This Privacy Statement describes the manner in which LeStudio Limited collects, holds, uses, discloses, protects, retains and otherwise handles personal information in connection with the Services.
1. Scope and Privacy Agency
1.1 Agency
For the purposes of this Statement, the agency collecting and holding personal information is LeStudio Limited (“LeStudio”, “we”, “us” or “our”).
1.2 Corporate Details
LeStudio Limited is a New Zealand company:
- Company number: 9452538;
- NZBN: 9429053895868;
- public contact address: 27 Broadfell Avenue, Avonhead, Christchurch 8042, New Zealand.
1.3 Privacy Officer
LeStudio's Privacy Officer is Logan Evans.
1.4 Privacy Contact
Privacy enquiries and requests may be sent to privacy@lestudio.co.nz.
1.5 Services Covered
This Statement applies to LeStudio websites, Accounts, applications and Services that display or link to it.
2. Definitions and Interpretation
2.1 Personal Information
“Personal information” has the meaning given by applicable New Zealand privacy law and, in general terms, means information about an identifiable individual.
2.2 Account
“Account” means a LeStudio identity used to access a supported Service.
2.3 Service
“Service” means a LeStudio website, application, platform, product or online service to which this Statement applies.
2.4 Provider
“Provider” means a third party that supplies infrastructure, communications, storage, security, database, analytics or another service used by LeStudio.
3. Categories of Personal Information
3.1 Account Information
Depending on the supported sign-in method, LeStudio may collect or hold:
- email address;
- password credential in hashed form for password-based Accounts;
- Account and email-verification status;
- legal-document acceptance records;
- optional marketing preference;
- optional profile or display information where supported.
3.2 Authentication and Security Information
LeStudio may process:
- session identifiers;
- login and security events;
- verification and password-recovery records;
- IP address or related network information where reasonably required for abuse prevention or security;
- anti-bot or security-challenge information;
- browser or device information where reasonably required for security.
3.3 Enquiry Information
Where you contact LeStudio, LeStudio may collect:
- name;
- email address;
- optional phone number;
- subject;
- message;
- selected enquiry destination;
- attachments;
- correspondence and follow-up communications.
3.4 User Files and Content
A Service may permit authenticated users to upload documents, drawings, images or other supported files. Those files may contain personal or confidential information selected by the user.
3.5 Preferences
LeStudio may store preferences such as display, layout, theme, favourites or local workspace settings.
3.6 Public Feature Information
A public feature may display information that a user chooses to submit for public display. The current Snake leaderboard can display a submitted display name, score, device category and submission time.
3.7 Product and Device Telemetry
LeStudio may process limited technical information reasonably required for compatibility, security, connection status, diagnostics or support.
Routine Archicad heartbeat processing does not include machine name, computer username, current project or raw IP as routine heartbeat fields.
3.8 Website Analytics
LeStudio uses Vercel Web Analytics. The current analytics implementation may process page route, referrer, approximate location, browser, operating system and device category in the manner described in clause 10.
4. Purposes of Collection and Use
4.1 Permitted Purposes
LeStudio may collect and use personal information where reasonably necessary to:
- establish, verify and administer Accounts;
- authenticate users;
- support password recovery and Account security;
- protect users, LeStudio and infrastructure from abuse, compromise and security threats;
- respond to enquiries;
- provide requested products, storage and Services;
- maintain preferences;
- provide support;
- diagnose and improve reliability;
- maintain necessary legal-acceptance evidence;
- comply with Applicable Law;
- manage disputes, complaints or security incidents.
4.2 Data Minimisation
LeStudio does not intend to collect identifying information merely because it might be useful at an unspecified future time.
4.3 Secondary Use
LeStudio will not knowingly use personal information for a materially unrelated purpose unless that use is permitted by applicable privacy law.
5. Direct Collection and Collection Notices
5.1 Direct Collection
LeStudio may collect personal information directly from you when you register, sign in, contact LeStudio, upload content, configure a preference or otherwise use a Service.
5.2 Required Information
Where providing information is required for a particular purpose, LeStudio intends to make that requirement reasonably clear at or before collection.
5.3 Current Account Requirements
For the current central LeStudio Account:
- email is required;
- a supported authenticator is required;
- acceptance of applicable legal documents is required before registration can be completed;
- optional promotional marketing is separate;
- legal name and phone number are not required merely to establish the shared identity.
5.4 Enquiries
For an ordinary enquiry, name, email and message are ordinarily required to enable a response. Phone number, subject and attachment are optional unless a specific process states otherwise.
