Privacy policy

Information we collect

Our application form may collect:

• your name, business name, email address, and mobile number;
• whether you consent to marketing email, and the version of the consent wording you saw;
• the services you select and any project context you type into the form;
• your contact preference, preferred callback times, and — if you book a scoping call — the time you chose;
• campaign parameters from the link you arrived on (they begin with utm_), a Meta click identifier (fbclid) if you arrived from a Meta advertisement, the page you first arrived on, and the website that referred you; and
• a salted hash derived from your IP address for abuse prevention. We do not store the raw IP address in the application row.

Please do not put passwords, access keys, payment information, or other sensitive credentials in the project-context field. If a project proceeds, we will request necessary access through a separate secure channel and keep client credentials isolated from other client work.

Why we collect and use it

We use application information to assess and process your application, contact you about it, prepare the scoping-call agenda, deliver requested services, maintain business records, attribute campaigns, understand funnel performance, and prevent spam or excessive submissions. Providing the required contact details is necessary for us to process the application; optional selections and project context help us prepare.

We send service messages about your application because they are needed to respond to your request. We send separate marketing messages only where we have a defensible consent basis under the Unsolicited Electronic Messages Act 2007. Marketing messages will identify NewCo accurately and include a working unsubscribe method. You can withdraw marketing consent at any time by using that method or contacting us. Withdrawal does not affect application-related messages already required to handle your request.

Storage, processors, and safeguards

Application data is stored in a dedicated Supabase database protected by deny-all row-level security and accessed only by authorised server-side services. Our service providers are: Supabase (database hosting, Sydney, Australia), Vercel Inc. (United States — website hosting and website analytics), Resend, Inc. (a United States company; the emails we send you about your application are processed in its Tokyo, Japan region), Cal.com, Inc. (United States — scoping-call scheduling; when you book a call, your name, email address and chosen time are processed by Cal.com), and Meta Platforms Ireland Limited (advertising measurement, as described under “Analytics and advertising measurement”; processing in the United States and other countries). Each of these providers processes information outside New Zealand. We limit each provider’s access to what is needed to supply its part of the service.

If a privacy breach occurs, we will contain and assess it, keep the records required by law, and notify the Office of the Privacy Commissioner and affected people when the Privacy Act 2020 requires us to do so.

Retention, deletion, and export

We keep personal information only for as long as it is needed for the purposes above or to meet legal obligations. Unprogressed partial applications are deleted after 90 days, other application records after 24 months from the last interaction, and contractual or tax records for the period required by New Zealand law. We then securely delete or de-identify information unless continued retention is required.

At the end of a client engagement, customer data is included in the agreed export where applicable and is deleted from systems we control after the handover and any legally required retention period. Third-party processors may retain backups for their documented backup cycles.

One deliberate exception: if you unsubscribe from marketing email, we keep a one-way hash of your email address on a suppression list indefinitely, so that we never email you again by mistake. The hash cannot be turned back into your address and is stored with nothing else.

Your access and correction rights

You may ask for access to personal information we hold about you and ask us to correct it. You may also request deletion where we have no lawful reason to keep it. We may need to verify your identity and may withhold information only where the Privacy Act 2020 permits.

Analytics and advertising measurement

We measure how this website is used and how people find it. We keep this to the minimum that lets us run the business, we name every tool below, and this section describes only what is running today. If we switch anything else on, we will update this page first.

Website analytics — Vercel Web Analytics. We use Vercel Web Analytics, provided by Vercel Inc. (United States), to count page views and understand which pages people visit and where they arrived from. It does not use cookies and does not create an identifier that follows you across other websites. It records the page address, the referring website, your approximate country, and your device and browser type. The measurement script is served from our own domain. Vercel keeps this data for the retention period of our hosting plan. Because it stores nothing on your device and identifies nobody, it is not affected by the control below.

Campaign links. If you arrive on a link that carries campaign parameters (they begin with utm_) or a Meta click identifier (fbclid), we store those values in a first-party cookie named nc_attr for up to 90 days, together with the page you first arrived on and the website that referred you, and we record them with any application you submit. This is how we tell which advertisements are worth paying for. We do not set this cookie on an ordinary visit — only when your link carries campaign information. It is not used to build a profile of you and it is not shared with anyone except as described on this page.

Advertising measurement — Meta Pixel and Conversions API. We run advertising on Facebook and Instagram, and we use measurement tools provided by Meta Platforms Ireland Limited (which processes information in the United States and other countries) to understand which advertisements lead to applications. These tools work in two ways. In your browser, a small piece of Meta’s code records that you viewed a page and stores two first-party cookies on our domain (_fbp and _fbc) so that a later application can be connected to the advertisement you clicked. From our server, we send Meta a record of key steps — that an application was started, that it was completed, and that a scoping call was booked, attended, or led to a signed engagement. So that Meta can match this to the right advertisement, that record includes the page address, your IP address, your browser’s user-agent string, the Meta identifiers described above, and a one-way cryptographic hash (SHA-256) of your email address, mobile number and name. A one-way hash cannot be reversed to recover the original value. We do not send Meta your name, email address or mobile number in readable form, your business name, the services you selected, or anything you write in the project-context field. Meta processes this information for advertising measurement and for improving the delivery of advertisements, and keeps it for the period stated in its own data policy.

Your choice. The control below turns advertising measurement and campaign attribution off in this browser. When it is off, we do not load Meta’s code, we do not store the campaign cookie, we do not send Meta any record of your visit or your application, and we do not record campaign parameters, click identifiers, the page you arrived on, or the referring website with your application — even if the link you arrived on carries them. Meta’s cookies set earlier in this browser are removed when you turn it off. We also respect the Global Privacy Control signal on every request, if your browser sends one. Turning this off does not affect your application, our service to you, or the messages we send about your application.

Checking your current setting…

You can also block or delete cookies in your browser settings, and review how Meta uses information about you in your Facebook or Instagram ad settings.

Client websites and analytics

For a client website, the contract will define whether the client or NewCo is responsible for particular information. Analytics and tracking defaults are decided and documented for each site. Routing data through a first-party domain does not itself create permission to collect or use it.

Contact

To withdraw marketing consent or request access, correction, deletion, or an export, email hello@newco.co.nz, use the contact page, or note your request in the three-minute application.