1. Who This Policy Covers

This policy explains how Needsey ("we", "our", "us") collects, holds, uses and discloses personal information about Clients and Service Providers who use the Needsey platform, in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). It should be read alongside our Terms and Conditions, which remains the governing agreement for using the Platform.

2. What We Collect, and Why (IPP 1–3)

We only collect what's needed to run the marketplace safely and match Clients with Providers:

• Account & contact details — name, email and phone number, collected at signup and before a job can be accepted or a phone-verified need can be posted. Your phone number is only ever shared with the other party to a booking once that job becomes active, so you can coordinate directly — it is never publicly listed on your profile.
• Location data — for Providers, a service/home-base location (used to place you on the Radar and Services map for nearby matching); for Clients, the location attached to a posted Need (used for provider matching, or omitted entirely for remote/online needs). Addresses are turned into coordinates using OpenStreetMap/Nominatim, which only ever receives the address text you search for — no account information is sent to it.
• Identity verification — Providers may complete ID verification through Stripe Identity. Document images and biometric checks are handled directly by Stripe on a secure, redirect-based flow; Needsey never receives or stores your raw ID documents, only the resulting verification status (verified / pending / failed) shown as a badge on your profile.
• Payment & payout details — handled by Stripe Connect. Needsey never sees or stores your full card number or bank account details; we retain only the transaction records, commission amounts, and your Stripe account's onboarding/payout status needed to run escrow and settle payments.
• Messages & booking activity — chat messages, offers, ratings and review text you exchange through the Platform, retained to operate the booking, resolve disputes, and maintain a review history.
• Device & notification data — if you opt in to push notifications, a browser-generated push subscription endpoint (no content is stored beyond what's needed to deliver that notification).

3. Who We Share It With (IPP 11)

We don't sell personal information to anyone, including data brokers. We share it only where necessary to operate the Platform:

• Stripe — for payment processing, Connect escrow/payouts, and (if you complete it) identity verification.
• Supabase — our database and authentication infrastructure host.
• OpenStreetMap / Nominatim — for converting addresses you enter into map coordinates.
• Your browser or device's push notification service (e.g. the notification relay built into your browser or operating system) — only if you opt in to push notifications.
• The other party to a booking — limited profile and contact information (such as your phone number) is shared with your Client or Provider counterpart once a job is active, so the work can actually be coordinated and completed.
• Needsey staff/administrators — where necessary to investigate a dispute raised through our in-app resolution process.
• Law enforcement or regulators, only where we're legally required to.

4. Overseas Disclosure (IPP 12)

Some of the providers above (notably Stripe and Supabase) process or store data on infrastructure located outside New Zealand, including in the United States. Under IPP 12, we only disclose personal information overseas where the recipient is subject to privacy safeguards comparable to the Privacy Act 2020 — including via their own data processing agreements and certifications (e.g. Stripe's and Supabase's published compliance and security documentation) — or another exception under the Act applies. We review these arrangements periodically as our provider list changes.

5. How Long We Keep It (IPP 9)

We keep personal information for as long as your account is active, and for a reasonable period afterwards where we have a legitimate reason to — for example, financial and transaction records that New Zealand tax law requires businesses to retain, or records relevant to an unresolved dispute. Where we no longer need information for these purposes, we delete it or de-identify it.

6. Your Rights — Access, Correction & Deletion (IPP 6–7)

You can review and update most of your own information at any time from your account Settings and Profile pages. Under the Privacy Act 2020, you also have the right to request access to the personal information we hold about you, ask us to correct it if it's wrong, or request that your account and associated personal information be deleted.

To make a request, contact us at privacy@needsey.co.nz. We'll respond within the timeframe required by the Act. Note that some information — such as records tied to a completed transaction, an active dispute, or information we're required to retain for tax purposes — may need to be retained or de-identified rather than deleted outright, even after an account closure request.

7. Complaints

If you're unhappy with how we've handled your personal information, please contact us first at privacy@needsey.co.nz so we can try to resolve it directly. If you're not satisfied with our response, you have the right to complain to New Zealand's Office of the Privacy Commissioner (privacy.org.nz).

8. Security

We restrict access to personal information to what's needed to operate the Platform, use row-level access controls on our database, and rely on Stripe's PCI-compliant infrastructure for payment data rather than handling card or bank details ourselves. No online platform can guarantee absolute security, but we continue to review and tighten these controls as the Platform grows.

9. Changes to This Policy

We may update this policy as the Platform changes. Material changes will be reflected in the "Last Updated" date above, and where appropriate, communicated in-app.