Privacy statement

Are You Ready? is operated by Are You Ready Limited, a New Zealand company (“AYR”, “we”, “us” or “our”). We can be contacted about privacy matters at privacy@areyouready.co.nz.

Are You Ready? collects and uses personal information to provide lending-readiness assessments, saved results and any optional lending-professional referral you choose to request. We aim to collect only information reasonably necessary for those purposes and to handle it in accordance with the New Zealand Privacy Act 2020.

Who this service is for

Are You Ready? is intended for people aged 18 or over who are considering consumer borrowing in New Zealand. It is not intended for children.

What we collect

Depending on how you use Are You Ready?, we may collect information you enter about your borrowing goal, proposed amount and timeframe, income, employment, household, expenses, debts, property position, repayment or credit history, spending conduct, KiwiSaver/student-loan settings and other assessment inputs. If you choose to have a saved result emailed to you, we collect your first name and email address for that delivery. If you request contact from a lending professional, we also collect your name, email address, phone number, town/city, region, professional-location preference, preferred contact time and consent choices.

Why we collect it

We use assessment information to calculate and display your Readiness Score and related educational outputs. If you choose to save a result, we store a limited result summary so the private link can be reopened and use the first name and email address you provide to deliver that link. If you request contact from a lending professional, we use the information to create a referral report, match your enquiry to a participating professional, take account of any local-professional preference you select, and administer the introduction.

Where information comes from

Assessment and referral information is normally collected directly from you. If we collect personal information about you from another source in the future, we will handle any notification obligations that apply under New Zealand privacy law.

Who may receive your information

Your information is processed by Are You Ready? and service providers we use to operate the platform. We currently use:

• Supabase for database, storage and related backend services.
• Vercel to host and deliver the Are You Ready? website and application.
• Resend to send saved-result links, transactional referral emails and professional-access emails.

These providers process information only as required to provide their services to Are You Ready?, subject to their own security and contractual arrangements.

Overseas and cloud processing

Some service providers or their infrastructure may process or store information outside New Zealand. Using an overseas cloud or processing provider does not remove Are You Ready?'s responsibility for the personal information we hold. Where New Zealand privacy law requires additional safeguards for an overseas disclosure, we will take appropriate steps to ensure the disclosure is permitted and adequately protected.

Assessment information stored in your browser

Your current assessment and result may be stored in your browser so you can continue or revisit the result on that device. Clearing browser storage or using another device may remove access to that locally stored information.

Saved results

If you choose “Save this result for later”, we store a limited summary of the result, including your score, borrowing type, the key borrowing-request details needed to identify the scenario you assessed, monthly income/expense summary, proposed assessed repayment and surplus position. A private tokenised link is generated. We ask for your first name and email address so we can send that private link to you. Those contact details are used for delivery of the saved result and are not treated as a request for professional contact or marketing consent. Anyone who has the private link may be able to view the saved summary, so you should keep the link private.

Optional lending-professional referrals

We do not automatically send your assessment to a lending professional. A referral occurs only if you actively choose to request professional contact and provide the required consent.

If you request professional contact, we store your contact details, referral consent, assessment snapshot and AYR assessment outputs. We then make the referral report available to one selected participating lending professional. If you ask for someone local, we use your region to help prioritise the match; local availability is not guaranteed and, where necessary, another participating professional may be selected. Before that professional accepts the referral, your name, email address, phone number, town/city and preferred-contact details remain hidden. The professional may review the customer-declared assessment information, AYR-calculated outputs and your region so they can decide whether to accept the referral. If they accept the referral and the applicable referral-fee terms, your identity and contact details are then released so they can contact you. If they do not accept, your identity and contact details are not released to them. The referral report distinguishes customer-declared information from AYR-calculated information. The receiving professional is responsible for their own verification, lending, suitability and advice processes.

Are You Ready? may receive a referral or lead fee from the professional or their business for an introduction. The existence or amount of that fee does not affect your Readiness Score, result band, assessment calculations or whether your assessment is classified as strong, getting there or not quite ready.

Marketing

Referral consent and marketing consent are separate. Marketing consent is optional. You can withdraw marketing consent at any time using the unsubscribe method provided in a marketing message or by contacting Are You Ready?.

Cookies, local storage and analytics

Are You Ready? uses essential browser storage, cookies or similar technologies to keep the service working, remember assessment progress and protect secure sessions. We also use first-party, privacy-minimised analytics to understand basic site usage and the assessment funnel. Analytics records may include an anonymous browser session identifier, the page path, a limited event name such as page view, assessment started, assessment completed or referral submitted, and a timestamp. We do not send assessment answers, income, debts, borrowing amounts, Readiness Scores, conduct answers, names, email addresses, phone numbers or other contact details into this analytics event stream. The analytics session identifier is stored in your browser and is not intended to identify you personally. We will not use hidden marketing consent as a condition of completing an assessment.

How long we keep information

Are You Ready? uses documented retention periods so personal information is not kept indefinitely. Unless a longer period is reasonably required for a lawful purpose, legal obligation, complaint, access/correction request or dispute:

• Unsaved assessment data: assessment information held only in your browser remains there until you clear it, replace it with another assessment, or browser storage is otherwise removed.
• Saved-result records: up to 90 days from creation, after which the server-side saved result should be deleted or de-identified.
• Referral contact, consent and audit records: up to 24 months from referral where reasonably required to administer the introduction, deal with follow-up, quality issues, complaints, disputes or referral-fee reconciliation.
• Detailed referral assessment and result snapshots: normally retained for up to 180 days from referral, then deleted from the referral record unless they are reasonably required for an active referral, access/correction request, complaint, dispute, security investigation or other lawful purpose. The minimum contact, consent, referral, outcome and fee/audit record may be retained for up to 24 months where reasonably required.
• Marketing records: while you remain subscribed, plus a minimal suppression record after opt-out where reasonably necessary to ensure we honour the opt-out.
• Privacy-minimised analytics events: normally up to 90 days, after which they should be deleted.
• Security and operational logs: normally up to 90 days unless needed to investigate security, fraud, misuse or a technical incident.

When information is no longer required for a lawful purpose, we will delete or de-identify it securely. We will not destroy information that must be preserved because of a current access/correction request, complaint, dispute or other legal requirement.

Security

We use protected server-side routes for privileged database operations, do not expose privileged database credentials in the browser, restrict access to referral information and use secure token-based access for participating professionals. We also use rate limiting and other operational safeguards designed to reduce unauthorised or abusive access. No online service can guarantee absolute security, but we will use safeguards that are reasonable for the sensitivity of the information we hold.

Privacy breaches

If a privacy breach occurs, Are You Ready? will assess the likely harm and follow the notification requirements that apply under the Privacy Act 2020, including notifying affected individuals and the Office of the Privacy Commissioner where required.

Privacy contact and complaints

For privacy questions, access or correction requests, or a privacy complaint, contact privacy@areyouready.co.nz. We will consider and respond to requests in accordance with the Privacy Act 2020. You may also raise a privacy complaint with the Office of the Privacy Commissioner.

Access and correction

You may ask Are You Ready? for access to personal information we hold about you and may ask for information to be corrected if you believe it is wrong. We may need to verify your identity before responding. If we do not make a requested correction, you may ask us to attach a statement of correction to the information where required by law.

Changes to this Privacy Statement

We may update this Privacy Statement when our services, technology, providers, legal obligations or data-handling practices change. The latest version will be published on this page with an updated date. If a change materially affects how we use information already collected, we will take additional steps where required by law.

Last updated: August 2026.