How Dendra handles information.

Who we are

Dendra is operated by ShiftCurve Limited, a New Zealand company based in Auckland (NZBN 9429053587725, GST 148-460-841). In this policy, "we" and "us" mean ShiftCurve Limited.

Our privacy officer is Pranil Bilimoria. Contact: pranil@dendra.co.nz.

This policy covers the dendra.co.nz website and the Dendra service used by planning firms.

What we collect

From planners and firms using Dendra

• Account details: names, email addresses and roles of the planners in your firm, and your firm's name.
• Material you send us: emails, attachments, briefs, plans, client notes, council correspondence and example reports. This often includes personal information about your clients and other people connected to a site.
• The drafts Dendra prepares, and the edits, replies and feedback planners make on them.
• Usage records, such as how many AEEs have been counted each month, for billing.
• Billing details. Payments are taken by Stripe. We do not see or store your full card or bank details.

From website visitors

• What you enter in the contact form (such as your name, email, firm, role, the councils you work with and your message). It is sent to us by email, and a short alert (the email's subject and first lines, usually showing your name, firm and email address) is posted to our team's private chat on Telegram so we can reply quickly.
• If you email hello@dendra.co.nz and are not a planner at a firm using Dendra, we keep a short record of it in Dendra's database in Sydney and post an alert to our team's private chat on Telegram, usually with your name, firm, email address and a one-line summary of what you wrote. The alert leaves out the summary if we already know you, and names nobody if the email is about a firm's job.
• If you email submit@dendra.co.nz and are not a planner at a firm using Dendra, we record your email address in the same way and post an alert that says only that someone new wrote. The alert does not include your name, email address or anything you wrote.
• With the form, where you came from: the website that referred you, the page you landed on, and any campaign tags or ad click identifier in the link you followed (for example utm_source or gclid). These are kept in your browser only for the visit and are sent to us only if you submit the form.
• Anonymous visit statistics from Vercel Web Analytics, which does not use cookies. Our website host also keeps standard server logs.
• If you accept cookies, information collected by Google Analytics and Google Ads, as explained under Cookies and advertising.

Your firm's material belongs to your firm

Your firm owns the material it sends to Dendra and the drafts Dendra prepares for it. Your firm decides what to send and stays responsible to its own clients for that information. We hold and process it only to provide Dendra to your firm.

Each firm's material is kept separate from every other firm's. One firm cannot see another firm's material, drafts or edits.

How we use information

• To prepare and revise drafts for your firm.
• To run, support and secure the service.
• To bill you and keep the records the law requires.
• To improve Dendra through de-identified lessons, as explained below.
• To reply to enquiries sent through the website or by email, and to know which search, ad or campaign led to them.
• If you accept cookies, to measure visits to this website and how our ads perform.

We do not sell information. We do not use your firm's material, or the details you send us, for advertising.

Cookies and advertising

This website uses Google Analytics and Google Ads only if you accept cookies in the banner. Until you choose, and if you decline, no Google script loads and no Google cookie is set. The site works the same either way.

If you accept:

• Google Analytics sets cookies (named _ga and _ga_ followed by an ID, kept for up to two years) to count visits and see which pages are used, so we can improve the site.
• Google Ads sets cookies (such as _gcl_au and, if you arrived from one of our ads, _gcl_aw, kept for about 90 days) to measure whether our ads lead to visits and enquiries. Google may also use this to show our ads to people who have visited the site.
• Google processes this information, including your IP address and device details, in the United States and other countries, under its own terms and privacy policy.

Your choice is stored in your browser, not in a cookie. You can change it at any time with the "Cookie settings" link at the bottom of every page; if you withdraw, the Google cookies set on this site are removed and Google's scripts stop. You can also clear cookies in your browser settings.

No training of AI models

We do not use your firm's material to train AI models. The Dendra service uses Anthropic's AI models through Anthropic's commercial API, and Anthropic does not by default train its models on data sent through that API.

Our team also uses AI assistants on subscription plans, Anthropic's Claude and OpenAI's ChatGPT (including Codex), to build, run and support Dendra and to handle our email and alerts. That work may involve information we hold. It is covered by the providers' consumer terms, not their commercial API terms. The settings that allow Anthropic and OpenAI to use our Claude and ChatGPT conversations to train their models are switched off for our accounts.

