Privacy

Draft of 19 October 2026. The legal entity, contact address and governing details are placeholders until the business is registered.

What we collect

• Request access form: your name, email, organisation, the option you choose for who you are, the product and area you name, your message, the page you sent it from and when. To limit spam we also keep a one-way hash of your IP address and your browser's user-agent string.
• Your account: your name, email, sign-in records (sessions, passkeys, API keys) and your role.
• Orders: the areas you draw, your answers to our questions, files you upload, and payment records from our payment provider (we never see or store your card number).
• This website uses no analytics or advertising trackers. Signing in sets a cookie that is needed for your account to work; the order form keeps an unsent draft in your browser's session storage.

Why, and who sees it

We use your details to reply to you, to run your account and your orders, to email you about your orders, and to understand who Lepro is useful for. We do not sell personal information or use it for advertising. Only the people running Lepro, and the providers that host our systems, send our email and take payments, can see it.

Where it is stored

Lepro runs on Railway's infrastructure in Singapore, so your information is stored outside New Zealand. We choose providers that protect it to a standard comparable to the Privacy Act.

How long we keep it

Requests that do not lead to an account are deleted after 24 months. Account and order information is kept while your account is active and for as long as tax and consumer law require after that.

People named in public records

Some permit holders and applicants are individuals. Their names come from the public NZP&M permit register, and Lepro shows them only in the context of that permit.

Your rights

You can ask to see the personal information we hold about you and ask us to correct it, through the contact form. If you are not happy with our response, you can complain to the Office of the Privacy Commissioner.