Pincite Privacy Policy

Effective: 6 August 2026

Pincite Pty Ltd (ACN 700 309 753 | ABN 43 700 309 753) (Pincite, we, us, our) provides an online tool that helps users format and manage legal citations. This policy explains how we collect, hold, use and disclose your personal information, and how you can access it, correct it, or make a complaint.

We are an Australian company, and your information is held outside New Zealand. That does not put you outside the reach of New Zealand privacy law. The Privacy Act 2020 (NZ) applies to an overseas agency that carries on business in New Zealand, whether or not it has a place of business here, so we handle your personal information in accordance with the Information Privacy Principles (the IPPs) in that Act. Unlike the Australian Act, the Privacy Act 2020 has no small-business exemption — it applies to every agency regardless of size — so these are obligations we owe you, not commitments we have chosen to make. You can read the IPPs in full on the website of the Office of the Privacy Commissioner at https://www.privacy.org.nz.

Because we are an Australian company, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (the APPs) also govern our handling of your information. Where the two sets of rules differ, we apply whichever gives you the greater protection. This means you have two complaints routes, and you may use either — see clause 15.

This policy forms part of our Terms and Conditions. Capitalised terms not defined in this policy have the meanings given to them in clause 18 (Definitions) or in the Terms and Conditions.

1. Scope

This policy applies to personal information we collect through the Website, including when you browse our Website, create an Account, subscribe, use the citation generator, save Projects, or contact us for support. It does not cover the citation content itself (for example, case names or statute titles) unless that content also happens to identify you.

2. Personal information we collect, and why

2.1 What we collect. We collect the following personal information for the purposes described. We collect it for these purposes only, and only because it is necessary for them (IPP 1):

2.2 Payment details. We do not collect or store your full payment card details. They are collected and held directly by our payment processor, Stripe.

2.3 Sensitive information. We do not seek out information about your health, race, ethnicity, religious or political beliefs, or other sensitive matters. You should not enter confidential, privileged or sensitive material into Pincite. If you send us sensitive information we have not asked for, we will only use it for the purpose for which you provided it, or as the law requires, and will delete it if it is not needed.

2.4 Children. Pincite is for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we become aware that we have, we will delete it and close the Account, and refund any unused Fees.

3. How we collect personal information

Where practical, we collect personal information directly from you (IPP 2) — when you create an Account, subscribe (through Stripe's checkout), save a Project, contact support, or take part in our referral program. We tell you what we are collecting and why at the point we collect it (IPP 3). We also collect some information automatically through cookies and analytics tools when you use our Website (see clause 8). We do not collect personal information by unlawful, unfair or unreasonably intrusive means (IPP 4).

4. What we will never do with your information

• (a) We will never use your Projects, your citation content, or other content you submit through Pincite to train, fine-tune, evaluate or develop any artificial intelligence or machine learning model, whether ours or anyone else's.
• (b) We will never permit a service provider to use that content for those purposes on our behalf. This does not prevent a provider from processing your content strictly as necessary to provide its service to us, subject to appropriate confidentiality and security obligations.
• (c) We will never sell your personal information, and we will never share it with data brokers or advertisers.
• (d) We will never publish your Project content.
• (e) We do not use artificial intelligence or machine learning to generate your citations. Pincite runs on rules-based logic that we author and maintain.

5. How we use your information to improve Pincite

We analyse aggregated and de-identified information about how Pincite is used — for example, which citation types most often produce errors, or which fields users most often leave blank — so that we can identify and remedy the parts of the product that do not work well. "De-identified" means the data does not identify you and you cannot reasonably be re-identified from it. This is subject to the commitments in clause 4; in particular, this data is never used to train an artificial intelligence model.

6. How we hold and secure your information

We take reasonable security safeguards against loss, misuse and unauthorised access, use, modification or disclosure (IPP 5):

• (a) Your Account and Projects data is stored in a Supabase database hosted in the Sydney, Australia region. This is outside New Zealand — see clause 9.
• (b) Payment card details are held by Stripe, not by us.
• (c) We restrict internal access to what is needed to run the service, using database-level access controls (Row Level Security).
• (d) We use multi-factor authentication on all our administrative and infrastructure accounts.
• (e) We take reasonable technical and organisational steps to protect your information from misuse, loss, and unauthorised access, modification or disclosure.

No method of storage or transmission is completely secure, but we keep our practices current as Pincite grows.

7. Privacy breaches

If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm to you, we will notify you and the Office of the Privacy Commissioner as soon as practicable, and tell you:

• (a) what happened and what information was involved;
• (b) what we are doing about it; and
• (c) what you should do to protect yourself.

This is a legal obligation under Part 6 of the Privacy Act 2020, not a voluntary commitment. We will also notify the OAIC where the Australian Notifiable Data Breaches scheme applies, and we will follow this clause whether or not that scheme strictly applies to us.

