Privacy Policy

Who we are

ShopPilot is operated by Anihera Tait, a sole trader based in Christchurch, Aotearoa New Zealand, trading as ShopPilot (company registration pending).

For the purposes of the New Zealand Privacy Act 2020 we are the "agency" that holds your personal information. For visitors in the European Union and United Kingdom we act as the "data controller" in the sense used by the GDPR and UK GDPR.

What we collect

We only collect what we need to run the shop. In practice that means:

• Order information — your name, delivery address, email address, and phone number. You give us this when you place an order or contact us about one.
• Payment information — handled by Shopify Payments. We do not see or store your card number, CVV, or full bank account details. We only see the order total, the last four digits of the card (where Shopify exposes it), the billing country, and whether the payment succeeded.
• Communications — anything you write to us at hello@shoppilot.co.nz or via the contact form, plus any photos you send us when asking about a refund or damaged item.
• Website analytics — basic page-view data, the referring website, your approximate location (country / region level, derived from your IP address), and the type of device and browser you used. This is aggregated and not used to identify you personally.
• Marketing attribution (UTM tags) — when you arrive at the site via one of our ads or a tracked link, we store the campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term) so we can tell which ads are working. These travel with your order if you check out.
• Advertising pixels — with your consent (see Cookies and tracking below), we load retargeting pixels from Meta (Facebook / Instagram), TikTok, and Google. These let us show you our ads on those platforms if you have visited the site. If you decline, no pixels load.

How we use it

• To fulfil your order — we share the delivery address with our fulfilment partner (Zendrop) so they can dispatch your order, and with the carriers they use for tracking and delivery.
• To process payments — Shopify Payments handles the card transaction. We use the resulting order record to reconcile sales and to issue refunds.
• To send transactional emails — order confirmations, shipping updates, refund confirmations. These are sent via Resend on our behalf. You cannot opt out of transactional emails for an active order.
• To send marketing emails — only if you opted in (for example by ticking the newsletter box). Every marketing email has a one-click unsubscribe link, and we honour unsubscribe requests within five working days.
• To prevent fraud and abuse — we may use IP address, browser fingerprint signals from Shopify, and order patterns to flag suspicious transactions before fulfilment.
• To improve the site — aggregated analytics help us understand which products and pages are useful.
• To meet legal obligations — we keep records of sales for the period required by Inland Revenue and the Companies Act in New Zealand.

Who we share it with

We only share your information with the parties below, and only for the purposes listed. We do not sell your personal information to anyone.

• Shopify Inc. (Canada / US) — checkout, order processing, payments via Shopify Payments. Shopify is bound by its own Privacy Policy.
• Zendrop Inc. (US) — fulfilment. We pass your name, delivery address, contact email, phone number, and the items you ordered. Zendrop in turn passes the delivery address to the carrier and (where the supplier is overseas) to the supplier or supplier's freight forwarder.
• Resend (US) — transactional and marketing email sending. They receive your email address and the content of the email we send you.
• Meta (Facebook / Instagram), TikTok, and Google — only if you consent to advertising cookies. These platforms receive an event ping (page view, add-to-cart, purchase) plus a hashed version of your email so they can match you to a campaign audience.
• Cloud hosting — the site itself runs on Google Cloud Platform (Firebase Hosting) in the United States. Analytics and operational data are stored in Google Firestore.
• Carriers and customs authorities — for international shipments, customs authorities in the destination country may require the contents and value of the parcel; this is part of normal customs processing.
• Lawful requests — we will disclose information if compelled by a New Zealand court order, by police acting under proper authority, or as otherwise required by law.

Several of the parties above are based outside New Zealand. By placing an order with us you understand and agree that your information may be sent overseas for these purposes. We choose partners that publish their own privacy practices and that contractually agree to protect your data.

Cookies and tracking

Our site uses a small number of cookies and similar technologies. We group them like this:

• Essential — needed to remember what is in your cart, to keep you logged in to the checkout, and to protect against fraud. These cannot be turned off without breaking the site.
• Analytics — anonymous, aggregated page-view counts. We use this to see which products and pages get attention.
• Advertising — Meta Pixel, TikTok Pixel, Google Ads tag. These are off by default and only load if you give consent.

You can refuse non-essential cookies in our cookie banner, in your browser settings, or via the platform-level controls each ad network provides (for example Meta's Ad Preferences, TikTok's Ad Settings, or Google's My Ad Center).

How long we keep your information

• Order records — seven years, as required by New Zealand tax law.
• Support email threads — three years from the last message in the thread, then deleted.
• Marketing email subscriptions — until you unsubscribe, then we keep your email address on a suppression list so we do not accidentally email you again.
• Analytics and ad event data — kept by the underlying platform (Google, Meta, TikTok) per their own retention periods, typically 13–26 months.

Your rights

Under the New Zealand Privacy Act 2020 you have the right to:

• ask us what personal information we hold about you;
• ask us to correct that information if it is wrong or out of date;
• ask us to delete information we no longer need to hold (subject to our legal retention obligations above);
• complain to us if you think we have mishandled your data.

If you are in the EU or UK, the GDPR gives you additional rights including the right to data portability and the right to object to processing based on legitimate interests. To exercise any of these rights, email hello@shoppilot.co.nz with the subject line "Privacy request" and we will respond within 20 working days.

If you are not satisfied with how we have handled your request, you can complain to the Office of the Privacy Commissioner of New Zealand: privacy.org.nz.

Children

Our site is not directed at children under 16 and we do not knowingly collect information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

Security

We protect your information with HTTPS everywhere on the site, with industry-standard encryption at rest in our hosting provider, and by limiting internal access to people who need it to fulfil orders or answer support. We do not store your full payment card details at any point — those live with Shopify Payments.

Changes to this policy

We may update this policy as the business changes. The "Last updated" date at the top of the page shows when the current version took effect. Material changes (for example adding a new category of data we collect, or a new third party we share with) will be flagged on the site and, where we have your email, sent by email before they take effect.

Contact

Questions about privacy can go to hello@shoppilot.co.nz. We aim to reply within one working day.