Privacy Policy

This Privacy Policy describes how Flatchat (“we”, “our”, or “us”) collects, uses, and protects personal information when you use flatchat.co.nz (the “Site”). We are committed to protecting your privacy and complying with the New Zealand Privacy Act 2020.

By using the Site you acknowledge that you have read this Privacy Policy and consent to our collection and use of your information as described below.

1. Information we collect

We collect the following types of information:

• Account information. When you create an account we collect your email address and the display name you choose. Your email is used for authentication and is never displayed publicly.
• Review content. When you submit a property review we collect the text, ratings, and any other content you provide. Reviews are published publicly on the Site under your chosen display name.
• Technical and usage data. We automatically collect basic technical information when you visit the Site, including your IP address, browser type, operating system, referring URL, and pages viewed. We treat technical and usage data as personal information where it could reasonably be combined with other information we hold to identify you. We use it to understand how the Site is used and to improve it.
• Anonymised funnel events. We log anonymised funnel events (page views, button clicks, form submissions) on our own infrastructure to understand how the product is used. These events contain identifiers, counts, and a per-tab session ID, but never the content of your reviews, search queries, addresses, or any free-form text you have entered. We do not share this data with third parties.

2. How we use your information

• To create and manage your account and authenticate your access to the Site.
• To publish your reviews and display your chosen display name alongside them.
• To respond to questions or support requests you send to us.
• To monitor, maintain, and improve the Site.
• To detect and prevent fraud, abuse, or illegal activity.
• To comply with applicable legal obligations.

We will not use your personal information for purposes other than those described in this policy without first notifying you and obtaining your consent.

3. Third-party services

We use trusted third-party services to operate the Site. These providers process your information only as necessary to deliver their services to us and are not permitted to use it for other purposes.

• Supabase. We use Supabase for authentication and database storage. Your email address and account data are stored securely in Supabase’s infrastructure.
• Vercel. The Site is hosted on Vercel. Vercel may collect standard server access logs as part of hosting the Site.
• Google Maps and Street View. Property pages may display maps or street view images powered by Google. Your use of these features is subject to Google’s own privacy policy.
• Cross-border storage. Some of our service providers (including Supabase and Vercel) store data on infrastructure located outside New Zealand, including in the United States. Under the Privacy Act 2020, where a service provider holds personal information solely to process it on our behalf, the information remains our responsibility under the Act and is not treated as an overseas disclosure. These providers act as our agents; we do not authorise them to use your personal information for their own purposes. If we ever need to disclose your personal information to an overseas recipient for a purpose of their own, we will do so only where permitted by IPP12 of the Privacy Act 2020.

4. Public information

Reviews you submit, including your display name and the ratings and text you provide, are published publicly on the Site and may be indexed by search engines. Please do not include personal information about yourself or others in the content of your reviews.

5. Sharing your information

We do not sell or rent your personal information to third parties. We may share your information in the following limited circumstances:

• With third-party service providers as described in section 3 above.
• If we are required to do so by law, court order, or a request from a regulatory authority.
• To protect the rights, property, or safety of Flatchat, our users, or the public.
• In connection with a merger, acquisition, or sale of all or part of our business, in which case we will notify you before your information is transferred and subject to a different privacy policy.

6. Data retention

We retain personal information only for as long as we need it. Our current retention practice is:

• Account information. Retained for the life of your account. You can request deletion of your account at any time by emailing legal@flatchat.co.nz; we will action deletion requests within 30 working days, subject to any legal hold.
• Reviews. Retained while the property exists in our database. When an account is deleted, the displayed reviewer name is replaced with a neutral label (“Deleted User”) while the review content remains.
• Technical / usage logs. Our hosting providers (Supabase, Vercel) retain server and database logs per their own default retention policies, typically up to 30 days. We do not separately retain query-level logs.

Where we are required to retain information by law, or to preserve it for a complaint, investigation, or legal process, we do so for as long as the legal obligation applies.

7. Security

We implement reasonable administrative and technical measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. However, no internet transmission is completely secure. While we do our best to protect your information, you acknowledge that you provide it at your own risk and we cannot guarantee absolute security.

You are responsible for keeping your account credentials confidential and for any activity that occurs under your account.

8. Your rights

Under the New Zealand Privacy Act 2020 you have the right to:

• Access (IPP6). Ask whether we hold personal information about you and request access to it.
• Correction (IPP7). Request that we correct any personal information we hold about you that is inaccurate, incomplete, or out of date.
• Statement of correction (section 64). If we decline to correct information on request, ask us to attach a statement of the requested correction so that it is read alongside the disputed information.
• Make a complaint to the Office of the Privacy Commissioner at www.privacy.org.nz if you believe we have breached the Act.

To request access to information we hold about you, or to request correction, email legal@flatchat.co.nz. We will respond within 20 working days as required by the Privacy Act 2020.

Our designated Privacy Officer is Ryan Cole, contactable at legal@flatchat.co.nz.

9. Children’s privacy

Flatchat is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we become aware that a person under 18 has provided us with personal information, we will delete it as soon as reasonably practicable.

10. External links

The Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites and recommend you review their privacy policies before providing any personal information.

11. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. Your continued use of the Site after changes are posted constitutes your acceptance of the updated policy.

12. Contact us

If you have any questions or concerns about this Privacy Policy or how we handle your personal information, email legal@flatchat.co.nz.

13. Cookies and analytics

We use a small number of cookies and similar technologies to operate the Site. These currently include:

• Authentication cookies set by our authentication provider (Supabase) to keep you signed in and secure session data.
• Hosting and performance signals set by our hosting provider (Vercel), including any Vercel Analytics or Speed Insights data where enabled, to measure page performance.

We do not currently run advertising cookies or third-party behavioural-tracking pixels. If this changes in the future, we will update this section and the “Last updated” date above.