Privacy policy
Last updated 2 November 2026.
We collect as little as we can. You can study and sit assessments without telling us who you are. This policy is written for the New Zealand Privacy Act 2020.
Who is responsible
Steadyhand Training is a trading name used by Lautaro Manuel Gutierrez (49208135058), a business (trader) based in Australia ("we", "us"). Postal address: 2095. You can reach us at support@steadyhand.co.nz.
Our privacy officer can be reached at the same address.
What we collect, and why
| What | Why | How long |
|---|---|---|
| A random session cookie, plus your module progress and assessment results | To save your place and record your result, with no account | 180 days after your last visit, or 365 days after your last pass if that is later, unless you buy a certificate |
| Your name and email, when you start buying a certificate | To print the certificate and send it to you | For as long as the certificate needs to stay verifiable, and to keep business records as the law requires. If you do not finish paying, we delete them after 30 days |
| Payment records from Stripe (amount, date, status). Never your card number | To confirm payment, handle refunds and keep financial records | As required for tax and financial records |
| A scrambled form of your IP address, for a short time | To limit abuse of the assessment and verification pages | A few days |
| Page and step counts linked to a scrambled reference, and where you first came from | To see which courses help people and where they get stuck. These hold no name or email | 400 days |
Do you have to give us this?
No. Studying and sitting assessments needs no personal details at all. If you want a certificate we need your name to print on it and your email to send it, so without them we cannot issue one. No law requires you to give us this information.
What others can see
Anyone holding a certificate ID can see the name on that certificate, the course, its type, the issue date and whether it is valid. That is the point of verification, and it is why the ID is hard to guess. They cannot see your email, your score or anything about your payment. A withdrawn certificate does not show a name.
Who processes your information
We share only what each of these companies needs. Some of them store information outside New Zealand, including in the United States, so it may not have the same protection as under New Zealand law. We chose them for their security and their own privacy commitments, and we remain responsible for what they do for us.
- Cloudflare (United States and a worldwide network) hosts this site and its database.
- Stripe (United States and elsewhere, including India) takes your payment. Your card details go straight to them. Stripe also uses payment information for its own purposes, such as preventing fraud and improving its services, under its own privacy policy at stripe.com/privacy.
- Resend (United States) sends our emails.
We do not sell personal information, and we do not use it for advertising.
Cookies
- Session cookie (wm_sid): remembers your progress. Essential to using the site without an account.
- First-visit cookie (wm_ft): remembers how you first reached us, such as a search or a campaign link. It holds no personal details and lasts 90 days.
Your browser needs scripts turned on to change this setting.
Emails
We email your certificate because you bought it. If you ask for a link to your progress or certificates, we send that once. We send no marketing.
Your rights
You can ask to see the personal information we hold about you, and ask us to correct it. Write to support@steadyhand.co.nz. We will respond within 20 working days, as the Privacy Act requires. You can also ask us to delete what we hold, and we will, except what we must keep for tax or financial records or to keep a certificate verifiable. If you are not happy with our response, you can complain to the Office of the Privacy Commissioner.
Security and breaches
Session cookies and email links are stored only in scrambled form, card details never reach us, and all traffic is encrypted. If a privacy breach is likely to cause serious harm, we will notify the Privacy Commissioner and the people affected, as the law requires.
Children
Our courses are written for adults working or preparing to work. Please do not buy a certificate if you are under 16 without a parent or guardian's help.