Privacy Policy

Who is responsible

This pre-launch website and email enrolment list operate under the name DRAFTYR.

Privacy contact: hello@draftyr.com.

Joining is voluntary

Joining the enrolment list is free and voluntary. We ask for your email address so we can send course previews, course updates, enrolment announcements and occasional DRAFTYR marketing emails. Your first name is optional. If you do not provide an email address and consent, you can still browse the public website but will not receive these emails. Joining does not create a course account or purchase.

What we collect and why

We collect the email address and optional first name you enter, the consent wording and version you agreed to, subscription status, signup and unsubscribe details, and relevant timestamps. Campaign labels in the page address may record which advert or link brought you here. We use these records to manage your requested subscription, deliver updates, understand which campaigns lead to signups and keep evidence of your choices.

The signup service uses a keyed hash of the request IP address and an email-derived identifier to limit repeated requests and prevent abuse. It does not store the raw IP address in these rate-limit counters. Our hosting and email providers may also process network addresses, browser or device details, timestamps and delivery or security logs to operate and protect their services.

If you email us, we receive your address, message and any information you choose to include, so we can reply and handle your request. Please do not send passwords or payment-card information.

Website analytics

We use Vercel Web Analytics to understand visits to the public website, including pages viewed, referrers, timestamps, general location, and browser, operating-system and device type. Vercel says Web Analytics does not use cookies and stores anonymized data; its visitor identifier resets daily and does not follow visitors across websites. We remove sensitive query parameters and exclude signup-confirmation and private account routes from analytics. This is separate from optional Meta advertising measurement and does not send signup email addresses or names to Vercel as analytics events.

Joining and leaving the list

When you submit the form and agree to receive emails, we add your address to the active DRAFTYR enrolment list. There is no email-confirmation step for new signups. Please check the address before submitting; the list does not verify that you control it. Confirmation links sent before this change can still be used for those older requests.

Use the unsubscribe link in a DRAFTYR marketing email to stop course updates and marketing emails. You can also contact us at the address below. To subscribe again after unsubscribing, submit the form and agree to receive emails again.

Services that handle information

Vercel hosts the website and processes requests. Supabase stores signup, subscription and consent records. Resend delivers marketing emails and holds the active contact list and unsubscribe status. Microsoft Outlook handles messages sent to our business inbox. These providers and their service providers receive the information needed to perform these functions; their terms also describe processing for delivery, security, abuse prevention and legal obligations.

Overseas processing and protection

Our service providers store or process information outside New Zealand. Our Supabase database is hosted in Sydney, Australia. Resend stores customer data in the United States; its sending region determines email routing, not where records are stored. Vercel uses international infrastructure to deliver and operate the website. Our Microsoft Exchange Online mailbox currently stores data at rest in New Zealand. Microsoft lists no committed geography for it, so we do not promise permanent New Zealand-only storage or processing. Support teams and subcontractors may process information in other locations.

DRAFTYR remains responsible for information processed on its behalf. The provider terms describe confidentiality, security, subcontractors, help with privacy requests and international-transfer safeguards. Providers may also process account, usage and security information for their own operational or legal purposes. Our review distinguishes these uses from processing solely on our behalf; it does not assume that all overseas processing is the same or that a certification alone meets every applicable privacy requirement.

The signup database restricts access to the server-side service, and marketing consent is recorded before a new address is activated. No online service is completely secure. Contact us if you believe your information has been misused.

How long information is kept

Signup requests from the earlier email-confirmation process that remain pending are removed by a daily cleanup once 30 days have passed since the latest request. Their associated consent history is removed with them. Older confirmation links expire after 24 hours. If a previously unsubscribed person starts but does not complete a new signup within 30 days, the request returns to unsubscribed status so the previous opt-out remains protected.

Active subscription details and the latest consent evidence are kept while we provide the updates you requested. The website’s unsubscribe flow removes the optional name and campaign labels from the enrolment-list record. Consent wording and history are retained for up to 24 months after the later of the latest consent or unsubscribe, then removed by cleanup. Older superseded consent events are also removed after 24 months. These periods are our operating rules, not a statement that the law requires a fixed two-year period.