8. Cookies and analytics

Our Website uses cookies and similar technologies through:

• (a) Google Analytics — to understand traffic and how visitors use our Website;
• (b) Vercel Analytics — to monitor Website performance and usage; and
• (c) Clarity — to record how visitors move through our public pages.

These may collect your IP address, device and browser type, pages visited, and general location. You can control or disable cookies through your browser settings, though some parts of Pincite may not work properly if you do.

8.1 What Clarity records. On our public pages Clarity records user clicks and mouse movement. This will be used to find the places where our pages confuse people, so that we can fix them.

8.2 Where Clarity does not run. Clarity does not run on the citation generator, on your saved Projects, or on your Account settings. Your citation work is never recorded. We have also configured those parts of Pincite so that their contents are withheld from Clarity even if you move into them from a public page during the same visit.

8.3 What is excluded from Clarity. Anything typed into a sign-up, sign-in or password form, or any page accessed on your dashboard or settings, is not recorded.

8.4 Turning it off. Most browsers offer tracking protection, and content-blocking extensions will also block these services. Either will stop Clarity and our other analytics tools from recording your visit.

9. Your information is held and processed outside New Zealand

This clause matters more to a New Zealand user than any other in this policy, so it is stated plainly.

We are an Australian company. All of your personal information is held and processed outside New Zealand — none of it is stored in New Zealand. Our database is in Australia, and several of the services we rely on are provided by companies based in the United States.

IPP 12 governs disclosure of personal information outside New Zealand. Before disclosing personal information to a person or entity overseas, we satisfy ourselves on reasonable grounds that the recipient is required to protect the information in a way that, overall, provides comparable safeguards to those in the Privacy Act 2020 — including through contractual privacy, confidentiality, security and breach-notification obligations, and appropriate controls over the recipient's use of subcontractors.

What this means for you. Personal information held in another country is subject to that country's laws, and an overseas authority may in some circumstances be able to require access to it. Australia has a national privacy law broadly comparable to New Zealand's, and we remain accountable to you under the Privacy Act 2020 for our own handling of your information wherever it is held. By using Pincite, you acknowledge that your personal information will be held and disclosed overseas as described in this clause. This acknowledgement does not reduce any rights you have under New Zealand or Australian privacy law. We encourage you to review each provider's own privacy policy.

10. How we use and disclose your information

10.1 Purposes. We use your personal information for the purposes it was collected for, and for closely related purposes you would reasonably expect (IPPs 10 and 11), such as:

• (a) responding to support requests;
• (b) sending you service emails (renewal reminders, receipts, security notices);
• (c) detecting and preventing fraud or misuse; and
• (d) improving Pincite, as described in clause 5.

Before we use or disclose your information we take reasonable steps to check it is accurate, complete, up to date, relevant and not misleading (IPP 8).

10.2 Disclosure. We only disclose personal information to:

• (a) the service providers listed in clause 9, to the extent needed for them to perform their function;
• (b) anyone else with your consent; or
• (c) where required or authorised by law.

10.3 Direct marketing. We will only send you marketing emails if you have consented, and every one will contain an unsubscribe link, as required by the Unsolicited Electronic Messages Act 2007 (NZ). Service emails (billing, security, renewal reminders) are not marketing, and you will receive them while you hold an Account.

11. If our business is sold

If Pincite is sold, merged, or restructured, your personal information may transfer to the purchaser, successor or relevant related body corporate as part of that transaction. In that event:

• (a) before any transfer of personal information takes effect, we will take reasonable steps to require the recipient to handle that information in accordance with this policy, or under a privacy policy that provides materially equivalent protection, and — where the recipient is overseas — to meet the requirements of IPP 12;
• (b) we will take reasonable steps to require the recipient not to use your Projects, your citation content, or other content you submit through Pincite to train, fine-tune, evaluate or develop any artificial intelligence or machine learning model;
• (c) we will give you reasonable notice by email before a material transfer takes effect, where reasonably practicable, so that you can export your Projects or delete your Account first if you would prefer; and
• (d) if a future owner proposes a material change to the commitments in clause 4, it must give you notice and obtain any consent required by law before using your personal information in the changed manner.

12. Anonymity

You can browse our public pages anonymously. To use most Pincite features you will need an Account, so full anonymity is not possible for those.

13. How long we keep your information

We do not keep personal information for longer than we need it for the purposes it may lawfully be used for (IPP 9).

13.1 Cancelled subscriptions. If you cancel your subscription but keep your Account, we keep your Account and Projects so that you can return to them. Cancelling does not delete anything.

13.2 Inactive accounts. If an Account has no login activity for 24 months, we may delete it and its data, but we will never do so without warning you. We will email you 30 days before deletion, and again seven days before deletion, each time with a link to keep your Account and a link to export your Projects. If you log in at any point, the 24-month period resets. We will not delete an Account under this clause while you have a current paid subscription, unless the Account is suspended or terminated under our Terms and Conditions.