How Dendra learns

Dendra learns from the edits your planners make, so its drafts fit your firm's practice. That learning stays within your firm.

Under our terms of service for firms, Dendra may also turn edits into general lessons about a rule, zone or topic, and use those lessons to improve drafts for other firms. These lessons are de-identified:

• A lesson must be about a rule, zone or topic, never about a particular site or job.
• Before a lesson is shared, it is automatically checked for names, addresses, legal descriptions, consent numbers and job references, and then reviewed by a person.
• Shared lessons never say which firm contributed.
• Lessons are looked up when a draft is prepared. They are never used to train an AI model.

A lead planner can opt your firm out of contributing lessons at any time by emailing us. It keeps its own firm learning, but stops receiving shared lessons from other firms.

To decide which lessons to trust, Dendra keeps a record of how planners' edits hold up, for example whether the council accepted the approach. This is personal information about the planner. Any planner can ask to see their record and ask for it to be corrected.

Who processes information for us

We use these service providers. They handle information on our behalf, under their own contractual data protection terms, and we remain responsible for it.

• Anthropic provides the AI model that reads your material and writes drafts. Processed in the United States.
• Google Workspace (Gmail, Drive and Docs) receives the emails you send Dendra and stores the drafts as Google Docs. Google stores data in its data centres, which may be outside New Zealand.
• Supabase hosts Dendra's database in Sydney, Australia.
• Google Cloud runs the Dendra service, in Sydney, Australia.
• Stripe processes payments. Stripe operates internationally, including in the United States.
• Vercel hosts this website and provides its visit statistics. Resend delivers contact form messages to us by email, sending from Japan (Tokyo).
• Telegram carries our team's private alerts about website enquiries and emails to hello@ and submit@, as described above. Telegram stores messages outside New Zealand.
• To look up a site, Dendra sends its address or location to LINZ, the OpenStreetMap geocoder (Nominatim) and the council's public map services. Nothing else from your material is sent to them.
• Google Analytics and Google Ads measure website visits and ad performance, only if you accept cookies on this website.

Information sent overseas

Because of the providers above, information you send Dendra is stored and processed outside New Zealand, in Australia, the United States, Japan and other countries where our providers operate. The Privacy Act 2020 (information privacy principle 12) sets rules for this. We choose providers that are bound by contract to protect information, and we tell you here so you can make an informed decision about what to send.

How long we keep it

• We keep your firm's material while your firm uses Dendra.
• When your firm leaves, or asks us to, we export its material to it on request and then delete it from our systems within 30 days.
• De-identified lessons your firm contributed stay, because they contain nothing that identifies your firm or anyone else. Your firm's contribution is removed from the evidence behind them.
• Billing records are kept for 7 years, as New Zealand tax law requires.
• Website enquiries, and the records and alerts about emails to hello@ and submit@, are kept while we need them to reply and follow up. We have not yet set a fixed period for deleting them; you can ask us to delete yours at any time.

Keeping it safe

Information is encrypted in transit and stored with providers that encrypt it at rest. Access is limited to the people who need it to run Dendra. If a privacy breach is likely to cause serious harm, we will tell the affected firms and people, and the Privacy Commissioner, as the Privacy Act requires.

Your rights

You can ask for a copy of the personal information we hold about you, and ask us to correct it. Email pranil@dendra.co.nz. We will respond within 20 working days.

If you are a client of a planning firm that uses Dendra, please contact that firm first, because it controls your information. We will help it respond.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

30 September 2026: added the records and team alerts for emails to hello@ and submit@ and for contact form enquiries, Telegram as a provider, our team's use of AI assistants on subscription plans (Claude, and ChatGPT including Codex), and Japan, where Resend handles our contact form email.

26 September 2026: added Google Analytics and Google Ads cookies (only with your consent), the campaign details sent with the contact form, and Google Cloud as the host of the Dendra service.

We will update this page if how we handle information changes, and email firms using Dendra about any significant change before it takes effect.