If you received an email from us, this page explains where your address came from, what we hold, and how to make it stop. It is longer than it needs to be for that purpose, because a publication about how organisations handle other people’s information should be willing to show its own working.

1. Who we contacted, and what we asked

We contacted named staff at New Zealand industry associations, professional bodies and regional business support providers, and the editors of New Zealand trade and professional publications.

We contacted them for one of three reasons: to offer free resources their members can use (an AI policy builder, a free course and a one-page worksheet) and ask that they be passed on if useful; to offer an editor a contributed article or a short news item; or, for an AI advisory provider, to tell them about our practitioner credential.

We did not ask for a meeting, a partnership, a listing, a referral fee or a link exchange. An editor may reply to take up an article. Otherwise, if a body passes the link on to its members, that is the outcome we were hoping for. If it does not, we go away.

We contact fewer than eighty people in total. Not per month. In total. Updated 25 October 2026: this section previously said we wrote for one reason only and to roughly forty to fifty people. It now matches the emails we send.

2. How to stop hearing from us

Reply with the word stop, or with anything asking us to stop or remove you. A single word is enough. Our emails are sent by hand, so they carry no unsubscribe link.

You go onto a suppression list, permanently. We do not re-add people, we do not clear the list periodically, and we do not treat a new campaign as a fresh start. Suppression is the one record we keep indefinitely, and section 7 explains why that has to be the case.

3. Where your address came from

From your organisation’s own public website, on the page where your name, role and work contact are published.

At the moment we recorded it, we also recorded the exact page it appeared on, the date we looked, your role, and one sentence on why we believed this particular message was relevant to that role. We keep those four things together. If you ask us where we got your address, we can tell you the page and the day.

4. What we did not do

We did not buy or use a compiled contact database. Several commercial services sell packaged contact records for New Zealand industry bodies, including staff names and email addresses the individual never published. They appeared repeatedly in ordinary search results while this list was being built. We did not use them, and any address we could only have obtained that way is not on our list.

We did not guess email addresses. Where an organisation publishes a general enquiries inbox but no named contact, we left that organisation off the list rather than inferring a personal address from a common pattern.

We did not use address-harvesting software, which is separately prohibited under New Zealand law.

We did not research you personally. No professional network activity, no conference appearances, no recent posts, nothing that would let an email open by demonstrating we had been paying attention to you. We know your role and your organisation. That is deliberately all we know, and it is the reason our emails read a little plainly.

5. What we hold about you

Your name, your role, your organisation, your published work email address, the page and date we took it from, the reason the message suited your role, which message we sent you and when, and whether you replied. We cannot see whether you opened it: our emails are sent by hand and carry no tracking.

We do not hold your personal address or phone number, we do not append data from third-party sources, and we do not build a profile of you.

6. The legal basis

New Zealand’s Unsolicited Electronic Messages Act 2007 treats consent as given where a work address has been conspicuously published by someone in a business capacity, the publication carries no statement declining unsolicited messages, and the message sent is relevant to that person’s role or duties. Our messages are sent on that basis, and section 3 describes the record we keep to demonstrate it.

We treat our emails as commercial electronic messages under that Act even though what we offer is free and requires no email address, and we meet the identification and unsubscribe requirements in full. The alternative would be to argue we fall outside the Act. We would rather comply than argue.

The Privacy Act 2020 applies to the contact information we hold. This page serves as our notice of collection.

7. How long we keep it, and the one exception

If you do not respond, your contact record is deleted after 12 months.

Two things survive that deletion, and we would rather state them here than have someone discover them later.

Your suppression record, if you unsubscribed. Deleting it would mean losing the only proof that you asked not to be contacted, and you would eventually be contacted again. Suppression is kept indefinitely and consists of your email address and the date.

A minimal compliance record, if we sent to you. The law places the burden on us to show that a message was permitted, and that burden does not expire on our schedule. So we keep your name, organisation, the page your address came from, and the date we sent. Enough to answer a complaint, and nothing more. Everything else in section 5 goes at 12 months.

We could have written a cleaner promise here. It would not have been true.

8. How these emails were written

The emails, and this page, were drafted with the assistance of AI tools and reviewed by a person before sending. Given what this publication is about, saying so seemed like the minimum.

9. Contact

Quentin Donald
AI Leakage
quentin@aileakage.com
Waimauku, Auckland, New Zealand