FindAWaterproofer.co.nz / FAW Privacy Policy

Status: Draft for review only — not legal advice and not approved for implementation or publication.

Last updated: [PLACEHOLDER — insert approved publication date]

1. Purpose

This draft Privacy Policy describes how FindAWaterproofer.co.nz / FAW may collect, use, hold, disclose, and protect personal information. It must be completed against verified product evidence, the operational vendor map, and approved founder policy decisions before publication.

FAW is described in the current draft materials as a platform, introducer, or lead-generation service that may help homeowners connect with independent waterproofing contractors. [PLACEHOLDER — confirm the final platform role, the launch workflow, and whether this description remains accurate.]

2. Who operates FAW and how to contact us

FindAWaterproofer.co.nz / FAW is operated by:

• Legal operator name: [PENDING REGISTRATION/ADDRESS — confirm legal entity or sole-trader name]
• Legal structure: [PENDING REGISTRATION/ADDRESS — confirm sole trader, company, partnership, trust, or other structure]
• Trading name: FindAWaterproofer.co.nz / FAW
• NZBN: [PENDING REGISTRATION/ADDRESS — confirm whether applicable and insert NZBN]
• GST registration and number: [PENDING REGISTRATION/ADDRESS — confirm GST-registration status and number, if registered]
• Business, physical, or service address: [PENDING REGISTRATION/ADDRESS — insert confirmed address]
• Privacy and general contact email: hello@findawaterproofer.co.nz
• Telephone: No phone number is published.
• Internal privacy-request and breach-escalation owner: [PLACEHOLDER — identify the responsible role or person]

In this draft, “FAW”, “we”, “us”, and “our” mean the operator identified above.

3. Personal information we may collect

We will collect only the personal information reasonably necessary for the purposes described in this policy and any other lawful purpose. The final published policy must match the fields actually collected and the records actually created.

3.1 Homeowners and enquiries

Current repository evidence confirms that FAW's homeowner intake does not request a street address, house number, or exact property location. It may collect city, suburb, or other approved general-location information for matching. [PLACEHOLDER — confirm the final location fields and whether any future workflow will collect or release a full address.]

Depending on the final enquiry flow, FAW may collect:

• name, email address, phone number, and preferred contact method;
• city, suburb, region, or other approved general-location information;
• the waterproofing issue or project description, property type, timing, urgency, and notes;
• homeowner photos uploaded with an enquiry;
• documents or other uploaded materials, if enabled;
• communications with FAW;
• consent records, form-submission records, and the relevant form version; and
• technical and usage data, such as IP address, timestamp, browser or device information, referrer, campaign source, and website interactions.

[PLACEHOLDER — founder evidence and policy review: confirm every homeowner form field; whether homeowners have accounts or submit one-off enquiries; whether documents are enabled; where photos and other uploads are stored; who can access them; and whether messages are held in FAW or occur off-platform.]

3.2 Contractors

Depending on the final contractor onboarding and lead workflow, FAW may collect:

• contractor, contact-person, legal-business, and trading-name details;
• NZBN or company details, contact details, business address, service areas, trade categories, and website details;
• profile content, including logos, photographs, job examples, and service descriptions;
• qualifications, licences, registrations, supplier certifications, references, public-liability-insurance information, and Licensed Building Practitioner information where relevant;
• application, account, lead-access, lead-purchase, billing, invoice, refund, credit, and transaction records;
• communications, complaints, review, moderation, and dispute records; and
• any other information a contractor chooses to provide.

[PLACEHOLDER — confirm every contractor application and signup field; whether onboarding is manual or automated; which profile content is public, private, or restricted; and which qualifications, insurance, or registration details are collected or checked.]

3.3 Payments and financial information

If FAW takes contractor payments, a third-party payment provider may process them. Stripe-related payment and webhook surfaces exist in the repository, but the final payment-provider and data-handling statement remains pending confirmation. [PLACEHOLDER — founder evidence and policy review: identify the final payment provider and confirm whether payments are live at launch.]

FAW's final policy must accurately state whether FAW stores any payment-related information, including billing name, billing address, invoice, receipt, transaction identifier, payment status, failed-payment, refund, dispute, tax, GST, bank, or payout records. It must also state whether FAW stores full card details. [PLACEHOLDER — founder evidence and policy review: confirm all payment data, access controls, contractor bank or payout details, final fee wording, and GST treatment.]

3.4 Website, cookies, analytics, and advertising

FAW may collect technical and usage information when people use its website. It may use cookies or similar technologies for site operation, security, preferences, analytics, fraud prevention, and advertising measurement only where those technologies are actually enabled.

