privacy.

ursa.nz is a creative media laboratory and Indigenist research co-operative. We work with people across Australia and Aotearoa New Zealand.

ursa.nz is a business name registered to Aidan Tuhoro-Bell, ABN 30 956 581 475. We also work with other traders and providers under the ursa.nz name. We give you their details and privacy policies before you agree to work with them.

Write to kiaora@ursa.nz about anything on this page. Our privacy officer will answer.

This policy applies to this site, the client portal at ursa.nz/account and the work we do with you.

Businesses that turn over less than $3 million a year are exempt from Australia's Privacy Act. We follow the Australian Privacy Principles anyway.

New Zealand's Privacy Act 2020 applies to us in full, because we do business there.

Other sites we link to have their own policies.

We do not set cookies or run analytics. Every font, icon and script comes from ursa.nz.

We log each request with the time, the site, the method, your browser's name and a shortened IP address. We keep the first three parts of the address, or the first 48 bits for IPv6. We don't log the page you visit or any cookie. We delete the log within ten days.

When a request fails, we log the page address and the same shortened IP address. We keep those lines for about a week for diagnostics and security reasons.

To send an enquiry, you give us your name and a way to reach you, by email, text, Signal or phone. You can add a topic, a message or a good time to call.

Your message travels over HTTPS to our server in Sydney, and we store it on an encrypted disk.

We email ourselves to say an enquiry has arrived. That email does not contain what you wrote. We read your message only in our site's admin, on our own server.

We use your IP address to stop anyone flooding the form. We keep it in memory for about an hour and never save it.

We only use what you send us to reply to you. We delete an enquiry 12 months after we last updated it. If the conversation turns into work, we move what's needed into our client records and tell you what we keep.

We check that you're a person in your browser, without a cookie or any other company.

When you become a client, we store your organisation's name, billing address and ABN or NZBN. We also store the name and email address of each person we deal with there.

We keep the invoices and credit notes we send you, and a record of each payment.

We keep the material you give us for the work, such as documents, recordings, images and data, on our own systems. We run our own forge, wiki and chat.

We use it to do the work, bill for it and keep our accounts. We will never use it for anything else unless you agree first.

We send nothing you give us to an AI service unless you explicitly agree first. If you do, we use Claude, from Anthropic in the United States, and only on the parts of the work you choose.

We also run AI models on our own computers. Your material stays on our machines when we do.

Your contacts sign in to the client portal with a link we email them. They can use the link once, within 15 minutes. We then set one cookie, and they stay signed in for seven days.

To answer a question, we sometimes open the portal as one of your contacts would see it.

Card payments go through Stripe. You enter your card number on Stripe's page, and we never see it.

We keep the card's brand, its last four digits and its expiry date, so you know which card is paying your invoices.

If you save a card for regular billing, we record who agreed to that, when, from which IP address and the terms they saw. We keep that record as proof you agreed to the charges.

We send Stripe your organisation's name, a contact's email address, the invoice numbers and the amounts. Our account is with Stripe Payments Australia. Stripe stores payment data in the United States and other countries.

Stripe also checks payments for fraud and keeps the records the law requires. For those, its own privacy policy applies.

If you pay by bank transfer, we do not use Stripe.

Our inbox is with Tuta in Germany. Tuta stores mail encrypted and can read only the addresses and dates.

Lettermint, in the Netherlands, sends our site's emails, such as invoices, sign-in links and reminders. Lettermint deletes each one after 28 days.

Most email travels encrypted between servers, but not all. For anything sensitive, ask us to use Signal or our Matrix server at chat.ursa.nz.

We rent our server in an OVHcloud data centre in Sydney. We store your information on an encrypted disk, and only we have the keys.

Every night we back up the server's database and files. We encrypt each backup on our server before it leaves.

We send one copy to kDrive in Switzerland and one to rsync.net in the United States. Neither company can read them.

We keep a daily backup for a week, a weekly backup for a month and a monthly backup for six months. Anything we delete is gone from the backups within about six months.

