How AI Leakage handles the personal information of site visitors. Last updated: 22 October 2026.

Who we are

AI Leakage is operated from New Zealand. “We,” “us,” and “our” refer to the AI Leakage operator. “You” refers to any visitor to this site.

What information we collect

• Server access logs: Our hosting provider logs standard web server data for every request, IP address, user agent string, request URL, response code, timestamp. Used for security monitoring and basic traffic analysis.
• Email correspondence: If you email us via the contact page, we retain that correspondence as part of our editorial record-keeping.
• Newsletter subscription data: If you sign up to AI Leakage Alerts (our email updates, including the digest), we store your email address and the date you subscribed. Newsletter delivery is operated through a third-party email service (currently Brevo; this may change with notice on this page).
• Purchase data: If you buy a digital product through this site, payment processing is handled by Stripe. We store the order record (product, date, email address, country) but do not store full payment card numbers. Stripe’s privacy practices govern the payment processing layer.
• Emails we send: The emails this site sends you, such as your access code, your certificate, renewal reminders and acknowledgements of messages you send us, go through our email provider, Brevo. Brevo records when an email is opened and which of its links are clicked.
• Course progress: If you take one of our courses, your browser is given a cookie (ail_lk, kept for up to a year) so the site can remember which modules you have finished. Your progress is stored against that cookie, not against your name or email address.
• Certificates: If you pass a course test and ask for a certificate, we store your name and email address with the certificate record, held encrypted, together with the course, industry edition, course version, completion date and the date the certificate is current until. Anyone with the certificate number can confirm at aileakage.com/verify that it is genuine and see the holder’s name, the course and those dates. Your email address is never shown. When you claim a certificate, we record your AI Leakage Alerts choice, when you made it and the IP address it came from, whether or not you join. Joining is required for the free Basic certificate and optional for paid certificates. When you join, we add to AI Leakage Alerts at Brevo your name, certificate number, course, level, industry edition, whether your course is the New Zealand or the Australian one, which version of the consent wording you agreed to, and whether you have bought the Intermediate or Advanced course, so that emails about our other courses can leave out the ones you have. If you later buy a course with the same email address, we update that at Brevo. You can unsubscribe at any time from the link in any email or at our email preferences page, and your certificate stays valid.
• AI Leakage Alerts: When you claim the free Basic certificate, or tick the box when you claim a paid one, we store your name and email address and add you to AI Leakage Alerts, sent through Brevo, to send the relevant information described in our Terms. You can unsubscribe from any email.
• Analytics: We use Google Analytics 4 to count visitors and understand which pages are read. It sets first-party cookies that record how you arrived (referrer or campaign link) for up to 90 days.
• Research data (AI Policy Builder): When you build a policy with the AI Policy Builder we keep an anonymous record of the sector you selected, your team size band, and which AI tools you ticked. We do not keep the business name, your name, your role, your email address or your IP address, and the record cannot be linked back to you. We keep these records for 24 months and use them to publish New Zealand-wide findings about AI use in small business. Published findings never include anything below 100 responses for a headline figure or 30 for a breakdown, and always disclose that respondents selected themselves.

What we do not collect

• We do not run third-party advertising trackers
• We do not require accounts for content access (there is no login on the public site)
• We do not sell, rent, or share visitor data with third parties beyond what is technically required for newsletter delivery and payment processing

How we use information

• Server logs are used for security monitoring and traffic analysis only
• Email correspondence is used to respond to your specific email and may be retained as part of our editorial record
• Newsletter subscriber data is used only to send the newsletter and any operational notices about it
• Purchase data is used to deliver the product, provide receipts, handle support enquiries, and meet our tax and accounting obligations
• Course progress is used only to show you where you are in a course
• Certificate records are used to issue your certificate, let others confirm it is genuine, and remind you before it lapses; if you agreed to hear from us, also to send you the email updates you chose

Your rights under NZ Privacy Act 2020

If we hold personal information about you (correspondence, newsletter subscription, purchase record, course progress or certificate record), you have the right under the NZ Privacy Act 2020 to: request access to that information; request correction of inaccurate information; and request deletion. Email the operator via the contact page. We keep certificate records so that a certificate can be confirmed for as long as it is shown as current. If you ask us to delete yours, we will, and it will no longer verify.

GDPR / international visitors

For EU and UK visitors, we rely on legitimate interest as the legal basis for processing server logs (for security monitoring) and contractual necessity for email correspondence, newsletter subscriptions, and purchases you initiate. You have the same access, correction, and deletion rights as NZ residents plus the right to object to processing.

Cookies

This site uses essential cookies required for the WordPress platform to function, the course progress cookie (ail_lk) described above, and the Google Analytics 4 cookies described under Analytics. There are no affiliate links on this site, so no affiliate tracking cookies are set by us or on our behalf. We do not set advertising cookies.

Changes to this policy

We will update this policy when our practices change. The “Last updated” date at the top will reflect the most recent revision. Material changes will be noted in AI Leakage Alerts.