5.5 Consequence of Non-Provision
If required information is not provided, LeStudio may be unable to establish or secure an Account, respond to an enquiry or provide the relevant feature.
6. Indirect Collection and Information Privacy Principle 3A
6.1 Indirect Collection
LeStudio may receive personal information about an individual from an organisation, administrator, user or other third party, including where an organisation invites a person to a LeStudio Service.
6.2 Lawfulness Assessment
Before relying on an indirect collection, LeStudio assesses whether the collection is permitted under applicable New Zealand privacy law.
6.3 IPP 3A Notice
Where Information Privacy Principle 3A applies and no exception is available, LeStudio will take reasonable steps, as soon as reasonably practicable, to make the affected individual aware of the matters required by law.
6.4 Matters Included in Notice
Depending on the circumstances, an IPP 3A notice may address:
- the fact that LeStudio has collected personal information;
- the purpose of collection;
- intended recipients;
- the identity and address of the collecting and holding agency;
- any applicable legal authority;
- the individual's rights of access and correction;
- any other matter required by law.
6.5 Method of Notice
LeStudio may provide the notice through an invitation, email, Account interface, product workflow or another reasonable channel appropriate to the collection.
7. Service Providers
7.1 General
LeStudio uses Providers to operate and secure the Services.
7.2 Vercel
Vercel hosts the LeStudio web application and related runtime infrastructure. LeStudio's production Function Region is configured in Singapore (`sin1`).
7.3 Cloudflare Turnstile
Cloudflare Turnstile is used for anti-bot and abuse-prevention purposes. The server integration can provide the visitor IP address, challenge token and related security information to Cloudflare's Siteverify service.
7.4 Cloudflare R2
Cloudflare R2 is used for user-file storage, LeStudio resources and enquiry attachments. The current users, lestudio-resources and lestudio-enquiries buckets are configured in Oceania (OC).
The Oceania location setting is not a representation that all related processing occurs exclusively in New Zealand.
7.5 Prisma Accelerate
Prisma Accelerate is used in LeStudio's database access path. The selected connection-pool region is Asia Pacific (Singapore).
7.6 Prisma Postgres
Prisma Postgres provides LeStudio's PostgreSQL database. The current database region is Asia Pacific (Singapore) (ap-southeast-1). The current verified service provides automated daily snapshots with the most recent 7 days available.
7.7 Resend
Resend is used for transactional email, including verification, password recovery, Account or Service messages and enquiry correspondence.
The current verified sending domain is email.lestudio.co.nz; the selected sending region is Tokyo (`ap-northeast-1`); open and click tracking are disabled. Resend states that customer data is stored in the United States and that its current standard-plan email-data retention is 30 days.
8. Overseas Processing and Disclosure
8.1 Overseas Processing
Some Providers process or store information outside New Zealand.
8.2 Current Verified Locations
The current verified configuration includes:
- Vercel production Functions in Singapore;
- Prisma Accelerate in Singapore;
- Prisma Postgres in Singapore;
- Cloudflare R2 buckets configured for Oceania;
- Resend transactional-email sending from Tokyo, with Resend stating that customer data is stored in the United States.
8.3 Scope of Location Statements
A configured region does not necessarily mean every support, security, backup or subprocessor activity is confined to that location.
8.4 Provider Agency Analysis
LeStudio assesses whether an overseas Provider processes information only on LeStudio's behalf or may use information for its own purposes.
8.5 IPP 12
Where an overseas disclosure is subject to Information Privacy Principle 12 rather than agency processing on LeStudio's behalf, LeStudio will apply and document the lawful basis or safeguard relied on.
9. Disclosure of Personal Information
9.1 Service Delivery
LeStudio may disclose personal information to a Provider to the extent reasonably necessary for the Provider to perform services for LeStudio.
9.2 Legal and Protective Disclosure
LeStudio may disclose personal information where reasonably required or permitted by Applicable Law, valid legal process, prevention or investigation of serious wrongdoing, protection of rights or security, or another lawful basis.
9.3 No Sale of Personal Information
LeStudio does not operate the current Services on the basis of selling users' personal information to data brokers or advertisers.
10. Cookies, Browser Storage, Security Technology and Analytics
10.1 General
LeStudio uses cookies, browser storage and similar technologies for authentication, session state, user preferences, security and limited analytics.
10.2 Current Cookie Notice
The current technologies and controls are described in the LeStudio Cookies & Similar Technologies Notice.
