Good Oil AI — Privacy Policy
Law: New Zealand Privacy Act 2020 and the Information Privacy Principles (IPPs). This is not a GDPR, CCPA, or other US/EU default template.
Adapted from: The Good Oil (goodoil.news) Privacy Policy, narrowed/extended for app.goodoil.ai.
Effective: 2026-09-30
Agency: The Good Oil, New Zealand. Privacy contact: privacy@goodoil.news
1. Who we are
The Good Oil (New Zealand) is the agency that holds personal information for Good Oil AI (app.goodoil.ai / goodoil.ai) and related political-intelligence APIs. Contact: privacy@goodoil.news.
For newsroom membership on goodoil.news, also see: https://goodoil.news/privacy-policy/
2. Privacy Act 2020 and the IPPs
We handle personal information under the Privacy Act 2020. The Information Privacy Principles set the rules for purpose and collection (IPP 1–4), storage and security (IPP 5), access and correction (IPP 6–7), accuracy (IPP 8), retention (IPP 9), use (IPP 10), disclosure (IPP 11), and disclosure outside New Zealand (IPP 12). Unique identifiers, if we assign them, follow IPP 13.
Your rights are the Privacy Act 2020 rights (access, correction, and a complaint to the Privacy Commissioner). We do not treat European or United States privacy statutes as the default rulebook.
3. What we collect and why (IPP 1–4)
We collect personal information only for a lawful purpose connected with our functions (running the Service, membership, billing status, security, and support), and only as much as we need. We collect it from you where practicable — for example when you sign in or write to us.
Indirect collection (IPP 3A). We mainly collect from you. We also receive membership and billing signals from Ghost (goodoil.news VIP / silver) and payment providers (e.g. Stripe) so we can match your email to the right access on Good Oil AI. That is for entitlement and security only. Where IPP 3A requires notice of collection from someone other than you, we will give that notice.
We may collect:
- Account & membership: email address; sign-in / OTP verification; membership tier or entitlement (e.g. Free, Basic, Insight, Ghost VIP / silver); staff flags.
- Billing: handled by payment providers (e.g. Stripe, Ghost). We receive payment status, customer/subscription identifiers, and limited receipt metadata — not full card numbers.
- Usage: pages and tools used, search queries within the app, Ask questions/answers and ratings when you leave improvement logging on (see §4), device/browser metadata, IP address, and logs for security and reliability.
- Support: messages you send us (email/Slack) and related records.
- Optional uploads you choose to send for a paid deep-dive / dossier fulfilment.
4. How we use information (IPP 10)
- Provide and secure the Service (auth, entitlements, desk access).
- Process subscriptions and one-off purchases (e.g. Insight, dossier checkout).
- Improve product quality, debug outages, and prevent abuse.
- Send service-necessary messages (OTP, receipts, security or account notices).
- Send promotional membership messages only as allowed under the Unsolicited Electronic Messages Act 2007 (see below).
- Comply with New Zealand law and respond to lawful requests.
With “Use my questions and ratings to improve answers” left on, we may use your Ask questions, answers, and ratings to improve the Assistant (including model training and evaluation for the Service). You can turn that off under Ask at any time.
We keep personal information only as long as needed for these purposes or as required by law (IPP 9).
5. Cookies and similar technology (NZ notice)
This is a clear notice, not an EU-style mandatory opt-in wall. You can use the Service without clicking “Accept all”. We do not put a consent overlay in front of the pages before you can read them.
We use cookies and similar technology so sign-in sessions work and to keep the Service secure. On app.goodoil.ai we use Google Analytics 4 to measure aggregate usage and performance of the Service, such as which pages are used. You can block or delete cookies in your browser; blocking some cookies may break sign-in. Details and contact: this Privacy Policy — /privacy.
6. Electronic messages (Unsolicited Electronic Messages Act 2007)
Commercial electronic messages (promotional or marketing mail about membership or the Service) are sent only where the Unsolicited Electronic Messages Act 2007 allows — typically with your consent, a clear New Zealand sender identity, and a working unsubscribe. You can stop marketing mail any time; we will honour that unsubscribe.
Transactional and account messages (one-time sign-in codes, payment receipts, security alerts, and notices needed to run the Service) are not marketing. We do not operate open, unauthenticated forms that relay or blast email to third parties.
7. Who we share information with (IPP 11)
We do not trade your personal information as a commodity. We disclose it only where IPP 11 allows — including to service providers who run the Service for us, to professional advisers, when the law requires it, or at your direction (e.g. a fulfilled dossier sent to an address you name).
Service providers may include:
- Hosting / compute: Fly.io (and related infrastructure) for APIs and workers.
- Payments / membership: Stripe; Ghost (goodoil.news) for VIP membership.
- Email / transactional mail for OTP and receipts.
- Analytics: Google Analytics 4 on app.goodoil.ai, for aggregate usage and performance.
- CDN / DNS / security: Cloudflare (and similar).
Those parties handle information so we can deliver the Service. They have their own terms and privacy policies.
8. Disclosure outside New Zealand (IPP 12)
Some service providers store or handle information outside New Zealand. Before we disclose personal information overseas we take the steps IPP 12 requires — in practice, using providers we believe will not breach the IPPs, or as otherwise permitted by that principle. This is an NZ Privacy Act overseas-disclosure rule, not an EU “international transfer / adequacy / SCCs” clause.
9. Security (IPP 5)
We use reasonable safeguards (access controls, HTTPS, entitlement checks). No method is perfectly secure.
10. Your rights — access and correction (IPP 6–7)
You may request access to personal information we hold about you, and you may request correction. Email privacy@goodoil.news. We will respond as the Privacy Act 2020 requires.
You may complain to us first, and you may also complain to the Office of the Privacy Commissioner (privacy.org.nz).
11. Children
The Service is aimed at adults. We do not knowingly collect personal information from children. This is a product rule, not an imported overseas age-of-consent number.
12. Changes
We may update this policy. The current version is posted at /privacy.
13. Contact
Privacy questions and access/correction requests: privacy@goodoil.news — The Good Oil, New Zealand.