Policy Lens Privacy Notice

This notice explains how Lumini handles information when you use Lumini Policy Lens, our election policy tool, whether on our website or embedded on another organisation's website, such as a news publisher's site. It sits alongside our main Privacy Policy at lumini.nz/privacy. Where they differ, this notice applies to Policy Lens.

1. Your questions may reveal political views

1.1 The questions you ask about party policies can say something about your political views. We treat all Policy Lens questions as sensitive.

1.2 Please don't include your name, other people's personal information, or details about yourself that you don't need to share. Policy Lens doesn't need them to answer.

2. What we collect

2.1 Public version. When you use the public version, we collect:

• the questions you type and the answers Policy Lens generates; and
• a hashed version of your IP address, which we use to apply limits, prevent misuse and keep Policy Lens secure. We don't store your IP address itself.

We don't ask for your name or email address, and we don't link your questions to your identity. Policy Lens uses your browser's local storage to keep your session working between visits. That information stays on your device, and you can clear it in your browser settings. Policy Lens doesn't use third-party analytics tools.

3. How we use it

3.1 We use the information we collect to:

• answer your questions;
• prevent misuse and keep Policy Lens secure;
• check and correct answers, including when someone reports an error;
• check and improve the quality, accuracy and operation of Policy Lens; and
• share questions and answers, with identifying details removed, with the website owner hosting Policy Lens (see clause 6).

3.2 We may use de-identified, aggregated information, such as broad counts of the policy topics people ask about, to understand usage, improve our services and produce reporting and commentary. Before using or sharing it, we take steps to prevent it from identifying an individual or organisation.

4. AI processing

4.1 Policy Lens uses OpenAI to find relevant party documents and generate answers. Your question is sent to OpenAI for this purpose, together with the relevant party material.

4.2 Our AI provider processes this under terms that don't allow it to use the content to train its models, and we haven't opted in to share data with it. It may keep inputs for up to 30 days for abuse monitoring, or longer if the law requires.

4.3 We don't use your questions or answers to train AI models.

4.4 Policy Lens doesn't make automated decisions about you that have a legal or similarly significant effect.

5. Who we share it with

5.1 In addition to the publisher sharing described in clause 6, we share information with service providers where needed to operate Policy Lens.

5.2 We don't sell personal information. We may disclose it where the law requires or allows, to protect our rights or the safety of others, or in a sale or restructure of our business, in which case it will be handled consistently with this notice.

6. Publishers hosting Policy Lens

6.1 When Policy Lens appears on another organisation's website, Lumini runs it and collects the information described in this notice. The website owner doesn't collect your questions directly through Policy Lens.

6.2 We may share the questions asked through Policy Lens on a website owner's site, and the answers given, with that website owner. Before sharing, we remove IP addresses and other technical identifiers, and we use automated tools to remove names, contact details and other details that could identify someone.

6.3 Website owners may use this information to understand what readers want to know about party policies, including for reporting. They have agreed not to try to identify anyone from it, or to combine it with other information to do so.

6.4 Because questions are free text, we can't guarantee that every identifying detail is removed. Please don't include personal information in your questions (see clause 1.2).

6.5 The website owner's own privacy policy applies to the rest of its site, including any cookies or analytics it uses on the page around Policy Lens.

7. Where it's stored

7.1 Policy Lens data is stored with our cloud hosting providers in Australia, encrypted in transit and at rest. Australian law may apply to data held there.

7.2 Some of our service providers, including our AI, email and CRM providers, may store or process information outside Australia, including in the United States and Europe.

8. How long we keep it

Public version questions, answers and hashed IP addresses: 30 days, then deleted.

Aggregated, de-identified information: De-identified, so it may be kept.

8.1 Some service providers may keep inputs for up to 30 days for abuse monitoring, or longer if the law requires. Backup copies may persist for a short period before being overwritten in the normal backup cycle.

9. Your rights

9.1 You can ask for access to, or correction of, the personal information we hold about you, and ask us to delete it. Email our Privacy Officer at privacy@lumini.nz. We may need to verify your identity first.

9.2 Because the public version doesn't link questions to your identity, we may not be able to find your questions unless you tell us when you asked them and roughly what you asked.

9.3 If you're not satisfied with how we handle your request or your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

10. Changes to this notice

10.1 We may update this notice. When we make a material change, we'll update the date above.

11. Contact us

Lumini Works Limited
Privacy Officer Email: privacy@lumini.nz
Website: lumini.nz