Privacy statement

Who we are

Heapso is an online planning service for teachers in Aotearoa New Zealand. In this statement "we", "us" and "Heapso" mean the operator of Heapso. We follow the Privacy Act 2020 and its information privacy principles (IPPs). When a school buys Heapso, the school is responsible for its staff's use of the service and we act on the school's behalf as set out in our data processing agreement.

What we collect and why

We only collect what we need for these purposes (IPP 1), and we collect it from you directly wherever we can (IPP 2).

We don't sell personal information, and we don't use it for advertising.

Keeping the free plan fair

To stop people making lots of free accounts, and to keep Heapso fast for everyone, we use a few light-touch checks:

• A device cookie. When you visit, we set a cookie on your browser with a random ID (not your name or email). It lets us notice when many free accounts are made on the same browser. It isn't used for advertising or to track you on other sites, and we don't fingerprint your device. Clearing your cookies removes it.
• A quick "are you human" check on the sign-in form, from Cloudflare Turnstile. Most people never see it.
• Your IP address, to slow down large numbers of sign-ups from one network. Schools often share one IP address, so this never blocks a teacher on its own.
• A simplified copy of your email address (for example ignoring dots in Gmail addresses and anything after a "+"), so one inbox can't collect the free plan many times over.
• Your school email, if you add one for bonus credits. We send it a link to confirm it's yours. We keep a one-way, scrambled copy of each address that has unlocked the bonus, even after an account is closed, so the same address can't unlock it twice. It can't be turned back into the address.

If these checks get something wrong, nothing is lost: email us at hello@heapso.com and a person will look at it. Free accounts that look duplicated share one free allowance rather than being closed.

Student information

Heapso is for teachers only. Please don't enter information that identifies a student, names, National Student Numbers, dates of birth, contact details, addresses, health or learning-support details tied to a named student. Use initials or "Student A" instead. You don't need any of that to plan a great lesson.

Heapso checks prompts as you type and shows a gentle warning if something looks like a student's details. The check is a safeguard, not a guarantee, so the responsibility stays with the teacher and school. Our AI instructions also tell the model never to repeat students' names or identifying details.

Where your information is stored

Your account and planning data is stored in a Postgres database. [Database provider and region: to confirm before launch.] Files you upload are stored with Cloudflare. [Storage region: to confirm before launch.] Our application runs on Cloudflare's global network, which means requests may be handled at a Cloudflare location close to you on their way to the database.

AI processing

When you ask Heapso to generate something, the relevant part of your request (your prompt, chosen curriculum references, any school or personal "How Pip writes for you" instructions, and text from files you've asked it to use) is sent to one of our AI providers, OpenAI (our default) or Anthropic, through their business APIs, for processing outside New Zealand (in the United States or other countries where they operate). The result comes back to us and is stored in our database. Some features also use AI models run by Cloudflare (Workers AI): making images, and indexing text from files you upload so Pip can search it.

• We don't use your content to train AI models.
• Under their standard terms, OpenAI and Anthropic don't train their models on content sent through their business APIs, and Cloudflare doesn't train models on content sent to Workers AI.
• OpenAI keeps abuse-monitoring logs of API requests for up to 30 days by default, and Anthropic deletes API inputs and outputs within 30 days by default. Either may keep content longer where the law requires it or to enforce its usage policies.

Overseas disclosure (IPP 12)

Sending information to OpenAI, Anthropic and our hosting providers is a disclosure outside New Zealand. Under IPP 12 we only do this where the recipient is required to protect the information in a way that, overall, provides comparable safeguards to the Privacy Act. We rely on each provider's standard business terms on confidentiality, security and use of data. [Whether these terms meet IPP 12, and the privacy law where our database is hosted: to confirm before launch.]

Information from others (IPP 3A)

Sometimes we receive personal information about you from someone else, for example, when your school admin invites you or assigns you a seat, or when you sign in with Google or Microsoft. In line with IPP 3A (in force from 1 May 2026), we'll tell you that we've collected it, why, and how to contact us. [How and where we give this notice: to confirm before launch.]

Who we share with

We use a small number of service providers to run Heapso. Each only gets what it needs:

• OpenAI and Anthropic: AI generation (offshore, see above)
• Cloudflare: application hosting, networking, file storage, and AI for images and searching your uploads
• Our Postgres database host: data storage [provider and region: to confirm before launch]
• Stripe: card payments and receipts
• Our email provider: sign-in links, receipts and service emails

In a school account, your school's admins can see your name, email, seat and usage totals, and any content you choose to share with the school. They can't see your private drafts. We may also disclose information where the law requires it.

Security

We protect information with encryption in transit (HTTPS), access controls in our application and database (including row-level security) and audit logging of school admin actions. [Encryption at rest, staff access controls and two-factor authentication for our team: to confirm before launch.] No system is perfectly secure, but we take reasonable steps to protect your information (IPP 5).

How long we keep it

• Your account and planning content: while your account is open. Schools can set a shorter retention period for school content.
• After you close your account: deleted within 90 days, except backups, which roll off within a further 35 days. [To confirm before launch.]
• Billing and tax records: 7 years, as required by New Zealand tax law.
• Security and audit logs: up to 12 months [to confirm before launch]. Sign-up network records used for fair-use checks: 30 days.

Your rights: access, correction, export, deletion

Under IPPs 6 and 7 you can ask to see the personal information we hold about you and ask us to correct it. You can also:

• export your plans, units, worksheets and slides at any time from inside Heapso;
• delete individual items, or ask us to delete your whole account;
• ask for a copy of your account data in a portable format.

Email privacy@heapso.com. We'll respond within 20 working days. If you're in a school account, some requests may need to go through your school, which controls school data.

Privacy breaches

If we have a privacy breach that has caused, or is likely to cause, serious harm, we'll notify the Office of the Privacy Commissioner and affected people as soon as practicable, as the Privacy Act requires. For school accounts we'll tell the school promptly so it can meet its own obligations.

Contact and complaints

Our privacy officer can be reached at privacy@heapso.com. If you're not happy with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

We'll post any changes to this statement on this page and tell you about significant changes by email.