We respect your privacy. This policy explains how Instilligent Limited collects, uses, and protects personal information in accordance with the New Zealand Privacy Act 2020.
Modular Compliance (modularcompliance.com) is a product of Instilligent Limited, a New Zealand registered company (NZBN: 9429051796284). In this policy, "we", "us", and "our" refers to Instilligent Limited as the operator of Modular Compliance.
We are an agency as defined by the Privacy Act 2020, and we are subject to the Information Privacy Principles (IPPs) set out in that Act.
For any privacy-related queries, requests, or complaints, contact our Privacy Officer at privacy@instilligent.com. We will acknowledge your request within 3 working days and respond substantively within 20 working days, as required by the Privacy Act 2020.
We collect personal information only for lawful purposes connected with our functions and activities, and only where it is necessary for those purposes.
We collect personal information directly from you when you:
We also collect limited technical and analytics data automatically when you use our website and platform (see Section 8 — Third-party services).
We do not collect personal information from third parties or public sources without your knowledge, except where required by law.
At or before the time we collect personal information, or as soon as practicable thereafter, we will take steps reasonable in the circumstances to ensure you are aware of:
This policy serves as the primary collection notice. Additional notices may appear at relevant points in our platform (such as forms and account creation flows).
We use personal information only for the purpose for which it was collected, or for a directly related purpose. Specifically, we use your information to:
We do not use your information for marketing purposes without your explicit consent. We do not sell personal information to any third party.
We take reasonable steps to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction.
All platform data — including your account information and compliance records — is stored on Railway infrastructure in the US-West region (United States). As Railway servers are located outside New Zealand, your personal information is transferred to the United States as part of normal platform operation. We ensure appropriate contractual and technical safeguards are in place with Railway.
We retain your compliance records and audit trail for 7 years from the date of creation, reflecting the retention requirements of NZ health and safety, employment, AML/CFT, and privacy legislation. Account data is retained for the duration of your subscription and for 12 months following account closure, after which it is permanently deleted.
We do not disclose personal information to third parties except as described below.
We share personal information with third-party service providers solely to the extent necessary to operate the platform:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Railway | Platform infrastructure and database hosting | All platform data | US-West (USA) |
| Stripe, Inc. | Payment processing and subscription management | Name, email, billing address, payment card data | USA |
| Anthropic (Claude API) | AI-powered compliance insights and analysis | Compliance record text (de-identified where possible) | USA |
| Google Analytics 4 (G-NQZ08PD0MJ) | Website usage analytics | Anonymised IP, browser/device type, page views | USA |
All providers are subject to contractual data protection obligations. We have applied IP anonymisation to our Google Analytics configuration.
We may disclose personal information where we are required to do so by law, court order, or regulatory requirement in New Zealand. We will notify you of such a disclosure where we are legally permitted to do so.
If Instilligent Limited is acquired or merges with another entity, personal information may be transferred as part of that transaction. We will notify affected users and they will retain their rights under the Privacy Act 2020.
Your personal information is transferred to and processed in the United States by Railway, Stripe, Anthropic, and Google (as described in Section 7). The United States does not have an equivalent privacy regime to New Zealand's Privacy Act 2020.
By using Modular Compliance, you acknowledge that your information will be transferred overseas. We take reasonable steps to ensure that these overseas recipients protect your personal information to a standard comparable to the Privacy Act 2020, including through data processing agreements and standard contractual clauses.
If you have concerns about overseas transfer of your data, please contact us at privacy@instilligent.com before using the platform.
Under the Privacy Act 2020, you have the right to:
To make an access or correction request, email privacy@instilligent.com with your name, email address, and the nature of your request. We will respond within 20 working days. In some cases, we may need to verify your identity before processing your request.
We may refuse access or correction in circumstances set out in the Privacy Act 2020 (for example, where doing so would prejudice the maintenance of the law). If we refuse, we will tell you the reason and advise you of your right to complain to the Privacy Commissioner.
The following table summarises how our practices align with all 12 IPPs under the Privacy Act 2020:
Our website uses cookies and Google Analytics 4 (GA4, property ID: G-NQZ08PD0MJ) to collect anonymised usage data. We have configured GA4 with IP anonymisation enabled.
We do not use advertising or tracking cookies for marketing purposes.
If we become aware of a privacy breach that poses a risk of harm to an individual, we will:
If you believe your personal information held by us has been compromised, please notify us immediately at privacy@instilligent.com.
If you believe we have breached the Privacy Act 2020 in relation to your personal information, please contact us first at privacy@instilligent.com. We will investigate and respond within 20 working days.
If you are not satisfied with our response, you may complain to the New Zealand Privacy Commissioner:
We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. For material changes, we will notify subscribers by email at least 14 days before the change takes effect.
Your continued use of Modular Compliance after any changes to this policy constitutes your acceptance of those changes.
For any privacy questions, access requests, correction requests, or complaints:
Instilligent Limited — Privacy Officer
Email: privacy@instilligent.com
General: info@instilligent.com
NZBN: 9429051796284
Website: instilligent.com