Last updated: 17 September 2026
Applied Insights is a data and analytics consultancy operated by Hayden Sanders in Auckland, New Zealand. This policy explains what personal information is collected through this website, and what Google account data is accessed by the private applications Applied Insights builds for its own use.
Applied Insights is the agency responsible for the personal information described here. Questions, requests and complaints go through the contact form on this site.
Part one — this website
What is collected
This website uses Google Tag Manager to load two analytics tools: Google Analytics 4, and Jitsu, which Applied Insights runs on its own server at x44.appliedinsights.co.nz. When you visit a page, the following is collected automatically:
- pages viewed, and the time and duration of each visit
- the referring website or search that brought you here
- an approximate location, derived from your IP address at city level
- device type, operating system, browser and screen size
- interactions with the page, such as clicks, scrolling and form submissions
Google Analytics 4 does not retain your full IP address. It is used to derive approximate location and is then discarded rather than logged.
If you submit a form on this site, the information you type into it is collected so the enquiry can be answered.
Cookies
Google Analytics sets two cookies, _ga and _ga_ followed by a stream identifier. They distinguish one visitor from another and one visit from another, and expire two years after your most recent visit.
Jitsu sets three cookies, __eventn_id, __eventn_id_usr and __eventn_uid, which serve the same purpose for the first-party analytics described above.
Google Tag Manager itself sets no cookies.
No advertising, remarketing or cross-site tracking tags are used on this site.
You can refuse or delete these cookies in your browser settings at any time, or install Google's Analytics opt-out browser add-on. The site works normally without them.
Why it is collected
Analytics data is used only to understand how the site is found and used, so its content can be improved. It is not used to identify you as an individual, is not sold or rented, and is not combined with any client work.
Who else sees it
Google LLC processes the Google Analytics data as a service provider, on servers that may be located outside New Zealand, including in the United States. Google's handling of it is governed by the Google Privacy Policy.
The Jitsu data is collected first-party: it goes to a server operated by Applied Insights on its own domain, and is not passed to any external analytics provider.
How long it is kept
In Google Analytics, event data is retained for 2 months and user data for 14 months, after which Google deletes it. Enquiry emails are kept for as long as needed to deal with the enquiry and any resulting work.
Part two — Applied Insights applications and Google account access
Applied Insights builds and runs private applications for its own internal use, including the task and scheduling application "Boris the Task Eater" and associated tools that connect to Google Workspace. These applications are single-operator: they are used only by Hayden Sanders, on Google accounts he owns or is authorised to use. They are not offered to the public and are not distributed.
What Google data is accessed
When the application is authorised, it requests permission to access:
- Google Calendar (read) — calendar names and event details, so scheduled work can be displayed alongside tasks.
- Google Calendar (read and write) — creating, updating and removing events, so tasks can be scheduled onto a calendar and kept in step.
- Google Drive file metadata (read) — file names and identifiers only, so a document linked to a task shows its real title rather than a raw URL. File contents are not accessed under this permission.
- Google Drive files (read only) — the names and contents of files in the Drive, so the account holder can find and read their own files. This permission cannot change, move or delete any file.
- Google Drive files created or opened with the application (read and write) — only those files the application itself creates, or that are explicitly opened with it. This gives no access to any other file in the Drive.
- Google Docs, Google Sheets and Google Slides (read and write) — the content of documents, spreadsheets and presentations the application works with.
How that data is used
Google data is used solely to provide the features above to the account holder who authorised it. Specifically, it is:
- used only to display, schedule and edit that person's own tasks, calendar entries and documents
- never sold, rented or disclosed to any third party, except that content the account holder asks an AI assistant to work with is sent to that assistant's provider (Anthropic) solely to carry out the request
- never used for advertising or marketing
- never used to develop, improve or train any artificial intelligence or machine learning model, whether generalised or personalised
- never read by any person other than the account holder
Limited Use
Applied Insights' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Withdrawing access
Access can be revoked at any time at myaccount.google.com/permissions by selecting the application and removing its access. This immediately invalidates the application's credentials for that account. Remaining stored data can be deleted on request.
Storage and security
Task and calendar records are held in a private database operated by Applied Insights on Google Cloud infrastructure, reachable only by the account holder through an authenticated session. Google OAuth credentials are held in Google Cloud Secret Manager and are never written into source code or logs. Data retrieved from Google APIs is kept only as long as it is needed for the features described, and is deleted when the corresponding task or connection is removed.
Your rights
Under the Privacy Act 2020 you may ask what personal information Applied Insights holds about you, ask for it to be corrected, and ask for it to be deleted. Requests go through the contact form on this site and are answered within 20 working days.
If you are not satisfied with the response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.
Changes to this policy
Any change to this policy is published on this page, with a revised date at the top.