Privacy

Updated 17 October 2026.

Second Look is a small, free website for New Zealand charities and community groups. We try to keep as little about you as we need, and to say plainly what we keep and why. We don't sell your information, show advertising or use tracking cookies.

Who we are

Second Look is run by Max Lin, Wellington, New Zealand, who collects and holds the information described here and is our privacy officer. Email hello@secondlook.org.nz for anything about your information.

What we keep, and for how long

In short: if you only browse, we don't keep your name or email address. We keep a scrambled code made from your internet address for a day to stop abuse, and Cloudflare keeps short-lived request logs. If you sign in or sign up for emails, we keep your email address and what you choose to save, until you delete it.

If you sign in

Your account: Your email address, when you joined and last signed in, and anything you add about your group: charity number, name, region, kinds of work, costs and website.; How long: Until you delete your account, or 24 months after you last sign in.
Signing in: Your email address, a scrambled copy of each sign-in code and link we send you, the page to return to, and a scrambled copy of your sign-in cookie.; How long: Codes and links are kept for a day. A sign-in lasts 30 days, or until you sign out.
Saved funders and reminders: The funders you save, whether you asked for reminders and the wording you agreed to, and which reminders we have sent.; How long: Until you remove them or delete your account. The record of sent reminders is kept for about 13 months.
Application drafts: Each draft we write for you and what it was based on: the funder, your charity number, the website address you gave and the line you typed. Email addresses and phone numbers are taken out first.; How long: Until you delete the draft or your account. A deleted draft is emptied straight away. An empty record stays for 31 days so it still counts towards the draft limit.

If you sign up for the weekly email or report a mistake

The weekly funding email: Your email address, the region, kinds of work and costs you picked, and the wording you agreed to and when.; How long: Until you unsubscribe, then deleted within 30 days. Sign-ups that are never confirmed are deleted after 30 days.
Mistake reports: Your message and, if you give one, your email address.; How long: 12 months. Your email address is deleted after 90 days.

For everyone who uses the site

Abuse protection: A scrambled code made from your internet address, used to limit repeated attempts. We can't turn it back into your address.; How long: A day.
Usage counts: Daily totals of what was used, such as how many fit checks were run for each region, which funder pages were opened and how many drafts were written. No internet address, email address or cookie is kept with a count, so a count can't be linked to you.; How long: 24 months.
Fit check answers: The AI's ranking and short reasons for a fit check, filed under a scrambled code made from the answers given, so the same check gets the same result. Not what you typed, and nothing that identifies you.; How long: 7 days.
Charity checks: Finished charity checks and register lookups, made only from public Charities Register data, and the number of new checks from each internet address each day.; How long: Checks for up to 30 days. Daily counts for two days.

About the site itself (nothing about you)

AI usage log: For each AI request: the time, the task, the model, how much text went in and out, the estimated cost and whether the result passed our checks. Not what you typed, and not who you are.; How long: 12 months.
Daily limits: How many drafts and emails the whole site has used each day.; How long: For about 2 months.
Site settings: The site's own key for signing links in emails.; How long: While the site runs.

Things you pick in the calendar and fit check are remembered in your own browser, so the form is filled in next time. They are not sent to us unless you sign in and save them, apart from the anonymous usage counts above. Clearing your browser data removes them.

Why we keep it

To run the things you ask for (signing in, saving funders, sending reminders and the weekly email, writing drafts), to stop abuse, and to understand how the site is used so we can improve it. We may read saved drafts, mistake reports and usage counts to check quality and fix problems. We won't use what you save for anything else, and we won't share it with funders.

AI and your information

When you use the fit check with the AI sorting, we send an AI model run by Cloudflare (Workers AI) the shortlisted funders' details and your answers, including the line you typed about what the money is for, with email addresses and phone numbers taken out. We don't keep what you typed. We keep the AI's answer for 7 days so the same check gets the same answer.

When you ask for an application draft, we send an AI model run by Cloudflare (Workers AI) the funder's details, your charity's public entry on the Charities Register, text from the one website address you give, and the line you typed, with email addresses and phone numbers taken out. Please don't type anything private or about other people. The draft is saved to your account so you can come back to it.

Who else handles it

These companies handle information for us. They are based overseas, mostly in the United States, so your information may be stored or processed outside New Zealand.

Cloudflare: Hosts the site and its database, runs the AI (Cloudflare Workers AI) that writes charity check summaries and application drafts and sorts the fit check shortlist, and checks you are a person (Turnstile). Keeps short-lived request logs. Deleted database rows can be recovered for up to 30 days through its backup feature, after which they are gone.
Resend: Sends our emails (sign-in codes, reminders, the weekly email) and keeps a log of what it sent.

We use reasonable care to protect what we hold, but no website can promise nothing will ever go wrong. If there is a privacy breach likely to cause serious harm, we will tell the Privacy Commissioner and the people affected, as the Privacy Act requires.

Charity information

Charity checks and the funder list use organisation-level data from the public Charities Register. We never store or show the names or contact details of a charity's officers.

Your rights

Under the Privacy Act 2020 you can ask to see the personal information we hold about you, and ask us to correct or delete it. You can delete your account and everything in it yourself on the account page. For anything else, email hello@secondlook.org.nz; we'll reply within 20 working days. If you're not happy with our answer, you can complain to the Privacy Commissioner.

Changes

If we change how we use your information, we'll update this page and, for anything significant, email account holders first.