Privacy Statement - Artisan Ideas Ltd & App-Rentice

Effective: March 7th, 2026

Artisan Ideas values the trust you place in us when you use artisanideas.co.nz, webapp.nz, App-Rentice, our Firebase hosting domains (including app-rentice.firebaseapp.com and app-rentice.web.app), and our subdomains within those websites, Mobile Applications (apps) or tools (collectively, our "Websites" or "Services"). This Privacy Policy describes our collection, use, and disclosure of your information and applies to our websites and applications that link to it, regardless of how you access or use them, including through mobile devices, web browsers, or native applications.

If you do not agree to the terms of this Privacy Policy, please do not use our Websites. We may make changes to this Privacy Policy from time to time. We will post any changes to our Websites. Your continued use of our Websites following the posting of any changes will mean you accept those changes.

Information We May Collect

We collect, process, share and retain information from you and any devices you may use when you access our Websites, use our services, register for an account with us, provide us information on a web form, update or add information to your account, participate in community discussions, chats, or otherwise correspond with us. The specific information we collect depends upon your use of the Websites, as described below.

Information You Give Us

We receive and store information you enter on our Websites or give us in any other way, including but not limited to:

• Your name
• Phone number
• Email address

Information About Your Interaction With Our Websites

We collect information about your interactions with our Websites, such as the purchases you make or the pages you visit.

Information We Automatically Collect

We receive and store certain types of information whenever you interact with us or our Websites. Our Websites use "cookies," tagging and other tracking technologies. This information includes computer and connection information such as statistics on your page views, traffic to and from our Websites, referral URL, ad data, your IP address, and device identifiers; this information may also include your browsing history, transaction history, and your web log information.

Location Information

We may receive information about your location and your mobile device, including a unique identifier about your device.

Educational Assessment Data

If you use App-Rentice through a training provider, educational institution, or employer-sponsored apprenticeship program, we collect information specific to your training and assessment activities, including but not limited to:

• Qualifications, certifications, and courses you are pursuing
• Unit standards, learning outcomes, and competency assessments
• Assessment records, signoff evidence, and tutor feedback
• Portfolio entries, project work, activity logs, and work evidence
• Evidence media (photos, documents, notes) submitted for assessment purposes
• Tutor/assessor assignments and employer relationships
• Achievement badges, completion status, and progress tracking
• Timesheet records and work hours logged for apprenticeship programs

Educational data is collected to facilitate your training, provide assessments, track your progress, and generate completion records required by educational authorities and qualification bodies. This data may be shared with your educational institution, training provider, employer, assigned tutors/assessors, and relevant qualification authorities as necessary to support your learning and certification.

Authentication Tokens and Session Management

When you log in to App-Rentice, we issue JSON Web Tokens (JWT) to authenticate your session. These tokens are stored securely on your device:

• Mobile Devices (iOS/Android): Tokens are stored using Capacitor Preferences, which utilises your device's secure storage (encrypted by your device's operating system, protected by iOS Keychain or Android Keystore).

• Web Browsers: Tokens are stored in your browser's local Storage, subject to standard browser security protections.

• Token Contents: Tokens contain your user ID, role (student/tutor/employer), and session expiration time. They do NOT contain your password.

• Token Lifecycle: Access tokens expire periodically (typically within 15-60 minutes) and are automatically refreshed. Refresh tokens expire after 7 days or when you log out.

• Security: When you log out, all authentication tokens are immediately cleared from your device. We encrypt all token transmission using HTTPS/TLS protocols.

• Session Timeout: For security, your session will automatically expire after 30 minutes of inactivity, requiring you to log in again.

We do NOT store your password after login. Your password is hashed using industry-standard encryption before storage, and we cannot retrieve or decrypt your original password.

Information From Social Media and Other Sites

When you interact with our Websites or services on a social media platform, we may collect the personal information that you make available to us on that page, including your account ID or username. If you choose to log in to your account with or through a social networking service, Artisan Ideas Ltd and that service may share certain information about your activities.

How We May Use Your Information

We use your information to help us personalize and continually improve your experiences on the Websites, including fulfilling your orders and requests for information, analysing and compiling trends and statistics, and communicating with you.

General Uses

We may use your information to:

• Provide, maintain, and improve the Websites for internal or other business purposes
• Fulfil requests for information
• Provide, produce, and ship the products that you order or the services you request
• Provide customer support
• Track and evaluate the use of the Websites
• Communicate with you about your Customer Account, Content Owner Account, profile, changes to our policies or terms
• Send you information about features and enhancements on or to our Websites
• Send you newsletters or other materials
• Send you offers, promotions, or other communications about our products and services, including special or promotional events, including services, products, or events for which we collaborate or co-offer with a third party
• Detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal
• Optimise or improve our products, services and operations
• Perform statistical, demographic, and marketing analysis of users of the Websites and their viewing patterns

How We May Share Your Information

We do not share your personal information with third parties, except as set forth below. We may disclose information that does not specifically identify you, such as aggregate information, device identifiers or other unique identifiers to third parties in any manner we deem appropriate.

Sale, Assignment or Change of Control

We may change our ownership or corporate organisation while providing the Websites. We may transfer to another entity or its affiliates some or all the information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any business, other change of control transaction or financing. Under such circumstances, we would request the acquiring party to follow the practices described in this Privacy Policy. Nevertheless, we cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Privacy Policy.

Law Enforcement, Legal Process, and Emergency Situations

We may also use or disclose your personal information if required to do so by law or on the good-faith belief that such action is necessary to (a) conform to applicable law or comply with legal process served on us or the Site; (b) protect and defend our rights or property, the Websites or our users, or (c) act to protect the personal safety of us, users of the Website or the public.

Data Retention

We retain your personal information only as long as necessary to fulfil the purposes described in this Privacy Policy or as required by law.

Your Responsibility

While we implement strong security measures, you also play a critical role in protecting your information:

• Choose a strong, unique password and do not reuse passwords across multiple sites
• Do not share your login credentials with others
• Log out when using shared or public devices
• Keep your device operating system and browser updated
• Use encryption and secure networks when accessing App-Rentice (avoid public WiFi for sensitive activities)
• Report suspicious activity immediately to daniel@artisanideas.co.nz

Your Privacy Rights and Data Access

We take steps to ensure that the personal information we collect is accurate and up to date, and we provide you with the ability to access, correct, and control your information.

How to Exercise Your Rights (Data Subject Access Request - DSAR)

To exercise any of these rights, please contact us at:

• Email: daniel@artisanideas.co.nz
• Subject Line: "DSAR Request - [Your Name]"
• Include: Your full name, account email, specific request, and any relevant details

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, and other factors. When we make changes, we will update the "Effective" date at the top of this Privacy Policy. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

Last Updated: March 7, 2026