Back to ILLSET

Legal

Privacy Policy

This policy explains what personal information ILLSET collects through this pre-launch website, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

Last updated:
18 August 2026
Provider:
ILLSET Limited

1. Who we are

ILLSET Limited (ILLSET, we, us) is the agency responsible for the personal information described in this policy. We are a New Zealand registered company (NZBN: 9429052681028, company number 9326547), with a registered office at Auckland, New Zealand. For privacy questions or requests, contact our privacy officer at privacy@illset.com.

This policy covers illset.com in its current pre-launch form: a landing page with a pre-registration form, an open community wall (the Green Room) and a referral scheme. It does not describe the full ILLSET platform, which will have its own privacy policy at launch. Existing platform accounts remain stored and are not deleted by the site being paused.

2. The law we work to

We comply with the New Zealand Privacy Act 2020 and its Information Privacy Principles. Where you are in the European Economic Area or the United Kingdom, we also apply the GDPR / UK GDPR, and this policy sets out our lawful bases. Where you are in Australia we apply the Australian Privacy Principles. Where you are in California, see section 11.

3. What we collect and why

3.1 Pre-registration

When you use the pre-register form we collect:

  • Email address (required) — to add you to the launch list and to email you about early access.
  • Name or act name (optional) — to personalise our communications.
  • Role (optional: artist, venue, promoter or fan) — so we can invite the right people to the right part of the launch.
  • Referral code — the code assigned to you, and the code of whoever referred you if you arrived via a share link, so we can count referrals.
  • Signup source (landing page or community wall) and the date and time of signup.

Lawful basis (GDPR): consent for marketing email, and legitimate interests in operating a waitlist for a product we are preparing to launch. You can withdraw consent at any time.

3.2 The Green Room community wall

The Green Room is a public, no-signup message board. Anything you submit — display name, role, location, message text and any social or website link — is published immediately and can be read, copied, indexed by search engines and screenshotted by anyone. We may also reproduce Green Room posts in ILLSET marketing (for example, screenshots shared on social media). Please do not post information you would not want to be public, and do not post other people's personal information.

We also store a moderation state for each post, and — where a post is reported — the reason given and a random reporter identifier generated in your browser. We do not collect your name or email when you report a post.

Lawful basis: consent (you choose to publish), and legitimate interests in moderating the board and keeping it free of spam and abuse.

3.3 Answer notifications

If you ask to be notified when someone answers your question, we collect your email address and optional name and link them to that post. That email is also added to the launch list. Lawful basis: consent.

3.4 Analytics

We record product analytics events so we can understand how the page performs: page views, form starts, email submissions, successful signups, referral shares, call-to-action clicks and similar funnel steps. Each event carries a random session identifier generated in your browser, the event name, a timestamp and non-identifying properties (such as which button was used). We do not use third-party advertising or cross-site tracking pixels on this site. Lawful basis: legitimate interests in measuring and improving our own website.

3.5 Technical data

Our hosting and database providers process standard technical information (such as IP address, browser user agent and request logs) as part of delivering the site securely. We use this for security, abuse prevention and diagnostics only.

3.6 Anti-abuse controls

To stop automated signups we use a hidden form field, a minimum form-completion time, a block on disposable email domains and a per-browser submission cooldown stored in your browser. These controls do not profile you and have no legal or similarly significant effect on you.

4. What we do not do

  • We do not sell personal information, and we never have.
  • We do not share your email address with other users.
  • We do not run behavioural advertising or share data with ad networks.
  • We do not make automated decisions that produce legal effects about you.
  • We do not knowingly collect information from children (see section 9).

5. Who we share information with

We share personal information only with service providers who process it on our instructions, under contract, and only as needed to run the site:

  • Hosting and application delivery — serving the website.
  • Database, authentication and storage provider — storing the pre-registration list, community posts and analytics events.
  • Email delivery provider — sending launch and notification emails (once enabled).

We may also disclose information where required by law, to enforce our Terms of Use, to protect the rights or safety of any person, or in connection with a sale or restructure of our business (in which case the acquirer must honour this policy).

6. Overseas storage and transfers

Our providers may store and process data outside New Zealand, including in Australia, the United States and the European Union. Before disclosing personal information overseas we take reasonable steps to ensure comparable safeguards to the Privacy Act 2020 (IPP 12), which for GDPR-covered transfers means Standard Contractual Clauses or an adequacy decision. You can ask us for details of the safeguards that apply.

7. How long we keep it

  • Pre-registration records — until launch plus 24 months, or until you ask us to delete them or unsubscribe, whichever is first.
  • Community posts — for as long as the Green Room is published; removed posts are retained in hidden form for up to 12 months for moderation and abuse records, then deleted.
  • Analytics events — 24 months, then deleted or aggregated.
  • Reports and moderation logs — 12 months.

8. Security

Data is stored in a managed database with row-level access controls: the pre-registration list, notification list and analytics events are write-only from the public website and cannot be read by site visitors. Administrative tools are protected by a passcode and are excluded from search engines. Traffic is encrypted in transit (TLS). No system is perfectly secure; if a privacy breach occurs that is likely to cause serious harm we will notify the Office of the Privacy Commissioner and affected people as required by the Privacy Act 2020, and within 72 hours to the relevant supervisory authority where the GDPR applies. Report a suspected vulnerability to legal@illset.com.

9. Children

This site is intended for people aged 16 and over. We do not knowingly collect personal information from under-16s. If you believe a child has given us information, email privacy@illset.com and we will delete it.

10. Your rights

You can ask us to:

  • confirm whether we hold information about you, and give you a copy of it;
  • correct information that is wrong or out of date;
  • delete your pre-registration, notification subscription or a community post you made;
  • stop sending you marketing email (every email also has a one-click unsubscribe);
  • where the GDPR applies: restrict or object to processing, and receive your data in a portable format.

Email privacy@illset.com from the address you signed up with, or tell us enough to identify your record. We respond within 20 working days (Privacy Act 2020) and within one month where the GDPR applies. There is no charge for a reasonable request.

If you are unhappy with our response you can complain to the Office of the Privacy Commissioner (New Zealand), the Office of the Australian Information Commissioner, or your local EU/UK supervisory authority.

11. California residents

We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process sensitive personal information for inferring characteristics. California residents may request access, deletion and correction using the contact details above; we will not discriminate against you for exercising those rights.

12. Marketing email

Pre-registering is a request to hear from us about the ILLSET launch. Every message will identify us clearly, will be sent from an ILLSET address and will contain a working unsubscribe link, as required by the Unsolicited Electronic Messages Act 2007 (NZ) and the Spam Act 2003 (Cth). Unsubscribing removes you from the launch list; it does not delete community posts you have made.

13. Changes

We may update this policy as the product develops. The date at the top shows when it last changed. If a change materially reduces your rights we will tell pre-registered users by email before it takes effect.

14. Contact

Privacy officer, ILLSET Limited — privacy@illset.com. General enquiries: hello@illset.com. Postal: Auckland, New Zealand.