10.3 Retired Authentication Artifacts
Legacy browser-readable authentication or identity artifacts named le_client_session and le_user have been retired as authentication authority, and migration code clears stale copies.
10.4 Vercel Web Analytics
Vercel states that Web Analytics does not use analytics cookies and is designed around anonymised, aggregated analytics.
10.5 LeStudio Analytics Minimisation
LeStudio excludes sensitive authentication, Account and administration route families from analytics and strips query strings and URL fragments before analytics delivery.
11. Marketing and Electronic Messages
11.1 Separate Choice
Creating an Account, submitting an enquiry or acknowledging this Privacy Statement does not, by itself, opt a person into optional promotional marketing.
11.2 Promotional Messages
If LeStudio sends promotional electronic messages, LeStudio will maintain an appropriate lawful sending basis and will:
- keep promotional choice separate from legal acceptance;
- retain appropriate evidence of the consent or other basis relied on;
- identify LeStudio accurately as sender;
- provide usable sender/contact information;
- provide a clear, free and functional unsubscribe facility.
11.3 New Zealand Unsubscribe Requests
A valid New Zealand unsubscribe request will be actioned no later than 5 working days after the request is made.
11.4 Transactional Communications
Account verification, security alerts, password-recovery messages, requested support communications and other genuine service messages are administered separately from optional marketing.
12. Security
12.1 Safeguards
LeStudio uses technical and organisational safeguards designed to protect personal information against loss, unauthorised access, misuse, modification, disclosure and other material security risks.
12.2 Current Controls
Current safeguards include encrypted connections, password hashing, email verification, anti-bot protections, application access controls, restricted storage access, sensitive-route analytics filtering, Account/session invalidation on closure and minimised browser authentication state.
12.3 No Absolute Guarantee
No information system is completely risk-free. LeStudio therefore manages security as an ongoing programme and does not represent that a Service can be absolutely secure in all circumstances.
13. Privacy Breaches
13.1 Assessment
If LeStudio becomes aware of a suspected privacy breach, LeStudio will assess the incident in accordance with applicable privacy-breach requirements.
13.2 Notification
Where notification is required by New Zealand privacy law, LeStudio will notify the Office of the Privacy Commissioner and affected individuals in the manner required by law.
13.3 Containment and Remediation
LeStudio may take reasonable steps to contain, investigate, remediate and preserve evidence relating to a privacy or security incident.
14. Retention
14.1 General Principle
LeStudio retains personal information only for so long as an identified lawful purpose reasonably requires it.
14.2 Current Baseline
The current retention baseline includes:
- consumed or expired verification and password-recovery challenge material: purge within 24 hours;
- authentication and security events: 12 months, unless a confirmed incident or legal hold requires longer;
- confirmed security-incident records: 7 years after closure of the incident;
- ordinary enquiries or contact submissions: 24 months after closure or last meaningful contact;
- redundant enquiry copies after conversion to a customer/project record: 90 days, unless another lawful purpose applies;
- general support correspondence: 24 months after resolution, unless it forms part of another contractual, dispute, privacy, security or statutory record;
- legal-acceptance evidence: duration of the Account or contract relationship plus 7 years;
- privacy-request and complaint case records: 7 years after resolution;
- minimal pseudonymous Account-closure evidence: 7 years after Account closure;
- LeStudio-held minimal transactional-email delivery or audit metadata: 12 months;
- financial, tax and material commercial records: at least 7 years where Applicable Law or a continuing evidence purpose requires it;
- ordinary user files: only while required by the Account, project or Service, subject to applicable deletion and hold rules.
14.3 Provider Retention
Provider-controlled backups and logs may follow the Provider's own rotation periods. The current verified Prisma Postgres backup window is 7 days and Resend's current standard-plan email-data retention is 30 days.
14.4 Legal Holds
A documented legal, regulatory, security or dispute hold may temporarily suspend deletion only to the extent relevant to the hold.
15. Account Closure and Deletion
15.1 Closure Request
An eligible user may request Account closure through a supported LeStudio process.
15.2 Active-System Action
For an eligible verified closure, LeStudio disables access, revokes or removes active sessions, deletes the user's R2 storage prefix, removes Account preferences and pseudonymises or clears core identity and credential information, subject to lawful retention.
15.3 Continuing Records
LeStudio may retain limited information where a lawful purpose continues, including legal-acceptance evidence, security-incident records, dispute records, financial or statutory records and information subject to a documented legal hold.
