Privacy policy

We use your information to:

• Provide and improve our services
• Communicate with you about enquiries, projects, and support
• Prepare proposals, quotes, prototypes, and engineering outputs
• Maintain security and integrity of our systems
• Comply with legal obligations (e.g., tax, record-keeping)
• Analyse traffic and performance of our website

When you ask for your AI Readiness Score report, we add you to our mailing list and send a few short follow-up emails with practical steps. Every email has a one-click unsubscribe.

We do not sell or trade your personal information.

If you are in the EU/EEA or UK, we process your information under the following legal bases:

• Contract – to provide services you engage us for
• Consent – for optional analytics or tracking (where applicable)
• Legitimate Interests – improving our services and understanding site usage
• Legal Obligation – compliance with NZ law (tax, accounting, etc.)

We store data using reputable, secure third-party providers, including:

• Vercel – website hosting
• Cloudflare – CDN and security, and the spam check on our brief form (Turnstile)
• Neon – our database, which holds AI Readiness Score answers and reports, enquiries, and client portal accounts, hosted in Sydney, Australia
• Resend – sending our emails, including your AI Readiness Score report and follow-ups, and keeping our mailing list
• Calendly – booking calls with us
• Google Workspace – email, documents, and collaboration
• Other tools as required for specific projects

Your data may be stored in New Zealand, the United States, the EU, or other countries where our service providers operate. These providers comply with GDPR-grade data protection and hold appropriate security certifications.

We take reasonable steps to protect your information from loss, unauthorised access, misuse, or disclosure.

We may share personal information with:

• Trusted subcontractors or collaborators helping deliver a project
• Service providers (hosting, email, analytics, payment platforms, etc.)
• Legal, accounting, or regulatory bodies if required by law

If you describe a typical Monday in the AI Readiness Score, we may send that text, without your name or email address, to Anthropic's Claude API to write a three-sentence summary for your report.

We ensure third parties only access the minimum information necessary and handle it securely.

We do not sell personal information.

We use lightweight, privacy-respecting analytics tools (Vercel Web Analytics and Speed Insights). These tools may collect:

• Device and browser information
• Session and page activity
• Aggregated traffic statistics

We also measure whether our ads on Meta (Facebook and Instagram) and LinkedIn lead to enquiries. Our server tells Meta when you view a page, and tells Meta and LinkedIn when you send a brief, finish the AI Readiness Score or book a call. With each event we send your IP address, browser user agent and the page URL, and for a brief your email address, hashed (SHA-256) so it isn't sent in readable form. The LinkedIn Insight Tag also runs in your browser, and LinkedIn may set its own cookies.

We also use Google Analytics to see how people find and use the site, and whether our Google ads lead to enquiries. It runs in your browser, sets its own cookies (_ga and _ga_*, kept for up to two years), and receives your IP address, browser details and the pages you visit. We tell it when you send a brief, finish the AI Readiness Score or book a call, never with your name or email.

We use PostHog, hosted in the EU, to see which pages people visit, how fast they load, and which steps of the site, the AI Readiness Score and the client portal get used. It runs in your browser and keeps an anonymous ID in its own cookie and local storage (ph_*). It does not record your screen or what you type. If you sign in to the client portal, we link that activity to your account and your email address.

If you arrive from one of those ads, we keep the ad's click ID in two first-party cookies, _fbc (Meta) and li_fat_id (LinkedIn), for 90 days so a conversion can be matched to the ad. They hold nothing else.

ai_hero remembers which of three headlines you saw on our AI pages, so we can tell which one helps people most. It holds a single letter, nothing about you, and expires after 90 days.

If you'd rather not be measured, an ad or tracker blocker stops these tools, and the site works the same.

We will respond to all valid requests within 30 days.

Because our infrastructure and tools are global, your personal information may be processed outside your home country. Where required, we use:

• Standard Contractual Clauses (GDPR)
• Privacy-compliant service providers
• Contractual commitments ensuring adequate protection

We keep personal information only for as long as necessary to:

• Deliver services
• Maintain records (required under NZ tax law for 7 years)
• Comply with legal obligations
• Resolve disputes

After that, information is securely deleted or anonymised.

Our website and services are not intended for children, and we do not knowingly collect personal information from anyone under 16.

We may update this Privacy Policy from time to time. The "Last updated" date will reflect the most recent version. If changes are significant, we will notify you by email or on this page.

If you have questions, concerns, or want to exercise your rights, please contact:

Voidforge Limited

Email: privacy@voidforge.nz

Location: Dunedin, New Zealand