Privacy Policy

Last updated 8 November 2026

Upfront Kiwi ("we", "us") builds and looks after websites for New Zealand small businesses. This policy explains what personal information we collect, why, and what you can do about it. We follow the New Zealand Privacy Act 2020.

What we collect

• Website Health Check: the web address you ask us to check, your email address, and the results of the check.
• Quote requests: your name, email, business details and the options you choose.
• Orders and onboarding: your name, business name, email, the content you give us for your website (text, images, opening hours, contact details), and details about your domain and hosting so we can connect your site.
• Payments: handled by Stripe. We never see or store your full card details. We receive a record of the payment (amount, date, and the last four digits of the card).
• Advertising and visit information: if you arrive from an online ad, we store the ad's click reference (for example Google's gclid or Microsoft's msclkid) and campaign tags (utm_ values) in your browser for up to 90 days, and attach them to any Health Check, quote or order you make.
• Security information: your IP address and browser details, used briefly to stop spam and abuse.

How we use it

• To run your Health Check and email you the report.
• To prepare quotes, build your website, and look after it if you have a care plan.
• To send emails about your order, report or account. We don't send marketing emails without asking.
• To measure which of our ads work. We may tell Google Ads or Microsoft Advertising that a click led to an enquiry or purchase, using only the click reference, the date and the value. We don't share your name or email with them.
• To keep our services secure and meet our legal and tax obligations.

Who we share it with

We don't sell personal information. We use these trusted providers to run our services, and they only process information for us:

• Cloudflare: hosting, security and spam protection (Turnstile)
• Stripe: payments
• Resend: sending email
• Microsoft: our business email
• Google: page-speed testing of the address you submit, and ad measurement
• Microsoft Advertising: ad measurement

Some of these providers store information outside New Zealand. We choose providers with strong security and privacy protections.

Google user data

Our internal management tool connects to the Google Ads API to manage Upfront Kiwi's own advertising account only. It doesn't ask website visitors or customers to sign in with Google, and it doesn't access anyone else's Google account or data. Information received from Google APIs is used only to run our own ad campaigns, isn't shared with third parties, and isn't used for any other purpose. Our use of that information follows the Google API Services User Data Policy, including its Limited Use requirements.

How long we keep it

• Health Check reports: 12 months.
• Customer, order and payment records: 7 years, as New Zealand tax law requires.
• Encrypted backups: 30 days.
• Ad click references in your browser: 90 days. You can clear them at any time by clearing your browser's site data.

Keeping it safe

All our pages use encrypted connections (HTTPS). Our admin systems need strong sign-in, and backups are encrypted. Only the people who need your information to do their job can see it.

Your rights

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it where we're not legally required to keep it. Email [email protected] and we'll reply within 20 working days. If you're not happy with our response, you can complain to the Office of the Privacy Commissioner.

Changes

If we change this policy, we'll post the new version here with an updated date.

Contact

Upfront Kiwi, New Zealand. Email [email protected].