Privacy
Loots is run by Intelligence Limited, a New Zealand company. This page says what we collect, who handles it, how long we keep it and how to have it removed.
What we collect
Using the calculator on its own collects nothing about you. Your answers stay in your browser (the first home buyer checklist ticks too). We collect personal information only at these points:
- The adviser form: your name, email, mobile number and the loan figures you entered.
- The first home buyer adviser form: your name, email, mobile number and your answers (where and what price, how many are buying, savings, KiwiSaver, any family gift, each buyer’s income and your debts), so the adviser can talk with you about the bank saying yes in advance.
- The adviser form for people who already own a home (moving, a rental or a holiday home): your name, email, mobile number and your answers on that page, so the adviser can talk with you about your plans. For a move that includes your sale and next prices, your mortgage, each buyer’s income and your debts.
- “Tell me when there’s a full guide”: your email and which guide, so we can email you once to confirm it’s you and once more when the guide is ready.
- The reminder form: your email and the loan figures, so we can email you before your term ends.
- “Email me this”: your email, your bank, the term, the rate your bank offered (if you entered one) and when your fixed rate ends, so we can email you the message and, if you ask, check in once a week later.
- A shared result card: the headline figures only, with no name or contact details.
- Request logs: your IP address, redacted, for abuse prevention.
When you open one of the pages for people who already own a home, we add one to a count for that page and day. The count is anonymous: it holds no IP address, cookie or answer. To stop scripts inflating it, your IP address is held for about a minute by our rate limiter (Upstash) and never written to our database.
The consent text you agree to is versioned, and the version you saw is stored with your record.
Who processes it
These services handle data on our behalf. All of them store it outside New Zealand.
| Service | Purpose | Region |
|---|---|---|
| Vercel | Hosting and request logs | United States |
| Neon | Database | AWS Sydney, Australia |
| Upstash | Rate limiting and short-lived cache | AWS Sydney, Australia |
| Resend | Email delivery | United States |
| Admin sign-in; Gemini reads banks' public rate pages and never receives your details | United States | |
| Cloudflare | Turnstile bot check on forms | Global |
| Sentry | Error reports with personal details scrubbed | United States |
How long we keep it
A daily job applies these limits.
| Record | Kept until |
|---|---|
| Lead, reminders only | 24 months after the last reminder is sent |
| Lead, lost | 24 months after it is marked lost |
| Lead, new and never contacted | 12 months after it is created |
| Lead, contacted or settled | While a current loan term has a future end date, then 24 months |
| First home buyer lead | 12 months after it is created |
| Moving or own-home lead | 12 months after it is created |
| Guide waitlist email | 12 months after you join, or once we email you that the guide is ready |
| “Email me this” request | 180 days after it is made, or until you unsubscribe |
| Result card | 90 days |
| Email outbox message | 90 days after it is sent |
| Rate scrape run | 12 months |
When a lead expires we anonymise it rather than delete it: name, email, mobile number and the unsubscribe link are removed, pending reminders and unsent emails are cancelled, and any unpaid referral reward for that lead is voided. Loan figures and settlement amounts are kept without anything that identifies you, for reporting. Result cards, sent emails and scrape records are deleted outright when they expire.
For a first home buyer lead we also remove the incomes, debts and KiwiSaver amounts, from the lead and from the email sent to the adviser. The region, price, number of buyers, savings and gift are kept without anything that identifies you, for reporting.
For a moving or own-home lead we remove your name, email, mobile number and all your answers, from the lead and from the email sent to the adviser. We keep only which page you asked from, the referral code you came with (if any), the date, and the consent version you agreed to and when, as a record of your consent.
For the guide waitlist, we remove your email address once we have told you the guide is ready, or after 12 months. If you use the unsubscribe page we stop emailing you at once, and remove the address on that same 12-month date. We keep which guide, the dates, and the consent version you agreed to and when, without your address.
For “Email me this”, we remove your email address after 180 days, or straight away when you use the unsubscribe link in that email. We keep the bank, term, rates, dates and any answer you gave to the check-in without anything that identifies you, to show what rates banks really give.
Your requests
Email privacy@www.loots.co.nz from the address on your record to see what we hold, correct it, or have it anonymised as described above. Every reminder email also carries a one-click unsubscribe link. Under the Privacy Act 2020 you can complain to the Office of the Privacy Commissioner if you are not satisfied with our response.
Who we are
Intelligence Limited, 85 Pooles Road, Greerton, Tauranga 3112, New Zealand. Loots gives general information, not financial advice; our adviser partner is a licensed financial advice provider and is named on the result panel.