13.3 Deleting your account. Before deleting your Account, you can export your Projects from your Account settings. If you delete your Account, we remove your Account and Projects from our live production systems and disable access to them. Copies may remain in encrypted database backups after deletion; these are not available for ordinary use, and we access them only where reasonably necessary to restore the service after a failure. Backups are overwritten within 30 days after deletion, unless a longer period is required by law or is reasonably necessary for disaster recovery, security or legal purposes. Once overwritten, the data cannot be recovered. If we restore a backup after you delete your Account, we will take reasonable steps to ensure your deleted Account and Projects are not returned to active use.

13.4 Deletion on request. You may also ask us by email to delete your personal information. We will complete a verified request within 30 days after we receive it, and may take reasonable steps to confirm you are the Account holder before acting. Our deletion obligations are subject to clause 13.5.

13.5 Retention required by law or for limited purposes. After your Account is deleted, we may retain only the minimum personal information reasonably necessary to:

• (a) comply with a legal, tax, accounting or record-keeping obligation;
• (b) establish, exercise or defend legal claims;
• (c) investigate or address fraud, security incidents, payment disputes or misuse of Pincite; or
• (d) keep a record that we completed your deletion request.

We will not retain your Projects, and will not use retained personal information for ordinary product, marketing or analytics purposes, after your Account is deleted, unless the law requires it or you give us separate consent. Any information retained under this clause is access-restricted, kept only for the period reasonably necessary for the relevant purpose, and securely deleted or de-identified when it is no longer required.

14. Accessing and correcting your information

You have a legal right to ask for the personal information we hold about you (IPP 6), and a legal right to ask us to correct it (IPP 7). These are rights under the Privacy Act 2020, not a courtesy.

• (a) Access. Ask us using the details in clause 16. We will decide on your request as soon as reasonably practicable, and no later than 20 working days after we receive it, and we will tell you if we need to refuse any part of it and why. We will not charge you a fee for an access request, though we may charge a reasonable administrative fee only if you ask for a large volume of copies.
• (b) Correction. If anything we hold is wrong or out of date, tell us and we will correct it. If we do not agree that a correction is needed, you can ask us to attach a statement of the correction you sought, and we will do so.
• (c) Identity. We may need to verify your identity before acting on either kind of request, so that we do not disclose your information to someone else.
• (d) Do it yourself. You can export your Projects yourself, at any time, from your Account settings.

15. Complaints — you have two routes

If you are unhappy with how we have handled your personal information:

• (a) Contact us first. Write to us using the details in clause 16. We will acknowledge your complaint within five business days and aim to resolve it within 30 days.
• (b) The Office of the Privacy Commissioner (New Zealand). You can complain to the Privacy Commissioner at https://www.privacy.org.nz. The Commissioner will usually ask whether you have raised the matter with us first, so coming to us is often the quickest route — but you are not required to, and you can approach the Commissioner at any time. If a complaint is not settled, it may ultimately be heard by the Human Rights Review Tribunal.
• (c) The OAIC (Australia). Because we are an Australian company, you may instead complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au or on +61 1300 363 992.

You are never required to come to us first, and you may choose either regulator.

16. Contact

Pincite Pty Ltd Email: privacy@pincite.com.au ACN 700 309 753 | ABN 43 700 309 753 A company incorporated in Australia

17. Changes to this policy

We may update this policy as Pincite grows or our practices change. The current version is always available on the Website.

• (a) For minor changes, we will update the "Effective" date.
• (b) For material changes — anything that meaningfully affects how we handle your information — we will give you at least 30 days' notice by email before they take effect.
• (c) We will never weaken the commitments in clause 4 without first asking for your express opt-in consent. Continuing to use Pincite is not consent to that.

Previous versions are available on request.

18. Definitions

In this policy:

Account means the account you create to access Pincite.

APPs means the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Clarity means Microsoft Clarity, the third-party service we use to record how visitors move through our public pages.

Google Workspace means Google Workspace, the service we use to receive and manage email you send to us.

IPPs means the Information Privacy Principles in the Privacy Act 2020 (NZ).

OAIC means the Office of the Australian Information Commissioner.

Office of the Privacy Commissioner means the New Zealand Office of the Privacy Commissioner.

Personal information has the meaning given in the Privacy Act 2020 (NZ).

Privacy Act 2020 means the Privacy Act 2020 (NZ).

Projects means the citation work you save in your Account.

Resend means Resend, our third-party email delivery provider.

Stripe means Stripe, our third-party payment processor.

Terms and Conditions means our Terms and Conditions governing the Pincite citation tool, available at https://pincite.co.nz/terms, as updated from time to time.

Upstash means Upstash, our third-party provider of rate-limiting and abuse-prevention infrastructure.

Website means the Pincite website at https://pincite.co.nz and its subdomains and pages.

you and your mean the individual whose personal information we hold.