Privacy Policy

Who we are

Mindstake Limited (NZBN 9429052959424), trading as Mindstake Whakatau ("Mindstake", "we", "us"), is a New Zealand company that provides a platform for multi-stakeholder decision making and impact reporting. This policy explains how we handle personal information on this website (mindstake.nz) and on the Mindstake platform.

For Māori organisations, this policy sits alongside Te Anga Mana Raraunga, our framework for Māori Data Sovereignty, which describes the additional obligations we hold for data connected to whakapapa, whenua, whānau, hapū and iwi.

Two ways we hold information

On our own behalf. When you visit this website, contact us or request a demo, we decide how that information is used and we are responsible for it.

On behalf of our clients. When an organisation uses the Mindstake platform, the survey responses, documents, recordings, transcripts and reports it places on the platform belong to that organisation. We hold and process that information only to provide the service to them, under our agreement with them and on their instructions. If your information was collected by one of our client organisations, that organisation is your first point of contact about it; we will help them respond.

What we collect

• Enquiries: your name, email address, organisation, phone number (if you give it) and message when you use the contact form or email us.
• Platform accounts: your name, email address and password (stored only as a one-way hash), the organisation that invited you, and your permissions.
• Platform content: information our clients collect and place on the platform, which can include survey answers, documents, audio and video recordings of interviews and hui, and their transcripts.
• Access records: when a signed-in user opens a report, document, recording or transcript, we record who, what, when, the IP address and the browser used. These records exist so our clients can see who has accessed their information.
• Technical information: IP address, browser type and server logs needed to run and secure the service.

How we use it

• To respond to your enquiry and to provide, support and improve the platform for our clients.
• To sign you in, send invitations, password resets and service notifications.
• To analyse and report on client information, as instructed by that client.
• To keep the platform secure, investigate misuse and meet our legal obligations.

We do not sell personal information, and we do not use it for advertising.

Where it is stored

Platform data is stored in New Zealand, on a server with a New Zealand hosting provider. Backups are encrypted and kept on Mindstake-owned hardware in Ōtautahi. Audio transcription runs on Mindstake-owned hardware in New Zealand.

Service providers, including outside New Zealand

We use a small number of service providers to run the platform. Some are outside New Zealand. We disclose information to them only as needed for the service, and we choose providers that are required to protect it to standards comparable to the Privacy Act.

• Cloudflare - website delivery, encryption in transit and protection against attacks (global network).
• Amazon Web Services - sending service emails such as invitations and password resets (Sydney, Australia).
• Google Workspace - our company email.
• AI analysis providers (Google Gemini, OpenAI and Anthropic, United States) - some analysis and report writing features send excerpts of client content for processing. Content our clients classify as Tapu is never sent to an external AI service.

Our accounts with AI providers are configured so that your information is not used to train their models.

How we protect it

Each client organisation's information is kept in its own separate database. All connections are encrypted (TLS 1.3), stored data and backups are encrypted, access is limited to invited users with the right permissions, and every access to client evidence is recorded in a log that cannot be altered. Only Mindstake's two directors have administrative access to the platform.

How long we keep it

We keep enquiries for as long as needed to respond and follow up. We keep platform information for as long as our client's agreement with us continues. When a client leaves, we return their information to them and then securely delete it from our systems within 10 working days, and from our backups within 30 days, and confirm the deletion in writing.

Cookies

We use only the cookies needed for the site to work: a session cookie that keeps you signed in and a security cookie that protects forms against forgery. We do not use advertising, analytics or tracking cookies. Our pages load the Inter typeface from Google Fonts, which means your browser's IP address is visible to Google when a page loads.

Your rights

You can ask for access to the personal information we hold about you, and ask us to correct it. We will respond within 20 working days. For information held on behalf of one of our clients, we will work with that organisation to respond. There is normally no charge.

If something goes wrong

If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act requires. We notify affected client organisations within 72 hours of becoming aware of a breach.

Contact and complaints

Our Privacy Officer can be reached at [email protected]. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

We will update this page when our practices change. The date at the top shows when it was last revised.