If you received an email from us, this page explains where your address came from, what we hold, and how to make it stop. It is longer than it needs to be for that purpose, because a publication about how organisations handle other people’s information should be willing to show its own working.

1. Who we contacted, and what we asked

We contacted named staff at New Zealand industry associations, professional bodies and regional business support providers.

We contacted them for one reason: to offer a free AI use policy template their members can use, and to ask that it be passed on if it is useful.

We did not ask for a reply, a meeting, a partnership, a listing, a referral fee or a link exchange. If an association forwards the link to its members, that is the entire outcome we were hoping for. If it does not, we go away.

We contact roughly forty to fifty people in total. Not per month. In total.

2. How to stop hearing from us

Use the unsubscribe link in the email, or reply with anything at all. A single word is enough.

You go onto a suppression list, permanently. We do not re-add people, we do not clear the list periodically, and we do not treat a new campaign as a fresh start. Suppression is the one record we keep indefinitely, and section 7 explains why that has to be the case.

3. Where your address came from

From your organisation’s own public website, on the page where your name, role and work contact are published.

At the moment we recorded it, we also recorded the exact page it appeared on, the date we looked, your role, and one sentence on why we believed this particular message was relevant to that role. We keep those four things together. If you ask us where we got your address, we can tell you the page and the day.

4. What we did not do

We did not buy or use a compiled contact database. Several commercial services sell packaged contact records for New Zealand industry bodies, including staff names and email addresses the individual never published. They appeared repeatedly in ordinary search results while this list was being built. We did not use them, and any address we could only have obtained that way is not on our list.

We did not guess email addresses. Where an organisation publishes a general enquiries inbox but no named contact, we left that organisation off the list rather than inferring a personal address from a common pattern.

We did not use address-harvesting software, which is separately prohibited under New Zealand law.

We did not research you personally. No professional network activity, no conference appearances, no recent posts, nothing that would let an email open by demonstrating we had been paying attention to you. We know your role and your organisation. That is deliberately all we know, and it is the reason our emails read a little plainly.

5. What we hold about you

Your name, your role, your organisation, your published work email address, the page and date we took it from, the reason the message suited your role, which of two versions you were sent, and whether you opened it or replied.

We do not hold your personal address or phone number, we do not append data from third-party sources, and we do not build a profile of you.

6. The legal basis

New Zealand’s Unsolicited Electronic Messages Act 2007 treats consent as given where a work address has been conspicuously published by someone in a business capacity, the publication carries no statement declining unsolicited messages, and the message sent is relevant to that person’s role or duties. Our messages are sent on that basis, and section 3 describes the record we keep to demonstrate it.

We treat our emails as commercial electronic messages under that Act even though what we offer is free and requires no email address, and we meet the identification and unsubscribe requirements in full. The alternative would be to argue we fall outside the Act. We would rather comply than argue.

The Privacy Act 2020 applies to the contact information we hold. This page serves as our notice of collection.

7. How long we keep it, and the one exception

If you do not respond, your contact record is deleted after 12 months.

Two things survive that deletion, and we would rather state them here than have someone discover them later.

Your suppression record, if you unsubscribed. Deleting it would mean losing the only proof that you asked not to be contacted, and you would eventually be contacted again. Suppression is kept indefinitely and consists of your email address and the date.

A minimal compliance record, if we sent to you. The law places the burden on us to show that a message was permitted, and that burden does not expire on our schedule. So we keep your name, organisation, the page your address came from, and the date we sent. Enough to answer a complaint, and nothing more. Everything else in section 5 goes at 12 months.

We could have written a cleaner promise here. It would not have been true.

8. How these emails were written

The emails, and this page, were drafted with the assistance of AI tools and reviewed by a person before sending. Given what this publication is about, saying so seemed like the minimum.

9. Contact

Quentin Donald
AI Leakage
quentin@aileakage.com
Waimauku, Auckland, New Zealand