eurekaSign in

Legal

Privacy Policy

Last updated: 2026-08-02

This Privacy Policy explains how Eureka Kiwi Limited ("Eureka", "we", "us") collects, uses and protects your personal information. It is aligned to the New Zealand Privacy Act 2020.

1. Who we are

Eureka is operated from New Zealand. Our Privacy Officer handles requests under the Privacy Act 2020 and can be reached at privacy@eureka.kiwi.nz.

2. What we collect

  • Account details: name, email, hashed password or OAuth identifier.
  • Career data you provide: CV file, target roles, skills, notes, pathway progress.
  • Usage data: page views, feature interactions, device and browser info.
  • Payment metadata: from Stripe — we never see or store full card numbers.
  • Calendar availability: if you connect Google Calendar.

3. Why we collect it

To operate the service (authentication, pathways, gap analysis), match you with mentors, process payments (Stripe), send transactional email (Resend), keep the service secure, and — only with your separate opt-in — send marketing.

4. AI processing

Your CV is processed by an AI model via the Lovable AI Gateway to extract skills and suggest role matches. Outputs are guidance, not advice. You can request human review or opt out of AI processing by emailing privacy@eureka.kiwi.nz. See our AI Use Policy for more.

5. Who we share it with

  • Stripe — payments and Stripe Connect mentor payouts.
  • Resend — transactional email delivery.
  • Google — only if you connect Calendar (read/write access limited to Eureka-created events).
  • Lovable AI Gateway — CV parsing and matching.
  • Supabase (AWS ap-southeast-2, Sydney) — application hosting and database.
  • Mentors you book — see your name and booking topic only.

6. Overseas disclosure (IPP 12)

Some of our providers (Stripe, Google, Lovable AI) process personal information outside New Zealand. We only use providers whose privacy practices we consider comparable to the Privacy Act 2020.

7. How long we keep it

Account and CV data: while your account is active, plus 24 months after a deletion request unless a legal obligation requires longer. Billing records: 7 years (Inland Revenue requirement). Analytics: aggregated and retained indefinitely.

8. Your rights

You can request access to and correction of your personal information (Privacy Act 2020, IPP 6 and IPP 7). We aim to respond within 20 working days. Email privacy@eureka.kiwi.nz.

9. Breach notification

If a notifiable privacy breach occurs we will notify the Office of the Privacy Commissioner and affected individuals as required by Part 6 of the Privacy Act 2020.

10. Cookies

We use only essential cookies plus privacy-focused analytics (Plausible). See our Cookie Notice.

11. Children

Eureka is not intended for children under 16. Please don't create an account if you're under 16.

12. Complaints

Contact privacy@eureka.kiwi.nz first. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).

This page is maintained by Eureka. It is not legal advice and is scheduled for review by a New Zealand-qualified lawyer before public launch.