15.4 Enquiries
Enquiry records and attachments follow their own retention and hold lifecycle and are not automatically destroyed solely because a related Account closes.
15.5 Backups and Logs
Provider backups and logs may remain temporarily until the relevant ordinary rotation period expires. Account closure therefore means closure of access and deletion or minimisation of eligible active information, not an assurance that every backup copy disappears immediately.
16. Access to Personal Information
16.1 Right to Request Access
An individual may request access to personal information that LeStudio holds about that individual, subject to applicable New Zealand privacy law.
16.2 Timeframe
LeStudio will respond as soon as reasonably practicable and normally no later than 20 working days after receiving a New Zealand access request, subject to any lawful extension.
16.3 Verification
LeStudio may require reasonable and proportionate identity verification before disclosing sensitive information. Verification is progressed promptly and does not silently reset LeStudio's recorded date of receipt.
16.4 Withholding
LeStudio may withhold information only where Applicable Law permits or requires that result and will provide the notice or reasons required by law.
17. Correction of Personal Information
17.1 Right to Request Correction
An individual may ask LeStudio to correct personal information which the individual considers inaccurate, incomplete or otherwise in need of correction.
17.2 Timeframe
LeStudio will respond as soon as reasonably practicable and normally no later than 20 working days after receiving a New Zealand correction request, subject to any lawful extension.
17.3 Statement of Correction
If LeStudio does not make the requested correction, the individual may request that a statement of the correction sought be attached where the Privacy Act 2020 provides that right.
17.4 Recipients
Where required by law, LeStudio will take the applicable steps concerning recipients of corrected information or a statement of correction.
18. Privacy Complaints
18.1 Internal Complaint
A privacy complaint may be sent to privacy@lestudio.co.nz.
18.2 Office of the Privacy Commissioner
An individual may also complain to the New Zealand Office of the Privacy Commissioner where entitled to do so.
18.3 No Mandatory Internal Precondition
LeStudio does not represent that an individual must first complete LeStudio's internal complaint process before approaching the Commissioner where the law permits direct complaint.
19. Information About Other Individuals
19.1 Authority
A person should not provide LeStudio with personal information about another individual without a proper reason and appropriate authority.
19.2 Organisation Features
Where an organisation feature permits invitations or other indirect collection, LeStudio will assess and apply the applicable indirect-collection and notification requirements.
20. Children
20.1 Account Eligibility
The current self-service LeStudio Account policy is for persons aged 18 years or older unless LeStudio expressly provides another arrangement.
20.2 Public Access
The 18+ Account rule does not mean that every visitor to a public LeStudio page is represented to be an adult.
20.3 Future Child-Directed Features
Before intentionally offering a feature designed for, or likely to involve, children, LeStudio will conduct a separate privacy, legal and security assessment.
21. Automated Processing and Material New Features
21.1 Technical Automation
LeStudio may use automated technical processes for authentication, anti-abuse controls, security monitoring, routing and ordinary Service operation.
21.2 High-Impact Processing
Before introducing automated processing intended to make or materially support a decision with significant effects on an individual, LeStudio will assess the applicable privacy, legal and security requirements before launch.
21.3 Material Privacy Change
A feature that materially changes the nature or risk of personal-information processing is subject to an appropriate privacy review before deployment.
22. New Zealand Baseline and International Use
22.1 New Zealand Baseline
This Statement is LeStudio's Public Legal V1 privacy baseline for its current New Zealand operation.
22.2 Foreign Market Entry
If LeStudio intentionally enters another market, or an additional privacy law applies because of LeStudio's actual activities, LeStudio will assess and implement any additional notice, rights, transfer, processing, consent or contractual requirements that apply.
22.3 No Omnibus Foreign Compliance Representation
Technical accessibility of a LeStudio website from another country does not constitute a representation that every foreign privacy regime has been activated.
23. Changes to this Statement
23.1 Versioning
LeStudio may amend this Statement as its Services, Providers, processing activities or legal obligations change.
23.2 Effective Date
A published amendment will identify its version and effective date.
23.3 Material Changes
Material changes will be communicated in a manner reasonably appropriate to their nature and impact.
23.4 Archive
Previous published versions will be preserved through the Legal Archive.
24. Contact
24.1 Privacy
Privacy enquiries, requests and complaints: privacy@lestudio.co.nz
24.2 Legal
Legal enquiries: legal@lestudio.co.nz
24.3 Address
LeStudio Limited 27 Broadfell Avenue Avonhead, Christchurch 8042 New Zealand