How AI Leakage handles the personal information of site visitors. Last updated: 24 May 2026.

Who we are

AI Leakage is operated from New Zealand. “We,” “us,” and “our” refer to the AI Leakage operator. “You” refers to any visitor to this site.

What information we collect

• Server access logs: Our hosting provider logs standard web server data for every request, IP address, user agent string, request URL, response code, timestamp. Used for security monitoring and basic traffic analysis.
• Email correspondence: If you email us via the contact page, we retain that correspondence as part of our editorial record-keeping.
• Newsletter subscription data: If you sign up to the AI Leakage Digest newsletter, we store your email address and the date you subscribed. Newsletter delivery is operated through a third-party email service (currently Brevo; this may change with notice on this page).
• Purchase data: If you buy a digital product through this site, payment processing is handled by Stripe. We store the order record (product, date, email address, country) but do not store full payment card numbers. Stripe’s privacy practices govern the payment processing layer.
• Analytics: We use Google Analytics 4 to count visitors and understand which pages are read. It sets first-party cookies that record how you arrived (referrer or campaign link) for up to 90 days.
• Research data (AI Policy Builder): When you build a policy with the AI Policy Builder we keep an anonymous record of the sector you selected, your team size band, and which AI tools you ticked. We do not keep the business name, your name, your role, your email address or your IP address, and the record cannot be linked back to you. We keep these records for 24 months and use them to publish New Zealand-wide findings about AI use in small business. Published findings never include anything below 100 responses for a headline figure or 30 for a breakdown, and always disclose that respondents selected themselves.

What we do not collect

• We do not run third-party advertising trackers
• We do not require accounts for content access (there is no login on the public site)
• We do not sell, rent, or share visitor data with third parties beyond what is technically required for newsletter delivery and payment processing

How we use information

• Server logs are used for security monitoring and traffic analysis only
• Email correspondence is used to respond to your specific email and may be retained as part of our editorial record
• Newsletter subscriber data is used only to send the newsletter and any operational notices about it
• Purchase data is used to deliver the product, provide receipts, handle support enquiries, and meet our tax and accounting obligations

Your rights under NZ Privacy Act 2020

If we hold personal information about you (correspondence, newsletter subscription, purchase record), you have the right under the NZ Privacy Act 2020 to: request access to that information; request correction of inaccurate information; and request deletion. Email the operator via the contact page.

GDPR / international visitors

For EU and UK visitors, we rely on legitimate interest as the legal basis for processing server logs (for security monitoring) and contractual necessity for email correspondence, newsletter subscriptions, and purchases you initiate. You have the same access, correction, and deletion rights as NZ residents plus the right to object to processing.

Cookies

This site uses essential cookies required for the WordPress platform to function. There are no affiliate links on this site, so no affiliate tracking cookies are set by us or on our behalf. We do not set behavioural-tracking or advertising cookies.

Changes to this policy

We will update this policy when our practices change. The “Last updated” date at the top will reflect the most recent revision. Material changes will be noted in the AI Leakage Digest.