Privacy Policy

Last updated: 8 May 2026

Penned is a New Zealand service that helps parents draft a Section 38 home education exemption application for the Ministry of Education. This Privacy Policy explains what personal information we collect, why we collect it, who handles it, and the choices you have.

We follow the Privacy Act 2020 and the twelve information privacy principles. Even though most of our customers are in New Zealand, we have chosen to align with the GDPR where it is stricter, because we think that is the right thing to do when the information is about a child.

Who we are

Penned is the agency responsible for your information. You can reach us at [contact email]. A real human on our team will reply.

What we collect

When you fill in our intake form, we collect:

• Your email address as the parent or guardian
• Your child's first name, age, and current year level
• Free-text answers about your family's approach to learning, your child's interests, your daily rhythm, and similar questions needed to draft your application

We do not ask for your home address, your child's surname, your IRD number, or any financial information beyond what Stripe needs to take payment. We do not explicitly ask for health, medical, ethnic or religious information. If you choose to mention any of those things in a free-text answer, we will treat that information with the same care as everything else, but we would rather you only share what is genuinely needed for the application.

When you pay, Stripe collects your card details directly. We never see or store your full card number.

Why we collect it

We collect this information for one reason: to draft a Section 38 home education exemption application that you can review, sign, and submit to the Ministry of Education. We do not use your information for marketing, we do not sell it, and we do not use it to train any AI model.

How we draft your application

To produce your draft, we copy your answers into a prompt we have written. Before anything is sent to AI, we replace your child's name and your name with placeholders. No names are transmitted to any AI system. The AI returns a draft, which a human on our team reviews, corrects, and personalises before restoring your real names and sending the finished version to you.

We use AI with data training disabled, so your answers are not used to train any AI model. We are in the process of migrating to Anthropic's commercial API, which provides additional contractual protections. We will update this page when that migration is complete.

We explain this further in our AI Use Disclosure.

Where your information is held, and who else handles it

We use the following service providers. Each one only sees the part of your information they need to do their job.

• Stripe (Ireland, with global infrastructure) handles your payment. We receive a confirmation that you paid, plus your name and email, but not your card details.
• Resend (United States) sends the emails we send you, including your draft delivery email. Your intake answers are transmitted to our team via Resend and are not stored in any database.
• Anthropic (United States) processes your answers through Claude AI to help draft your application, with data training disabled. Names are removed before processing.
• Vercel (United States) hosts the Penned website.

Some of these providers are based outside New Zealand. Where information leaves New Zealand, we only use providers who are subject to comparable privacy law (GDPR) or who contractually commit to equivalent protection.

How long we keep your information

• Intake form answers: emailed directly to our team and not stored in a database. Deleted from our email after your draft is delivered, within 90 days of submission.
• Your draft: delivered to you as a secure, time-limited download link. We delete the file after 7 days.
• Order record (your email, payment date, order status): kept for 7 years to meet IRD record-keeping requirements, then deleted.
• Email correspondence with us: kept for 2 years, then deleted.
• API requests sent to Anthropic: not retained by us; held by Anthropic only briefly under their commercial terms.

You can ask us to delete your information sooner. If we do, we will keep only the minimum financial record IRD requires (transaction date, amount, your name).

Your rights

You can:

• ask what personal information we hold about you
• ask us to correct anything that is wrong
• ask us to delete your information, subject to the IRD record-keeping note above
• withdraw your consent for any future processing
• complain to us, and if you are not satisfied, complain to the Office of the Privacy Commissioner at privacy.org.nz

We will respond to any request within 20 working days, as required by the Privacy Act.

Children's information

Most of the information we handle is about a child. Under the Privacy Act, children have the same privacy rights as adults. We rely on you, as the parent or guardian acting on behalf of your child, to share only what is needed for the application. We never market to children, we never contact a child directly, and we do not share a child's information with anyone other than the providers listed above.

Security

We use providers that encrypt information in transit and at rest. Access to your information on our side is limited to the small Penned team. We use strong, unique passwords and two-factor authentication on every account that touches customer information.

Data breach

If something goes wrong and your information is exposed in a way that is likely to cause you serious harm, we will tell you and notify the Office of the Privacy Commissioner, as required by the Privacy Act 2020.

Cookies

The Penned website uses a small number of cookies needed to make the site work, plus basic analytics. We do not use advertising cookies. See our short note on cookies at the bottom of this page.

Changes to this policy

If we make a material change, we will update the date at the top and email anyone who has an active draft with us.

Contact

Email [contact email] with any privacy question or request. We aim to reply within two working days.