Privacy notice

The AI Readiness Assessment is provided by NIUTech Solutions Ltd, a New Zealand company (C/O Walker Wayland, Level 14, 88 Shortland Street, Auckland Central, Auckland 1010, New Zealand). If you have a question about your information, or you want us to show you what we hold, correct it, or delete it, email privacy@niutech.co.nz.

Taking the assessment is voluntary. We can’t score it or give you an account without your answers and your email — but you’re free not to provide them, and free to stop at any time.

When you take the assessment, before you have an account

• Your answers to the ten questions.
• The time you started and finished.
• A random token stored in your browser as a secure cookie, so you can close the tab and come back to a part-finished assessment. We store only a one-way hash of that token. It is not linked to your name or email, and it does not identify you.
• Basic technical information needed to keep the page working and to stop automated abuse — including your IP address, used for rate limiting (and kept only as a keyed hash) and passed to our bot-protection provider.

When you create an account to see your results

• Your email address and your name.
• If you sign in with Google or Microsoft, your name, and a link to your profile picture where the service provides one. We store that link but do not currently show the picture anywhere. We never receive your password, and we cannot see anything else in your Google or Microsoft account.
• If you sign in by email, we send you a one-time six-digit code. We keep a short record that a code was requested, so we can spot abuse; that record is deleted after 2 days. The code itself is not kept once used. The first time you sign in this way we ask for your first and last name, so the app can greet you by name rather than by your address; you can change it under Your account.

If you choose to connect to your school

Connecting to a school is optional, and nothing below happens unless you ask for it or accept your school’s invitation. It may unlock additional resources and benefits.

• An invitation from your school. Your school’s leadership can invite you by email. We hold the address they give us, who sent the invitation, and when it was sent, accepted or withdrawn, and we email you the invitation. Nothing else happens unless you accept it.
• The school you choose. We ask you to find your school in a public directory of New Zealand schools. You have the right not to provide this.
• Your request, and who decided it. Your request carries your name and email address, so the person approving it knows who you are rather than approving an address they don’t recognise. We record who approved or declined it, and when.
• If your school isn’t set up on AI Ready yet, we keep a note that you asked about it, so we can follow up. That note is your account and the school’s name — nothing else.
• A second email address, if you add one. You can add and verify your school address — useful when you signed up with a personal one and want your school leaders to recognise you. We send a six-digit code to that address to prove it is yours. The code is stored only as a one-way hash, expires after 15 minutes, allows five attempts, and is erased the moment it is used.

Your school’s documents

If your school works with us on its AI policy and governance, the documents produced for it are stored on AI Ready. They are the school’s own records, held by us. Every member of the school can read them, whatever plan the school is on, and nobody outside the school can. We record who uploaded each document and when. There is no narrower setting than every member yet.

What we work out from your answers

• Your total score out of 30, the same score as a percentage, which of the five bands you fall into, and five sub-scores across the assessment's themes.
• Each time you retake the assessment we keep the new result alongside the previous ones, so you can see how your confidence has changed over time.
• Which learning modules you have started and finished, and when.

What we do not collect

• We do not collect any information about your students.
• We do not use your answers to train AI models.
• We do not sell your information, and there is no advertising.

To score your assessment and show you your result; to give you an account so you can return to it and track your progress; to connect you to your school if you ask us to; to keep the service secure and working; and, using only our own stored data and without identifying anyone, to understand in aggregate how people move through the assessment so we can improve it.

Your individual results are yours. Who at your school can see them depends on how you joined it.

If your school invited you, your school’s leadership can see your score, your band and which of the five areas you are working on — for assessments you complete after joining. We tell you this in the invitation and again before you join, because it is part of what joining a school on AI Ready means. They never see your individual answers, and anything you did before joining stays private to you — except that they can see you have taken the assessment.

If you joined a school yourself, nothing is visible to anyone until you choose to share it. If you do choose to share, you decide what: your score and band, or which modules you have completed. You share with one school, and you can withdraw it at any time.

