Privacy Policy

When you place an order we collect: your name, email address, shipping address, and phone number. Stripe collects your payment details on our behalf — we never see or store your card number.

When you browse the site we may collect basic technical data (browser type, IP address) for security and to keep the site working. We do not run third-party advertising trackers.

We use your information to:

• Process and ship your orders
• Email you order confirmations and tracking updates
• Comply with our legal obligations (e.g. accounting records)
• Respond to your support enquiries

We share your information only with these third parties:

• Stripe — payment processing. Subject to Stripe’s Privacy Policy.
• NZ Post (via GoSweetSpot) — shipping and tracking. Your name, address, and phone are passed to the courier for delivery.
• Resend (when configured) — transactional email delivery.

We do not sell or rent your information to anyone, ever.

Order records (name, address, items, totals) are kept for 7 years to meet New Zealand Inland Revenue tax record-keeping requirements. Other data is kept only as long as needed for the purpose collected.

Under the New Zealand Privacy Act 2020 you have the right to:

• Access the personal information we hold about you
• Request a correction if it is wrong
• Make a complaint to the Privacy Commissioner

To exercise these rights, email mcgregorhenare@gmail.com.

Payment is handled by Stripe (PCI-DSS Level 1 certified). Our site runs over HTTPS. Order data is stored on secure cloud infrastructure. We take reasonable steps to protect your information but no system is 100% secure.

We use only essential cookies and local storage required for the site to function (e.g. your shopping cart). We do not run advertising trackers, social media pixels, or third-party analytics.

We may update this policy. Material changes will be posted here with an updated date.

Privacy questions or requests: mcgregorhenare@gmail.com.