Privacy policy

This policy explains what personal information Kiwi Flame ("Kiwi Flame", "we") collects through kiwiflame.nz, why we collect it, and what you can do about it. We follow the New Zealand Privacy Act 2020.

The short version

• We only collect what we need for the thing you're doing.
• We don't sell your information, and we don't use advertising trackers.
• The signature you draw on the Hot waiver stays on your phone. We never receive it.
• You can ask to see, correct or delete what we hold about you at any time.

What we collect, and why

If you join the waitlist: your email address, the date you signed up, and where on the site you signed up. We use it to send batch news and tell you when online orders open. We ask you to confirm your address first, and every email has an unsubscribe link.

If you send an enquiry or a message: the details you give us (such as your name, email, phone, business name and town) so we can reply. If you tick the box to hear from us, we'll also add you to our mailing list.

If you sign the Hot waiver: the bottle code, the town you pick, the date and time, and the display name if you choose to give one. The town is added to Town Wars. If you give a display name, it appears on your certificate and on its public certificate page, but not on the Town Wars scoreboard. You don't need to give your real name. Your drawn or typed signature is placed on your certificate inside your browser and is never sent to us. A drawn signature is kept in your browser's storage on that device, so your certificate can be shown again there; clearing your browser data removes it. If you tick the box for Kiwi Flame news while signing, your email goes onto the waitlist in the same way as above, separately from your signing, so it isn't linked to your town or certificate.

If you buy online: your name, email, delivery address, phone number (if given) and what you ordered, so we can send your order and handle any problems. Payments are processed by Stripe. We never see or store your full card details.

When you visit the site: your cart is kept in your browser on your device and isn't sent to us until you go to checkout. The home page also remembers, in your browser only, the heat you last picked on the Bravery Dial, how many times you've visited (so it can show you a new joke) and the Town Wars scores you last saw (so it can tell you what's changed). None of that is sent to us, and clearing your browser data removes it. We count simple events such as page views, Heat Finder results, which heats get picked on the Bravery Dial and QR scans, without cookies and without storing your IP address, so we can see what's working. Our hosting provider keeps standard server logs (which include IP addresses) for security and troubleshooting.

To protect the site: to stop abuse, such as people guessing bottle codes, we keep a short-lived record of request counts linked to a one-way scrambled version of your IP address. These records are deleted automatically within two days.

Who we share it with

We use a small number of service providers to run the site. They only process information on our behalf:

• Netlify (website hosting)
• Supabase (database)
• Resend (sending emails)
• Stripe (payments, once online orders open)

Some of these providers store information outside New Zealand, including in Australia and the United States. We choose providers with strong security and privacy commitments.

We don't share your information with anyone else unless the law requires us to.

How long we keep it

• Waitlist: until you unsubscribe. After that we keep a record of your address and that you unsubscribed, so you aren't emailed again by mistake. Ask us and we'll delete it completely. Unconfirmed sign-ups are deleted after 30 days.
• Enquiries and messages: two years, then deleted automatically from our dashboard.
• Waiver records: for as long as Town Wars runs, because they make up each town's score. You can ask us to hide or delete your display name at any time.
• Orders: seven years, because tax law requires us to keep business records, then deleted automatically.
• Visit counts: about 13 months, then deleted automatically.
• Abuse-prevention records: deleted automatically within two days.

Your rights

You can ask to see the personal information we hold about you, and ask us to correct or delete it. Get in touch through the contact form. We'll reply within 20 working days, as the Privacy Act requires.

If you're not happy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

Security

The site runs over HTTPS. Bottle codes are stored in a scrambled form that can't be turned back into the printed code. Access to our dashboard is limited and protected by a password.

Changes

If we change this policy, we'll update this page.