Privacy

Who this is about

This policy covers nzbusiness.directory. Information about the business listings themselves is published deliberately, by the businesses in them. Information about the people with accounts is not published at all.

If you are just reading the directory

You do not need an account, and none is offered for readers. No profile is built of you, nothing you search for is tied to you, and the directory sets no advertising or tracking cookies of its own.

The site is hosted on Vercel, which keeps server request logs in the ordinary way. Those include IP addresses and are used to run and secure the service, not to identify readers.

There is no analytics container on this site at present. If one is added, this page will say what it loads before it is switched on.

If you have an account

What is stored, and why:

• Your name and email address. To sign you in, to confirm the address is yours, to reset a password and to tell you what has happened to your listing.
• A hashed password. The password itself is never stored and cannot be read back by anybody, including us.
• Session records. So you stay signed in, with the device and address a session was created from.
• Your listing and everything on it. This is the part that is published, and you control it.
• A record of moderation decisions. Who approved, rejected or suspended a listing, when, and why. This is kept so that a decision about somebody else’s business can always be accounted for.

Payments

Premium subscriptions are handled by Stripe. Card details are entered on Stripe’s own checkout and never reach this site, which is not able to read them. What is stored here is the Stripe customer and subscription identifiers, the plan, the status and the date the paid period ends.

Email

Verification, password reset and moderation emails are sent through Resend. The address you signed up with is shared with them for that purpose. No marketing email is sent from this directory.

Images

Images uploaded to a Premium listing are kept in a private storage bucket, not on a public URL. They are served through a route that checks the listing is published and the subscription is live, and the link it issues expires within minutes.

Where the data is

The database is hosted with Neon in Sydney, Australia. Stripe, Resend and Vercel each process data outside New Zealand as part of providing their services.

How long it is kept

Account and listing data is kept while the account exists. Ask for the account to be deleted and the account, its listings and its uploaded images are removed. The record of moderation decisions is kept without the personal details attached to it, because a decision that cannot be accounted for is worse than one that can.

Your rights

Under the Privacy Act 2020 you can ask what personal information is held about you and ask for it to be corrected. Ask through the contact page from the account in question.

Still to be confirmed

The legal entity responsible for this directory and the address for formal privacy requests are being finalised, and this page will name both as soon as they are. In the meantime requests through the contact page reach the person who runs the site.