What we hold, where it goes, and what we never ask for

Anphase Limited, based in Auckland and registered in New Zealand, is the agency responsible for personal information collected through AnswerFit. We handle it under the Privacy Act 2020. Contact details are on the Anphase website.

Starting with the exclusions, because they are the unusual part. We do not ask for or accept credentials to your systems, so there are no passwords, API keys or analytics logins held on your behalf. The service reads your site the way any visitor would and never signs in to anything.

No tracking code is installed on your site, and nothing on it is modified. No payment card details are held, because payments during the beta are arranged directly rather than through the site. The pages we read are pages anyone can already reach without logging in.

Three kinds of information are involved. The first is publicly available website content, gathered by an identified crawler from pages that are already public. Where a public page happens to name a person, for example a founder or an author, that name is part of the page and is stored with it.

The second is contact information you give us, such as a name, an email address and an organisation, used to correspond with you about a measurement or beta access. The third is the output of the measurement itself, meaning the questions asked, the answers the models gave, citations and run metadata.

The join form on this website collects your name and email address, and optionally your company, the address of the product you want measured and a message. It also records the country the request came from, as reported by our hosting provider. Before a request is accepted, Cloudflare Turnstile checks that it came from a person, which involves your IP address and signals from your browser. We use the IP address for that check only and do not store it.

Standard technical records such as server logs are produced when you visit this website. The site sets no advertising or analytics cookies.

Information is used to produce your measurement, to explain and support the result, and to correspond with you. Run records are retained so a report delivered months ago can still be checked against the evidence it came from, which matters because a measurement nobody can verify is only an assertion.

Aggregated and anonymised findings may be used to improve the method. Nothing that identifies you or your organisation is published without your agreement.

Producing a measurement requires sending questions, and sometimes public text from the site being measured, to third-party AI providers. Most of those providers are outside New Zealand, so this involves disclosing information overseas. The current list, with what each receives, is on the subprocessors page.

This website and its join form run on Cloudflare. A request sent through the form is stored in a Cloudflare database, and a copy is emailed to us through Cloudflare’s email service. Cloudflare is a United States company operating a global network, so this is also a disclosure overseas.

Because that step cannot be avoided, please do not send us confidential material you would not want processed by those providers. Information is not sold, and it is not shared for advertising.

Run records, including stored answers and metadata, are kept while they remain useful for verifying a result and for improving the method. Correspondence is kept while there is an active relationship and for a reasonable period afterwards. Information no longer needed for those purposes is deleted.

Under the Privacy Act 2020 you can ask what personal information we hold about you, ask for a copy, and ask us to correct anything wrong. Ask through the Anphase website and we will respond within the statutory timeframe. Where we cannot agree to a correction, we will attach a statement of the correction you sought.

If you are unhappy with how a request was handled, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Access to run records is limited to the people who need it, which during the private beta is a very small number. Provider credentials are held in environment configuration rather than in code or reports, and authentication headers are kept out of stored logs.

No system is perfectly secure, and saying otherwise would be the kind of claim this project exists to catch. If a privacy breach occurs that is likely to cause serious harm, we will notify affected people and the Privacy Commissioner as the Act requires.