Privacy Policy

New Zealand Boutique Consultancy Association is responsible for BoutiqAcademy and the personal information described in this policy.

For privacy questions, access or correction requests, or concerns, email contact@boutiqacademy.com.

We also retain administrator-authored courses, templates and resources, feature and navigation settings, API-key usage timestamps, and limited technical records needed to operate and secure the service. Request logging excludes authentication headers, cookies and URL query values.

If you joined the BoutiqAcademy waitlist while it was open, we keep your email address and the time you joined so we can contact you about when sign-up is available. Joining the waitlist did not create an account, and the waitlist is now closed to new entries.

If you create a free account, we retain your name, email address, a secure hash of the password you choose, the time you accepted this policy, and whether you chose to receive news about new courses. Your account is not active until you confirm your email address, and a free account that is never confirmed is deleted after seven days. An account that has been paid for is kept. You can ask us to stop sending news at any time.

If you buy a plan or package, or redeem a code, we also retain your Stripe customer reference, the plan or package you have and the dates your access runs, your subscription status and renewal date, and a record of each payment (the invoice number, amount, GST, date and a link to the tax invoice). Payments are taken by Stripe on its own page, so we never see or store your card details. While you are on that page, your name, email address and a secure hash of your password are held for up to 24 hours so your account can be created when the payment goes through. If you do not pay, they are deleted and no account is made.

Certificate records preserve the learner name, course details, completion date, credential status and issuance metadata so credentials can be issued and verified. A valid public verification page displays the credential details shown on the certificate. A revoked verification result does not display the learner's name.

• Provide and secure member accounts.
• Deliver courses, remember completion progress and issue credentials.
• Answer questions and produce research when you choose to use AI features.
• Send account welcome, confirmation, password-reset and payment receipt emails.
• Take payments, manage plans, packages and codes, and keep the records tax law requires.
• Contact people who joined the earlier waitlist about when sign-up is available.
• Maintain, troubleshoot and protect BoutiqAcademy.
• Respond to privacy, support and account requests.

We do not sell personal information and we do not use advertising trackers.

We use service providers to host the application and database, store private files, deliver transactional email through Resend, take payments through Stripe, and provide AI features through Anthropic. These providers receive only the information needed to perform those services and handle it under their own contractual and privacy obligations.

BoutiqAcademy may link to external resources, LinkedIn, videos, documents or websites. Once you open an external service, its privacy policy applies.

We keep account and learning records while they are needed to provide BoutiqAcademy, maintain credential history, meet legal obligations, resolve disputes and protect the service. Saved AI results remain until you delete them or your account data is removed. Operational logs are retained according to the hosting service's operational settings.

Payment and invoice records are kept for the period New Zealand tax law requires (currently seven years), even if the account is closed.

Course and template entries covered by the notice above are not retained by BoutiqAcademy. To request access, correction or deletion of retained personal information, email contact@boutiqacademy.com. Some records may need to be retained where required by law or to preserve the integrity of an issued credential.

We use access controls, password hashing, private file storage, restricted certificate downloads, request-log redaction and other technical and organisational safeguards appropriate to the service. No online service can guarantee absolute security, so please contact us promptly if you believe your account or information may be at risk.

You may ask us to confirm what personal information we hold about you, provide access to it, or correct information that is inaccurate. You may also ask us to delete information where applicable or raise a concern about how it has been handled.

We will respond in accordance with the New Zealand Privacy Act 2020. You may also contact the Office of the Privacy Commissioner if you are not satisfied with our response.

We may update this policy when BoutiqAcademy, our providers or legal requirements change. We will publish the revised policy here and update the effective date. If a change materially affects how we use personal information, we will provide an additional notice where appropriate.