Privacy statement
ConsentMuster stores the information needed to organise a New Zealand building-consent and CCC record. This statement explains how that information is handled.
Last updated 5 August 2026Information we handle
We may hold your account name and email, project addresses and descriptions, invited team member emails, uploaded documents, analysis results, RFI text, evidence status, billing references, an activity history and contact details submitted through the website.
Building files can contain personal information. Only upload information that is relevant to the project and that you are authorised to share.
Information received from another person
A project owner or administrator may enter a team member's work email and access role. Before that access is recorded, ConsentMuster requires the service's secure invitation email to send the person the project context, sign-in route and a link to this Privacy Statement.
Project documents may also contain information about owners, professionals, contractors or occupants that was supplied by another project participant. Uploaders must have authority to share it and should provide any privacy notice required for their collection and use.
How information is used
Information is used to provide the workspace, extract searchable document content, check completeness and consistency, create response and close-out records, control access, prevent misuse and support billing.
The current hosted service performs its searchable-text and rules review within the application. If secure visual document comparison is activated, the workspace will identify that review depth and project files may be sent temporarily to a contracted document-processing provider. Temporary provider file objects are requested for deletion after the review, subject to that provider's security, abuse-monitoring and legal retention requirements.
Storage, access and retention
Project records and files are stored in private application storage. Access is restricted to the project owner and people invited to that project. Activity events are retained to make important changes accountable.
Signed-in users can export their structured account record, download project files through the project and CCC exports, permanently delete owned projects, and permanently delete their account. Information is otherwise kept only while needed for the service, legitimate business and security records, legal obligations, or a property record the user has chosen to retain.
Access, correction and privacy requests
You may request access to personal information held about you and ask for incorrect, incomplete or misleading information to be corrected. New Zealand access and correction requests are normally answered within 20 working days, subject to the Privacy Act.
Deleting an account removes the active account and owned project records after connected billing is closed. Limited records may remain where retention is legally required, necessary to resolve a dispute or security incident, or present temporarily in provider backups under controlled retention processes.
Service providers and overseas processing
The service uses hosting and may use payment, transactional-email and document-processing providers. Those providers process the information needed for their role and may operate outside New Zealand. Payment card details are handled by the payment provider rather than stored by ConsentMuster.
ConsentMuster is intended to be operated consistently with the New Zealand Privacy Act 2020. If a privacy breach is reasonably believed to have caused or be likely to cause serious harm, the affected people and the Office of the Privacy Commissioner will be notified as required. This statement does not limit rights that cannot lawfully be limited.