Legal

Privacy Policy

Version 1.0 · Last updated: 2 November 2026 · New Zealand

Introduction

Welcome to LeaderKit. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, and your rights under the New Zealand Privacy Act 2020.

Throughout this policy, "LeaderKit", "we", "us" or "our" refers to the operator of leaderkit.com. "Service" means the LeaderKit strategy development platform and any related features, tools, or content. "You" or "User" means anyone who visits leaderkit.com or uses the Service. "Account" means the registered account you create to access the Service.

If anything in this policy is unclear, please email us at hello@leaderkit.com — we are happy to explain.

2.1 Information we collect

Information you give us directly

Name and email address when you create an account.
Billing details (processed securely by Stripe — we do not store your card numbers).
Profile information and content you enter into the platform (e.g. strategy documents, goals, team data).
Communications you send us, such as support emails.

Information collected automatically

Log data: your IP address, browser type, pages visited, and the date and time of requests.
Device information: device type, operating system, and browser version.
Usage data: features you interact with, session duration, and navigation paths.
Cookies and similar tracking technologies (see "Cookies and tracking" below).

Information from third parties

Payment confirmation and billing status from Stripe.
If you sign in using a third-party identity provider (such as Google or Microsoft), we receive the basic profile information that provider shares with us.

2.2 Why we collect your information

We only collect personal information for lawful purposes directly connected to providing the Service. Specifically:

To create and manage your account.
To deliver and improve the Service.
To process payments and manage your subscription.
To send important account notices (billing, security alerts, policy updates).
To send optional marketing communications (only with your consent; you can opt out at any time).
To meet legal obligations.
To investigate and resolve technical issues or complaints.

2.3 Legal basis for processing

Where applicable law requires a legal basis for processing, we rely on:

Contract: processing necessary to provide the Service you requested.
Legitimate interests: improving the platform, preventing fraud, and ensuring security.
Legal obligation: where law requires us to retain or disclose information.
Consent: for optional communications such as marketing emails.

2.4 How long we keep your information

We keep personal information only as long as needed for the purpose it was collected, or as required by law:

Account data is held while your account is active and for up to 7 years after closure (for legal and tax compliance).
Billing records are held for 7 years as required by New Zealand tax law.
Log and usage data is typically retained for 12 months.
Marketing consent records are held for 3 years after your last interaction.

2.5 Sharing your information

We do not sell your personal information. We share it only in the following limited circumstances:

Service providers (sub-processors)

We use trusted third-party providers to help us operate the Service:

Amazon Web Services (AWS) — cloud hosting and infrastructure, including AI capabilities via Amazon Bedrock. Data is stored in the AWS region specified at account creation.
Stripe — payment processing. Your card details are handled directly by Stripe and are never stored on our servers.
Xero — accounting and invoicing. Invoice and billing data is shared with Xero for financial record-keeping.

Each provider has their own privacy controls, and we require them to handle your data in accordance with applicable privacy law.

Legal requirements

We may disclose your information if required to do so by law, court order, or a government authority, or where we believe disclosure is necessary to protect the rights, property, or safety of LeaderKit, our users, or others.

Business transfers

If LeaderKit is sold, merged, or undergoes a significant business change, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

2.6 International data transfers

LeaderKit is operated from New Zealand, and your data may be processed in countries outside New Zealand (including the United States, where AWS and Stripe infrastructure is located). We ensure international transfers are made with appropriate safeguards consistent with our obligations under the Privacy Act 2020.

2.7 AI features and Amazon Bedrock

How we use AI

LeaderKit uses Amazon Bedrock to power certain AI-assisted features within the platform. Content you enter into AI-assisted features may be processed by Amazon Bedrock in accordance with AWS's data processing terms. We do not use your content to train foundation models. Outputs generated by AI features are not guaranteed to be accurate and should be reviewed by you before you rely on them.

2.8 Google and Microsoft calendar data

You can choose to connect a Google Calendar or Microsoft Outlook / 365 calendar in LeaderKit under Settings, then Integrations. This is optional. If you connect a calendar, LeaderKit creates a separate calendar named "LeaderKit" in your account and adds all-day events for the deadlines of goals and key actions you own. Each event has the item's title, its deadline date and a link back to LeaderKit. Completed items are removed from the calendar.

Google Calendar

LeaderKit asks Google for one calendar permission: https://www.googleapis.com/auth/calendar.app.created. This lets LeaderKit create its own calendar and manage events on that calendar only. LeaderKit only creates, updates and deletes events on the LeaderKit calendar. It does not read, change or delete your other calendars or events, and this permission does not give LeaderKit access to them. We also ask for your basic sign-in details (openid and email) so we can show which Google account is connected.

