Privacy Policy

Last updated 18 April 2026

Who we are

Consented is a Christchurch-based service that turns publicly available Christchurch City Council (CCC) resource consent data into personalised email digests and a live dashboard. This policy explains how we handle your personal information under the New Zealand Privacy Act 2020.

Consented operates from Christchurch, New Zealand. Privacy contact: hello@consented.co.nz.

What we collect

  • Account information: your email address (for sign-in and digest delivery) and an optional display name.
  • Preferences: the suburbs and developers you choose to watch, your persona, and your email cadence (daily/weekly/monthly/none).
  • Billing information: if you subscribe, we pass payment details directly to Stripe. We do not store card numbers ourselves. We receive only a Stripe customer ID and subscription status.
  • Usage data: standard server logs (IP address, user agent, request times) retained for debugging and security.
  • Advertising and analytics signals: when you visit consented.co.nz we load Meta's Pixel and Vercel Analytics (described below). These see your page URL, IP address, browser type, and a first-party cookie. They do not see your email, password, or any of your dashboard data.

How we use it

We use your information to:

  • Send the digest emails you've opted in to, at the cadence you've chosen.
  • Filter consent data to match your watched suburbs and developers.
  • Manage your subscription and process payments.
  • Measure the performance of our advertising on Meta (Facebook and Instagram) so we know whether our campaigns are reaching the right audience.
  • Diagnose and fix bugs, and protect against abuse of the service.

We do not sell your personal information.

Who we share it with

  • Supabase. Database and authentication, stores your account and preferences.
  • Vercel. Application hosting, plus Vercel Analytics and Speed Insights, which record anonymised page-view counts and performance metrics. No personally identifying information is sent to Vercel beyond what Vercel needs to serve the page.
  • Resend. Transactional and digest email delivery.
  • Stripe. Subscription billing, if you subscribe to a paid plan.
  • Anthropic. Claude API, used server-side to generate plain-English summaries of consent records. Your personal details are never sent.
  • Meta (Facebook and Instagram). We use the Meta Pixel (client-side) and the Meta Conversions API (server-side) to measure the performance of our advertising. The Pixel sets a first-party cookie and reports page-view events. The Conversions API reports server-side events (signup, trial start, purchase) along with a hashed version of your email so Meta can match the event to its own records. We do not share your password, dashboard data, or watchlists with Meta.
  • Beehiiv. If you opt in to our newsletter (separate from the digest), Beehiiv processes the newsletter subscription.

Each provider is a reputable processor with their own privacy commitments. Some of them store data outside New Zealand.

Cookies and tracking

Consented uses cookies for the following purposes:

  • Authentication. Supabase sets HTTP-only session cookies so you stay signed in.
  • Analytics. Vercel Analytics records aggregated page-view counts without setting persistent cookies.
  • Advertising measurement. The Meta Pixel sets a first-party cookie called _fbp. If you arrive on consented.co.nz via a Meta ad it may also set _fbc. These cookies are used to attribute ad performance and are not shared with third parties beyond Meta.

You can disable cookies in your browser, or use a tracker blocker, and the core product (dashboard, digests, account) will still work.

How we protect it

All traffic is served over HTTPS. Database access is restricted by row-level security so one user cannot read another user's preferences. Service credentials are held in secret storage and rotated on suspicion of compromise.

Your rights

Under the Privacy Act 2020 you can:

  • Ask for a copy of the personal information we hold about you.
  • Ask us to correct information that is wrong.
  • Delete your account and all associated data at any time via Settings.
  • Unsubscribe from digest emails immediately via the link at the bottom of every email, or by setting your cadence to “None” in Settings.

Email hello@consented.co.nz with any privacy request. If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email; the “last updated” date at the top of this page always reflects the current version.