Two things worth being clear about:

• Nothing from before you joined is shown, except that you took the assessment. If you took the AI Readiness Assessment before joining a school, its leaders can see that you have completed it — never your score, band, areas or answers from it. Nothing else you did before joining is shown, and your individual answers are never shown to anyone at your school.
• Everything else stays private. No other user of the platform can see your results beyond what is described here. The system is built so that the database itself refuses to return one person’s results to another — it is not a matter of us choosing not to look.

Who sees your request to join a school. Your school’s leaders on AI Ready — the principal and anyone your school has made a school leader — and occasionally our own support team, when a school has just come on board and has nobody set up to approve yet, or has lost the person who did. Every approval records who made it.

We use one cookie of our own: a secure token that lets you close the tab and come back to a part-finished assessment, and — once you have an account — the cookie that keeps you signed in. We store only a one-way hash of the first, and neither is used for advertising or for tracking you across other websites.

Our bot-protection provider, Cloudflare, sets a cookie on its own domain (challenges.cloudflare.com) while its check runs. It helps Cloudflare tell apart visitors who share an IP address. We cannot read it, and it is not linked to your account.

We use no analytics, advertising or tracking cookies of any kind.

Your information is stored in Sydney, Australia, in our database provider’s Australian region — so it is held outside New Zealand. We chose an Australian region deliberately, rather than a United States or European one, because Australia has privacy protections comparable to New Zealand’s.

The website itself is delivered through a global hosting network, so the pages you load may be served from somewhere closer to you.

One thing does leave the Sydney region in transit: when we email you — a sign-in code, a verification code, or a message about a school request — that email is sent through a provider based in the United States, which briefly handles your email address to deliver the message. Nothing else leaves Sydney, and your stored information stays in Sydney.

We use a small number of service providers to run the platform. Each sees only what it needs to:

• An assessment you start but never finish, and never create an account for: we mark it inactive after 30 days and delete it, with your answers, within 90 days.
• Sign-in code records: deleted after 2 days.
• Verification codes for a second email address: the code itself expires after 15 minutes and is erased when used. The address stays on your account until you ask us to remove it.
• Your account, your results and your learning progress: kept for as long as your account exists, so your progress over time stays meaningful.
• Your school connection — your request, the decision on it, and your sharing choices: kept for as long as your account exists, because they are the record of what you agreed to and when. Withdrawing sharing is recorded too; we keep the fact that you withdrew, not the sharing.
• A note that you asked about a school that isn’t set up yet: kept until that school comes on board or you ask us to remove it.
• An invitation your school sent you: the link stops working after 14 days, or once it is used or withdrawn. We keep the record of it — the address, who sent it and what happened to it — as the record of what you were told, and remove it if you ask.
• Your school’s documents: kept for as long as the school’s account exists. A school that stops working with us keeps the right to a copy of its own documents, and we delete them on request.

If you want any of it gone, ask us and we will delete it. Our clean-up runs automatically, once a day.

You can ask us to show you what we hold about you, correct anything wrong, or delete your account and results entirely. Email privacy@niutech.co.nz and we will action it and confirm when it is done. There is no self-service delete button yet — we will do it for you.

You can also simply stop using the platform.

We only email you about things you or your school have set in motion: a code you asked for, an address you asked to verify, a school request you made — including its outcome, which arrives without you asking again because you asked once — a merge of two accounts you asked us for, or an invitation your school asked us to send you. We send no newsletters and no marketing.

If you’re ever unhappy with how we’ve handled your information or a request, you can complain to the Office of the Privacy Commissioner (privacy.org.nz). We’d rather you told us first so we can put it right, but that door is always open to you.

If your information is ever exposed in a way that’s likely to cause you harm, we will tell you and the Office of the Privacy Commissioner, as the law requires.

If we change what we collect or what we do with it, we will update this page and, where the change matters, tell you directly.