How we handle your information.

Landform Labs is operated from Aotearoa New Zealand. It is currently a private beta and nothing on this site is sold: there are no fees, no payment details are collected, and there is no advertising. For anything in this policy, write to matt@landformlab.com.

Account information. When you request access or sign up we collect your name, email address, workspace (studio or company) name, and account type. Your password is stored only as a cryptographic hash by our authentication provider; we never see or store the password itself. Staff decisions about beta access (approved, pending, declined) are stored against your account.

Enquiries. The contact form collects the name, email, firm and message you choose to send. Sign-ups and enquiries also generate a notification email to us containing the same details.

What you do in the product. The addresses and parcels you look up, and the briefs, concepts, designs, options and specifications you create, are stored so the product can work and so your work is there when you return. Site reads themselves are assembled from public and government datasets (for example LINZ and council GIS and planning data); those datasets describe land, not you, but the fact that your account looked up a particular site is part of your account activity.

Communications. If you email us, we keep the correspondence.

Technical information. Our hosting and infrastructure providers generate standard server logs (including IP address, browser type, and pages requested) that we use for security and debugging. We have not installed analytics or advertising trackers, and there are no third-party marketing cookies on the site.

Cookies. The only cookies the app sets are the ones that keep you signed in (authentication and session cookies). If you do not sign in, the site works without setting them.

We collect information directly from you, and use it to:

Run the product: store and show your projects, resolve the sites you look up, and keep your account working.

Manage the beta: decide access requests, understand who is using the product, and contact you about your account or your enquiry.

Keep the service secure: detect abuse, debug failures, and protect other users' data.

Improve the engines: understand where reads succeed or fail. Where practical we do this with aggregated or de-identified information rather than anything tied to you.

We do not sell personal information. We do not use your information for advertising. We do not send marketing email; the only emails we send are about your account, your enquiry, or the service itself.

Parts of the product use AI models to do their work, for example the co-designer that turns plain-language direction into proposed design changes. The content you give those features (your messages, and the project context needed to answer them) is processed by the AI providers named below to produce the response. We use these providers' business APIs, which under their published terms do not use API content to train their general models. We do not use your projects to train models of our own.

We run on established infrastructure providers. Each processes data only to provide its service to us:

Supabase. Database and sign-in. This is where your account, projects and enquiries live.

Vercel. Web hosting: serves the site and app, and generates server logs.

Fly.io. Runs the site engine that assembles terrain, planning and hazard reads.

Resend. Delivers transactional email (enquiry and access-request notifications).

OpenAI. Processes content given to AI features, as described above.

ElevenLabs. Processes audio for voice features, where you use them.

Some of these providers store data outside New Zealand, mainly in the United States. Where information leaves New Zealand it is held by providers under contractual and security commitments that we consider provide comparable safeguards to the Privacy Act, which is what the Act requires of us.

Beyond these processors, we disclose personal information only if the law requires it, or if you ask us to.

Data is encrypted in transit. Access inside the database is restricted row by row, so one workspace cannot read another's data, and administrative access is limited and logged. No online service can promise perfect security, but if we become aware of a breach that causes, or risks, serious harm, we will notify affected people and the Office of the Privacy Commissioner as the Act requires.

Account and project data is kept while your account is active, so your work is there when you come back. Enquiries are kept while we are in conversation and for a reasonable period afterwards. Operational backups cycle on our providers' standard schedules.

If you ask us to delete your account, we will delete your personal information and your projects, except where we need to keep something to meet a legal obligation, and we will tell you if that is the case.

Under the Privacy Act 2020 you can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Email matt@landformlab.com and we will respond within the Act's timeframes (normally 20 working days).

If you are not satisfied with how we handle a request or a concern, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

The service is built for people working in and around property and design professionally. It is not directed at children, and we do not knowingly collect information from anyone under 16.

If this policy changes, the date at the top changes with it. Material changes (for example a new category of data collected, or a new kind of processor) will be flagged to signed-in users rather than slipped in quietly.