Every connection to our server uses HTTPS. Your browser will not connect without it.

If a disk is removed from the server or thrown away, nobody can read it. As with any rented server, data centre staff can get to the machine itself. We make it hard to copy your data that way, but no rented server is perfectly safe.

Only ursa.nz staff can sign in to our office. Everyone with access to your records signs in with a second factor every time.

Changes to the server need our hardware security keys.

We store sign-in links and portal sessions as fingerprints. Nobody can sign in with a copy of our database.

We update the server and its software as fixes come out, and we test that our backups restore.

These companies store or send information for us. We use each one under its data processing agreement or its privacy terms.

None of them may use your information for their own purposes, except Stripe for fraud checks and the records the law requires.

We store your information in Australia. Some of it goes to other countries.

Encrypted backups go to Switzerland and the United States. We encrypt them first, so neither company can read them.

Email passes through the Netherlands, and our inbox is in Germany. Both countries follow the EU's General Data Protection Regulation.

Stripe stores payment information in the United States and other countries where it operates.

If you agree to us using Claude on your work, we send the parts you choose to Anthropic in the United States.

We choose companies that must protect your information, by law or by contract.

We keep information only as long as we need it.

• Server logs, up to ten days. Error logs, about a week, and never more than a month.
• Enquiries, 12 months after we last updated them.
• Sign-in links and portal sessions, 30 days after they expire.
• Client records, invoices and payments, seven years after your last invoice, as Australian and New Zealand tax law requires.
• Material you give us for the work, until the work ends. Then we return it or delete it, as we agree with you.
• Emails our site sends, 28 days at Lettermint.
• Backups, up to six months after we delete the original.

We do not set cookies on the public site.

When a contact signs in to the client portal, we set one cookie, ursa-portal. It contains a random token, and they stay signed in for seven days.

Our staff get more cookies when they sign in to the office. Visitors and clients do not get them.

We keep your accessibility choices in your browser's session storage, for that tab only. We never see them.

One part of our work runs without a person deciding each case. That is billing by saved card, on terms you agreed.

We issue each invoice seven days before its period starts, and charge your saved card on the due date.

If a charge fails, we try again three, five and seven days later, and email you after each failed charge. After the last try, we stop charging and mark the subscription past due. Paying the invoice starts it again.

We use your invoices, the card you saved and Stripe's payment results to do this. What you owe comes from your agreement with us.

Information about Aboriginal and Torres Strait Islander peoples, Māori and Pacific peoples belongs to the communities it comes from.

We follow the CARE principles for Indigenous data governance, which are collective benefit, authority to control, responsibility and ethics.

When we work with a community's knowledge, stories or data, we agree in writing who decides where it's kept, who sees it and how it's used. Where we've agreed to more than this policy says, we do more.

When the work ends, the community decides what happens to it.

You can ask what information we have about you, and for a copy. You can ask us to correct or delete it. Write to kiaora@ursa.nz.

We answer within 20 working days, free. We may first ask you to confirm who you are.

We delete what you ask us to, unless the law requires us to keep it, such as invoices for tax. If we can't do what you ask, we tell you why and how to complain.

You can enquire without giving your real name. However, we need legal details for an invoice.

If a breach could cause you any harm, we tell you as soon as we can, with what happened, what it affects and what you can do.

We also tell New Zealand's Privacy Commissioner and the Office of the Australian Information Commissioner.

Tell us first, at kiaora@ursa.nz. We reply within 20 working days.

If you're not satisfied, you can complain to a regulator.

In Aotearoa New Zealand, the Office of the Privacy Commissioner, at privacy.org.nz or 0800 803 909.

In Australia, the Office of the Australian Information Commissioner, at oaic.gov.au or 1300 363 992. Because our turnover makes us exempt from Australia's Privacy Act, the OAIC may not be able to act on a complaint about us. It can still give you advice.

We update this page when what we do changes, such as a new provider, and change the date at the top.

If a change affects information we already have about you, we email you before it takes effect.