[PLACEHOLDER — founder evidence and policy review: list every active cookie, analytics product, advertising pixel, remarketing tag, heatmap, session-recording tool, conversion tracker, and whether any data is linked to identifiable enquiries. Confirm the required notice, consent mechanism, and opt-out process.]

4. How we collect personal information

FAW may collect personal information directly from a person when they submit an enquiry, apply as a contractor, create or update a profile, purchase, unlock, or receive a lead, upload information, contact FAW, make a payment, request support, or make a complaint.

FAW may also receive information from service providers, payment providers, public registers, or other third parties where this is relevant to the final workflow and permitted by law. [PLACEHOLDER — identify each indirect source and the purpose for which it is used.]

5. Why we may use personal information

Subject to final product evidence and founder policy review, FAW may use personal information to:

• receive, assess, and manage homeowner enquiries;
• operate accounts, contractor applications, profiles, matching, and lead-access workflows;
• connect homeowners with relevant independent contractors;
• process payments, billing, invoices, refunds, credits, and account records;
• communicate about enquiries, leads, accounts, payments, support, complaints, and platform updates;
• investigate or manage complaints, disputes, safety concerns, fraud, spam, misuse, or security issues;
• verify contractor information only where FAW has an actual verification process;
• meet legal, accounting, tax, and regulatory obligations; and
• improve the website, forms, services, and platform operations.

[PLACEHOLDER — founder evidence and policy review: confirm each purpose, whether FAW sends marketing, and whether automated decision-making, profiling, AI, or chatbot processing uses personal information.]

6. Sharing homeowner enquiry information with contractors

FAW may share relevant homeowner enquiry information with independent contractors to help them respond to a request for waterproofing-related services. FAW is not, on the current draft model, the contractor carrying out that work. [PLACEHOLDER — founder evidence and policy review: confirm this statement and the final homeowner–contractor contract and service workflow.]

FAW's current lead-access policy allows no more than three active paid, non-refunded contractor unlocks for a lead. Paid access is controlled by webhook-persisted entitlement. [PLACEHOLDER — founder evidence and policy review: confirm whether this policy will be used in the published service and define the treatment of reopened leads and prior purchasers.]

The exact information shown before an unlock remains unresolved. The current UI hides homeowner contact details before unlock, but the pre-unlock API payload requires evidence review because a path may return a homeowner name or phone number. The final policy must state only the fields verified by that review. [PLACEHOLDER — define and evidence every pre-unlock field, including category, city or suburb, urgency, description, property type, measurements, photo count or preview, and any other metadata.]

Homeowner photos are available to contractors only after purchase or unlock under the current repository evidence. The exact post-unlock information remains unresolved. [PLACEHOLDER — define and evidence the post-unlock fields, the webhook-entitlement release trigger, photo and document access, emergency-lead rules, whether leads may be unlocked by multiple contractors, and the homeowner notice or choice.]

Contractors must use homeowner information only for the confirmed lead-response and waterproofing-service purpose, unless the homeowner separately authorises another use. [PLACEHOLDER — founder evidence and policy review: confirm contractor privacy obligations, lead-use restrictions, monitoring, and enforcement process.]

7. Information we may share with homeowners

FAW may display or provide contractor information such as business name, contact details, service categories, service area, profile content, and any qualifications, licences, insurance, accreditation, reviews, or ratings that FAW has decided to display.

FAW must not describe a contractor as verified, insured, licensed, qualified, approved, or similar unless the statement matches an actual, documented, and auditable verification process. [PLACEHOLDER — founder evidence and policy review: confirm each displayed field, each badge or claim, its evidence, the checking process, and re-check frequency.]

8. Service providers, other recipients, and overseas disclosures

FAW may share personal information with service providers that support its operations, such as hosting, database, cloud-storage, authentication, email, SMS or phone, payment, analytics, advertising, CRM, support, security, logging, monitoring, backup, and professional-advice providers. FAW may also disclose information to government agencies, regulators, law enforcement, or professional advisers where permitted or required by law.

[PLACEHOLDER — operational vendor-map confirmation: Supabase, Resend, Stripe, Vercel, and Drippo-related processing surfaces are present in the repository, but this is not a complete data map. List every actual vendor, subprocessor, tool, data category shared, purpose, access location, retention setting, and whether AI tools process homeowner or contractor information.]

