and contract documents. Under Google's terms for its paid services, Google does not use what we send, or its responses, to improve its products, and keeps them for 55 days to detect misuse and for any disclosure the law requires. We send client documents to it only when our director has approved that for the matter
  • We do not fine-tune or train AI models on client data
  • Some of our services run automated AI workflows. Where a service publishes content for you, you approve it before it goes live, unless your service agreement says otherwise. Your service agreement sets out where human review applies.
  • You own data you provide to us. Outputs are subject to product-specific IP allocation set out in your service agreement (Master Services Agreement and the Schedule for that service).

Questions about this policy? Contact us at privacy@shiftcurve.co.nz or visit our contact page.