Privacy Policy

Last updated: 22 May 2026

Pulled is a New Zealand service that helps parents draft a Section 38 home education exemption application for the Ministry of Education. This Privacy Policy explains what personal information we collect, why we collect it, who handles it, and the choices you have.

We follow the Privacy Act 2020 and the twelve information privacy principles. Even though most of our customers are in New Zealand, we have chosen to align with the GDPR where it is stricter, because we think that is the right thing to do when the information is about a child.

Who we are

Pulled is the agency responsible for your information. You can reach us at hello@pulled.co.nz. A real human on our team will reply.

What we collect

When you fill in our intake form, we collect:

• Your email address as the parent or guardian
• Your child's first name, age, and current year level
• Free-text answers about your family's approach to learning, your child's interests, your daily rhythm, and similar questions needed to draft your application

We do not ask for your home address, your child's surname, your IRD number, or any financial information beyond what Stripe needs to take payment. We do not explicitly ask for health, medical, ethnic or religious information. If you choose to mention any of those things in a free-text answer, we will treat that information with the same care as everything else, but we would rather you only share what is genuinely needed for the application.

When you pay, Stripe collects your card details directly. We never see or store your full card number.

Why we collect it

We collect this information for one reason: to draft a Section 38 home education exemption application that you can review, sign, and submit to the Ministry of Education. We do not use your information for marketing, we do not sell it, and we do not use it to train any AI model.

How we draft your application

To produce your draft, we pass your answers to Claude, an AI made by Anthropic, via their commercial API. Before anything is sent to AI, your child's first name, any email addresses, and any phone numbers in your answers are automatically removed and replaced with placeholders. The AI returns a draft, which a human on our team reviews, corrects, and personalises before restoring your real details and sending the finished version to you.

We use Anthropic's commercial API, which contractually prohibits using your data to train AI models. Your answers are not used to train any AI.

We explain this further in our AI Use Disclosure.

Where your information is held, and who else handles it

We use the following service providers. Each one only sees the part of your information they need to do their job.

• Stripe (Ireland, with global infrastructure) handles your payment. We receive a confirmation that you paid, plus your name and email, but not your card details.
• Resend (United States) sends the emails we send you, including your confirmation and draft delivery emails.
• Anthropic (United States) processes your answers through their Claude API to produce your draft. Data training is contractually prohibited. Identifying details are removed before processing.
• Supabase (United States, hosted in ap-southeast-2) stores your submission and draft securely until delivery is complete.
• Vercel (United States) hosts the Pulled website.
• GitHub (United States) holds our private, encrypted database backups. Access is restricted to the Pulled team.

Some of these providers are based outside New Zealand. Where information leaves New Zealand, we only use providers who are subject to comparable privacy law (GDPR) or who contractually commit to equivalent protection.

How long we keep your information

• Intake form answers and your draft: stored securely in our database until your draft is delivered, then deleted within 90 days of submission.
• Your draft: emailed to you directly once it is ready. We delete the stored submission from our database within 90 days of delivery.
• Order record (your email, payment date, order status): kept for 7 years to meet IRD record-keeping requirements, then deleted.
• Email correspondence with us: kept for 2 years, then deleted.
• API requests sent to Anthropic: not retained by us; held by Anthropic only briefly under their commercial terms.
• Backups: we keep secure, encrypted backups of our database so we can recover your application if something goes wrong. Backups are held privately and access is limited to the Pulled team. When we delete your information from our live database, it can remain in a backup for a short additional period before that backup is rotated out.

You can ask us to delete your information sooner. If we do, we will keep only the minimum financial record IRD requires (transaction date, amount, your name), and your information will also be removed from backups as they rotate.

Your rights

You can:

• ask what personal information we hold about you
• ask us to correct anything that is wrong
• ask us to delete your information, subject to the IRD record-keeping note above
• withdraw your consent for any future processing
• complain to us, and if you are not satisfied, complain to the Office of the Privacy Commissioner at privacy.org.nz

We will respond to any request within 20 working days, as required by the Privacy Act.

Children's information

Most of the information we handle is about a child. Under the Privacy Act, children have the same privacy rights as adults. We rely on you, as the parent or guardian acting on behalf of your child, to share only what is needed for the application. We never market to children, we never contact a child directly, and we do not share a child's information with anyone other than the providers listed above.

Security

We use providers that encrypt information in transit and at rest. Access to your information on our side is limited to the small Pulled team. We use strong, unique passwords and two-factor authentication on every account that touches customer information.

Data breach

If something goes wrong and your information is exposed in a way that is likely to cause you serious harm, we will tell you and notify the Office of the Privacy Commissioner, as required by the Privacy Act 2020.

Cookies

The Pulled website uses cookies for two purposes: to make the site work correctly, and to understand how people use the site (analytics). We use PostHog and Google Analytics for analytics. These tools set cookies in your browser that help us see which pages are visited and how people move through the site. We do not use advertising cookies or sell any data to advertisers.

If you prefer not to be tracked by analytics, you can block cookies in your browser settings. This will not affect your ability to use the site or submit an application.

Changes to this policy

If we make a material change, we will update the date at the top and email anyone who has an active draft with us.

Contact

Email hello@pulled.co.nz with any privacy question or request. We aim to reply within two working days.