Some providers may store, process, or access personal information outside New Zealand. [PLACEHOLDER — founder evidence and policy review: confirm every overseas disclosure, data-hosting region, applicable privacy safeguards, contractual arrangements, and approved disclosure wording.]

9. Marketing and electronic messages

FAW may send service messages, such as enquiry confirmations, lead alerts, account notices, payment notices, and support messages, where the final workflow requires them.

FAW may send marketing messages only where permitted by law. Any commercial electronic message must use the confirmed consent, identification, and unsubscribe or opt-out process required for that message type.

[PLACEHOLDER — founder evidence and policy review: confirm the email and SMS providers; consent-capture wording and records; marketing audiences; unsubscribe mechanism; suppression-list process; and any exception relied on.]

10. Security

FAW will take reasonable steps to protect personal information from loss, unauthorised access, use, modification, disclosure, or destruction. The controls described in the final policy must reflect those actually in place.

[PLACEHOLDER — founder evidence and policy review: confirm access controls, authentication, encryption, secure-hosting measures, logging, monitoring, incident-response controls, vendor controls, backup arrangements, and who can access each data category.]

No online system can be guaranteed completely secure.

11. Privacy breaches

If FAW becomes aware of a privacy breach, it will assess, contain, investigate, document, and respond to the breach in accordance with its confirmed process and applicable law. Where required, FAW will notify affected people and the Office of the Privacy Commissioner.

[PLACEHOLDER — founder evidence and policy review: confirm the breach-triage process, assessment owner, notification process, breach register, evidence log, and escalation contacts.]

12. How long we keep personal information

FAW will keep personal information only for the period set in its approved retention schedule and for any longer period required or permitted for the relevant purpose, including legal, accounting, tax, complaint, fraud, security, and dispute needs.

[PLACEHOLDER — founder evidence and policy review: set and approve retention periods for homeowner leads; uploaded photos and documents; contractor applications, profiles, and rejected applications; payment and accounting records; invoices and tax records; complaints and disputes; support messages; inactive accounts; security logs; analytics data; Drippo conversations where applicable; backups; and deletion or de-identification processes.]

13. Access and correction

People may ask FAW for access to personal information it holds about them and may ask FAW to correct information they believe is inaccurate, incomplete, or out of date. Requests should be sent to hello@findawaterproofer.co.nz.

FAW may need to verify a requester's identity before responding. [PLACEHOLDER — founder evidence and policy review: confirm the access-and-correction request process, identity-verification method, response timeframes, exemptions, recordkeeping, and escalation owner.]

14. Deletion and profile removal

Homeowners and contractors may ask FAW to delete or remove personal information or a contractor profile by contacting hello@findawaterproofer.co.nz. FAW may need to retain some information where required or permitted by law or where necessary for an approved retention purpose.

[PLACEHOLDER — founder evidence and policy review: confirm whether homeowners have accounts, the deletion and profile-removal workflow, information that must be retained, the response process, and whether data export is available.]

15. Reviews, public content, children, and vulnerable users

If FAW enables contractor profiles, reviews, testimonials, job examples, or other public content, the relevant information may be publicly visible. [PLACEHOLDER — founder evidence and policy review: confirm which public-content features are enabled, consent requirements, moderation, removal, dispute, and appeal processes.]

FAW is not designed for use by children. [PLACEHOLDER — founder evidence and policy review: confirm whether an age limit, parental-consent process, or a specific vulnerable-user process is needed.]

16. Changes to this Privacy Policy

FAW may update an approved and published Privacy Policy from time to time. The final policy must state the effective date and the process FAW will use to notify people of material changes.

[PLACEHOLDER — founder evidence and policy review: confirm the change-notice process, version-control process, and whether consent will be sought again for material changes.]

17. Privacy questions and complaints

For privacy questions, access or correction requests, deletion requests, or complaints, contact FAW at hello@findawaterproofer.co.nz.

Postal address: [PENDING REGISTRATION/ADDRESS — insert confirmed address]

FAW will respond using its approved privacy-complaint process. If a person is dissatisfied with FAW's response, they may be able to contact the New Zealand Office of the Privacy Commissioner.

[PLACEHOLDER — founder evidence and policy review: confirm the complaint-routing process, response targets, evidence log, dispute escalation process, and the final Office of the Privacy Commissioner contact wording and link.]

18. Draft review and approval requirement

This document remains a draft. It is not legal advice and must not be published, linked in the application, shown in onboarding, or used in contractor or payment workflows until founder evidence and policy decisions resolve the outstanding items and approval is expressly recorded in docs/legal/LEGAL_IMPLEMENTATION_STATUS.md.