A minimal suppression record, including the email address, unsubscribe status and identifiers needed to honour opt-out links, remains while we operate the marketing list and need to prevent unwanted re-subscription. A documented, time-limited hold may preserve information needed for a specific privacy request, dispute or legal obligation. Rate-limit counters older than 24 hours are removed on the daily cleanup and during subsequent signups. Cleanup runs while the database is operational and is checked after any service interruption.

Messages sent to our business inbox are separate from the signup database and are not removed by its cleanup job. We review the mailbox monthly, with resolved enquiry correspondence deleted within 12 months of closure unless needed for a specific continuing request, dispute or legal obligation. Deletion includes clearing the relevant messages from Deleted Items. Under Microsoft’s default Exchange settings, removed messages may remain recoverable for a further 14 days; this recovery window is not an automatic expiry for ordinary inbox messages.

Copies held by providers follow their own applicable retention and backup arrangements. Resend publishes 30-day email/log retention for its standard plans and seven-day backups; this does not mean a contact-list entry is deleted after 30 days. Subscription suppression is retained separately. Hosting logs and Microsoft mailbox copies are also separate from the signup database. Verified deletion requests are handled across the relevant services, with any necessary retained records explained.

Access, correction, deletion and concerns

You can ask whether we hold information about you, request access to it, or ask us to correct it by emailing the privacy contact below. You can also ask us to delete information or stop using it for marketing. Please identify the email address used for the signup; we may need to verify that the record is yours before releasing or changing it.

We will consider requests under the privacy laws that apply. Deletion may be limited where a record is still needed to honour an unsubscribe, meet a legal obligation or resolve a dispute. We will explain any information we need to retain. If we do not make a requested correction, you can ask for a statement of correction to be attached to the record.

Please contact us first about a privacy concern. You can also raise a concern with the New Zealand Office of the Privacy Commissioner, or another privacy regulator where applicable.

Changes to this policy

We may update this policy as the website and our services change. The date above identifies the latest revision. We will explain significant new uses before they begin and seek a separate choice where appropriate; joining the email list does not authorise unrelated future uses.

Advertising and analytics

Optional Meta measurement is enabled only after you allow it through the separate advertising-measurement controls.

With your separate advertising consent, we send PageView events and one Lead event after a new signup has been successfully added to the active list with marketing consent. Clicking the signup button without completing a valid signup, or submitting an address that is already active, is not counted as a new Lead. An opaque event identifier may be stored in your browser to prevent duplicate reporting; you can remove this by clearing site data.

The signup and Lead event happen in the browser used to submit the form. Meta measurement still requires advertising consent in that browser. We do not transfer advertising consent between browsers. Email addresses and names are not included in our Pixel event parameters.

If enabled, optional Meta advertising measurement helps us understand visits and the effectiveness of Facebook and Instagram campaigns. It may send Meta the pages visited, event times, browser and device information, network address and advertising-cookie identifiers. Meta may associate this information with its own records and process it under its privacy policy.

Email-list consent and optional advertising-measurement consent are separate choices. Joining the list does not grant permission for Meta measurement, and declining measurement does not prevent signup. When measurement is enabled, you can allow or decline it and reopen Privacy choices to change your decision. A first-party preference cookie remembers that choice for up to 180 days. We ask again when it expires or our measurement purposes change. We do not load the Meta Pixel before you allow measurement, wherever you are located. Withdrawing consent stops future measurement and removes Meta cookies that our website can delete; it does not recall data already sent to Meta.

Campaign labels attached to a signup are different from loading the Meta Pixel. The signup form itself does not send your email address or name to Meta or automatically upload the enrolment list as an advertising audience. Any future audience matching or additional advertising use will require its own review and updated disclosure before it starts.

Read Meta’s Privacy Policy for information about Meta’s processing and your choices.

More information

Provider information: Vercel, Supabase, Resend and Microsoft.

New Zealand Office of the Privacy Commissioner.