LeaderKit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft Outlook / 365

For Outlook, Microsoft does not offer a permission limited to one app-created calendar, so LeaderKit asks for Calendars.ReadWrite, plus basic sign-in details (openid, email, offline_access and User.Read). LeaderKit uses this to find or create its own "LeaderKit" calendar by name and to manage the deadline events on it. It does not read the content of your other calendars or events.

If your organisation uses LeaderKit with Microsoft Teams and the workspace account holder sets up a "Goal & action review" meeting, LeaderKit also creates and updates that one recurring meeting in the account holder's connected Outlook calendar, with the invited attendees and an agenda of goals and key actions due. LeaderKit only changes or cancels meetings it created.

What we store

Encrypted access and refresh tokens, so we can keep the events up to date without asking you to sign in each time.
The email address of the connected calendar account.
The ID of the LeaderKit calendar and the IDs of the events LeaderKit created, so we can update or remove them.
Basic sync status, such as when the calendar was last updated.

We do not store the content of your other calendars or events.

How we use it

We use calendar data only to show your LeaderKit deadlines in your calendar. We do not sell this data, use it for advertising, or use it to train AI or machine learning models. We do not share it with third parties, except our hosting provider (AWS) which stores it on our behalf, or where the law requires it. People at LeaderKit do not read it except for security, to comply with the law, or with your permission (for example, when you ask for support).

Disconnecting and deletion

You can disconnect at any time in LeaderKit under Settings, then Integrations, then Disconnect. When you disconnect, we remove the events we created, remove the LeaderKit calendar if it is empty, and delete our stored tokens and calendar records. For Google, we also ask Google to revoke LeaderKit's access. If we cannot remove the calendar automatically, you can delete it in your calendar app.

You can also remove LeaderKit's access at any time from your Google Account at myaccount.google.com/permissions, or for Microsoft at myapps.microsoft.com (work or school accounts) or account.live.com/consent/Manage (personal accounts). To ask us to delete any calendar data we hold, email hello@leaderkit.com.

2.9 Security

We take reasonable steps to protect your personal information from loss, misuse, unauthorised access, disclosure, alteration, or destruction. Our measures include:

Encryption of data in transit (TLS) and at rest.
Access controls limiting which staff and systems can access personal data.
Regular security reviews and monitoring of our AWS infrastructure.
Incident response procedures.

No system is completely secure. In the event of a notifiable privacy breach, we will comply with our notification obligations under the Privacy Act 2020.

2.10 Your rights

Under the Privacy Act 2020, you have the right to:

Access the personal information we hold about you.
Request correction of any information that is inaccurate or out of date.
Complain to us if you believe we have breached the Privacy Act.

To exercise any of these rights, please email hello@leaderkit.com. We will respond within 20 working days.

If you are an EU or UK resident, you may have additional rights under the GDPR or UK GDPR (including the right to erasure and data portability). Please contact us and we will assist you.

If you are an Australian resident, Australian Privacy Act 1988 principles are broadly similar and we apply compatible standards.

2.11 Privacy complaints

If you are unhappy with how we have handled your personal information, please contact us first at hello@leaderkit.com so we can try to resolve the issue.

If you remain unsatisfied, you may complain to the New Zealand Privacy Commissioner at www.privacy.org.nz or by calling 0800 803 909 (within New Zealand).

Cookies and tracking

LeaderKit uses cookies and similar technologies to make the Service work properly and to understand how it is used.

What are cookies?

Cookies are small text files stored on your device by your browser. They help websites remember your preferences and provide a better experience.

Type	Purpose	Details
Essential	Required	Login sessions, security, basic functionality. Cannot be disabled.
Functional	Preferences	Remember your settings and preferences across sessions.
Analytics	Improvement	Understand how you use the platform so we can improve it. Anonymised where possible.
Marketing	Optional	Used only with your consent to show relevant information. You can opt out at any time.

You can control cookies through your browser settings. Note that disabling essential cookies will affect your ability to use the Service. For non-essential cookies, you can withdraw consent at any time by updating your preferences in your account settings.

Contact us

If you have any questions about this Privacy Policy or want to exercise your privacy rights, please contact us at hello@leaderkit.com.

This Privacy Policy was prepared for LeaderKit (leaderkit.com) and reflects the laws of New Zealand as at the date of publication. It does not constitute legal advice.