Privacy Policy

1. Who we are

Deis is operated from the United States. Our primary application hosting for production is in Sydney, Australia (Vercel), chosen for proximity to New Zealand users. Personal information may be processed in the United States and other countries where our service providers operate.

2. Information we collect

Business users: work email address, organisation profile, NZBN where provided, lookup and compliance evidence (queries, pathways, timestamps, notifications), billing details via Stripe, and support communications.

Individual users (transparency portal): personal email address for magic-link sign-in, IPP 3A notifications you receive, access/correction requests (IPP 6/7), privacy queries, OPC complaint drafts, and related correspondence stored in your Deis inbox.

Lookup data: information returned from third-party sources when a business user performs a lookup is stored according to the business retention settings. Compliance evidence is typically retained for up to seven years.

Technical data: essential session identifiers (cookies), server logs, and security-related metadata. We do not use advertising or third-party analytics cookies on the website.

3. How we use your information

• To provide the Deis platform (lookups, evidence, IPP notifications, individual inbox).
• To send magic links, request notifications, and system emails.
• To help individuals prepare and lodge OPC complaints (draft storage, extension handoff).
• To process subscriptions and billing for business users.
• To operate AI-assisted features described on our How we use AI page.
• To check extension version compatibility when you use OPC or install features (version number only).
• To improve security, reliability, and the service.

4. DEIS browser extension

The optional DEIS extension (Chrome / Edge) helps business users transfer lookup results into external systems and helps individuals complete the Office of the Privacy Commissioner online complaint process.

What the extension does

• On www.deis.nz: receives complaint or lookup payloads you explicitly send from the website (via secure page messaging), stores them locally in your browser, and reports when an OPC form appears to have been submitted so Deis can update your inbox.
• On www.privacy.org.nz: shows an assistant panel to help map your Deis complaint draft to visible form fields. File uploads on the OPC site are not auto-filled; you attach documents yourself.
• On other websites (business bridge only): when you choose to load a lookup into an external portal, the extension may inject a helper on that tab only. It does not run on every page by default without your action.

Data stored in the extension

Complaint drafts and lookup-bridge payloads are held in chrome.storage.local on your device until cleared or overwritten. We do not sell extension data. Network calls from the extension to Deis use your existing Deis session cookie when you are logged in.

Permissions (summary)

• storage — save complaint/lookup handoff data locally.
• activeTab / scripting — inject the bridge helper only on the tab you are using.
• Host access — www.deis.nz, privacy.org.nz, and (for bridge) the target site you are filling.

The extension checks for a newer published version only when you use OPC filing or open our install page — not on a background schedule. Store-distributed copies update through Chrome/Edge when we publish a new version.

Extension install & update information →

5. OPC complaints

Saving a complaint on Deis is not the same as lodging it with the Privacy Commissioner. You must complete the official process on privacy.org.nz. The OPC requires complaints in your own words; Deis AI coaching and form assistance are aids only.

When you finish the OPC online form, the extension notifies Deis at the end of submission. We record when you lodged and monitor the usual 10 working day acknowledgment period in your Deis inbox — we do not conduct the investigation; OPC does.

6. AI and third-party processors

Generative AI (Anthropic Claude) is used in limited, disclosed ways — see How we use AI. We do not send your data to Anthropic for advertising or model training under our API terms.

We also use service providers for:

• Hosting and databases (e.g. Vercel)
• Email delivery (Resend)
• Payments (Stripe, business accounts)
• Maps / Places (Google, where configured for organisation search)

Business lookups may query third-party data sources; those providers have their own privacy practices.

7. Data storage and security

Data is encrypted in transit (TLS). Production data is hosted on managed cloud infrastructure with access restricted to authorised personnel. We apply session-based authentication for business and individual portals.

8. Retention

We retain information for as long as needed to provide the service, meet legal obligations, and maintain compliance evidence. You may request deletion of personal information subject to our legal and audit requirements.

9. Your rights (New Zealand)

Under the Privacy Act 2020 you may request access to and correction of your personal information. Contact us using the details below. You may also complain to the Office of the Privacy Commissioner.

10. Cookies

We use essential cookies for business and individual session management (deis_session, deis_individual_session). We do not use advertising or cross-site tracking cookies on the website.

11. Children

Deis is not directed at children under 16. We do not knowingly collect their personal information.

12. Changes

We may update this policy. The “Last updated” date will change when we do. Material changes may be communicated through the website.

13. Contact