This policy explains how BuildCert (buildcert.nz), operated by BuildCert Solutions Ltd trading as BuildCert.NZ, collects and handles personal information, in accordance with the Privacy Act 2020.
What we collect
Contact details you give us (name, email, company, role) when you request access or contact us.
Project documents and case information you provide for a report. These are your documents and your evidence - we do not gather them from elsewhere.
Usage data such as pages visited, which we may collect in future to run and improve the service (we will update this policy when analytics are introduced).
Device preferences - the site stores your light/dark theme choice in your browser's local storage. This stays on your device and is never sent to us.
How we use it
To provide the service and your report, to respond to you, to operate and improve the site, and to meet legal obligations. We do not sell your personal information, and we do not use it for marketing without your consent.
Who we share it with
We use trusted third-party providers to run the service - for example form handling (Formspree), website and application hosting (Vercel), database and file storage (Supabase), and payment processing (Stripe). These providers process data on our behalf and may store it outside New Zealand. We share personal information only as needed to provide the service or where required by law.
Storage, security and retention
We take reasonable steps to protect personal information from loss, misuse, and unauthorised access, including access controls, encrypted connections, and authenticated-only access to your case records.
How long we keep it
Contact details (name, phone, company): if your case has had no activity for 12 months, we automatically de-identify the record - we remove these contact details while keeping the case record itself so you can still access your report. Your email is retained as the account identifier you use to sign in and retrieve your report.
Case record, report and evidence: retained in de-identified form for 10 years from your last activity, to meet our legal obligations and to support any claim or application relating to the property, then securely deleted by an automated process.
Account information: you can delete your account at any time; we will then delete or de-identify the personal information we hold about you, subject to legal obligations.
These retention actions are logged internally for audit purposes.
Your rights
Under the Privacy Act 2020 you may request access to, and correction of, the personal information we hold about you. Contact us and we will respond within the timeframes the Act requires.