Privacy Policy

Eversweet Limited ("Eversweet", "we", "us"), trading as Eversweet at 5D/119 Meadowland Drive, Somerville, Auckland 2014, collects some personal information in order to sell you dessert. This policy explains what we collect, why, who else sees it, where it is kept and what you can do about it. We handle personal information in line with the Privacy Act 2020.

You can order from Eversweet in two ways: through our mobile app, or through our website. Most of what follows applies to both. Where something applies to only one of them, the section is labelled "Mobile app only" or "Website only". Anything without a label applies wherever you order.

Ordering in the app needs an account, and the account holds:

• Your first name, last name, email address and phone number.
• Your password, which is stored only as a scrambled form that cannot be turned back into your password.
• A reference to your customer record with Stripe, our payment provider, if you have paid by card.
• Your Sweet Points balance and the record of points earned and spent that produces it.
• Your membership, if you have one: whether it is active, what its payment status is, and a reference to the subscription held by Stripe.
• Which offers you have unlocked or used.
• Whether you have chosen to be anonymous on the leaderboard.
• Which version of our Terms and Conditions and Privacy Policy you accepted when you created your account, and when you accepted it.
• A notification token for your device, if you allowed notifications. It identifies the app on your phone, not you.
• Short-lived codes when you verify your email address or reset your password. These are deleted once used and expire after 15 minutes either way.

The website has no customer accounts and no sign-in. You give us your name, email address and phone number at the checkout, and we keep them with that order so we can prepare it and contact you about it. Nothing carries over between website orders, and the website cannot show you your order history.

Wherever you order, we keep a record of the order itself:

• What you bought, any customisations, the quantities and what it cost, including GST.
• Whether it was to collect or to eat in, and the pick-up time you chose.
• The name, email address and phone number given for that order. These are stored with the order, so correcting your details later changes future orders rather than past ones.
• A reference to the payment, so that we can match it to your order and refund it if we need to.
• Any feedback you send us, which asks for your email address and optionally your name. Feedback is stored on its own and is not linked to an account.

It is worth being specific about this, because policies of this kind often claim more than the business does:

• We do not collect your home address. There is nowhere to put one, because we do not deliver.
• We do not collect your location. The app never asks for it.
• We do not use your camera, photos, contacts or microphone. The app asks for one permission, which is to send notifications.
• The app contains no advertising or analytics software of any kind, and we do not track you between apps or across the web.
• We never hold your full card number, expiry date or security code. Those go straight to Stripe.
• We do not buy personal information about you from anyone, and we do not sell yours.
• We do not send marketing emails, and we do not sell or share your details with anyone for their own marketing.

• To take, prepare and hand over your order, and to contact you about it.
• To take payment, and to release a hold or make a refund where one is due.
• To run your account, including signing you in and letting you reset your password.
• To run Sweet Points, the leaderboard, prizes, offers and membership, in the app.
• To answer your feedback or a question you have asked us.
• To keep accounting records and meet our tax obligations.
• To protect the shop and our customers from fraud and misuse, which includes limiting how often sign-in and code requests can be made from one address.

This is the one place where we show personal information publicly, so please read it. Each month we publish a leaderboard of customers by the Sweet Points they earned, and the previous month's top three appear in the app. That top-three list is served publicly: it can be read by anyone on the internet, not only by people signed in to the app.

• By default your first name and the initial of your last name are shown - "Aroha N.", for example. New accounts start this way.
• You can turn this off. Turn off "Show my name", on the leaderboard screen or in your account details - it is one setting, shown in both places - and your name is replaced with "Anonymous" everywhere customers can see it.
• The choice is applied on our servers, so while your name is hidden it is not sent to anyone's device at all.
• Copies of the public list are held briefly to keep the app quick, so your name can linger in one for a few minutes after you hide it, and on the screen of someone who already has the app open until the app next refreshes it.
• Our own staff still see real names, because somebody has to hand the right prize to the right person.
• Turning anonymity on does not affect your points, your ranking or your prize.

If you allow them, we send notifications about your own orders - when one is accepted, when the kitchen starts it, and when it is ready - when a prize has been assigned to you, a week before your Sweet Points are due to expire, three days before a membership you have cancelled ends, and when a membership renewal payment is declined. We also send one about the shop: a notification when a new offer becomes available, which for a members-only offer goes to members. That is the only message we send that is not about your own account or orders. You can turn notifications off in your phone's settings at any time, and the app keeps working without them. Signing out removes your device's notification token from our records.

The website uses very little of this, and the detail matters more than the usual blanket wording:

• We do not set any cookie of our own on customers. There is no customer sign-in on the website, so there is no session to keep. Your cart is held in your own browser's storage, not in a cookie, and never reaches us until you order.
• We use Vercel Web Analytics to count page views and see which pages are used. It does not use cookies and does not build a profile of you.
• Stripe sets its own cookies on the payment step, which it uses to detect fraud. Stripe's privacy policy covers those.
• Our staff sign-in area sets a session cookie, but only for staff.
• Because we set no tracking cookies, there is no consent banner to click through.

We use other companies to run parts of the service. They are allowed to use your information only to do the job we have given them:

• Stripe - payments, saved cards and memberships. Stripe receives your name, email address, phone number and the amount, and handles your card details directly.
• Resend - sends our emails: the code that confirms your email address, the code that resets your password, your order confirmation, a welcome email when you join the membership, and an email when you ask for your account to be deleted.
• Expo - delivers notifications to your phone, receiving the notification text and your device's token.
• Supabase - hosts the database that everything is stored in.
• Fly.io - runs the servers behind the app.
• Vercel - runs the website, and provides the page-view analytics described above.
• Cloudinary - hosts the images in our emails and on our menu. Opening one of our emails asks Cloudinary for those images, which tells Cloudinary your IP address, as opening any email with pictures in it would.
• We also share information where the law requires it, or to establish or defend a legal claim.

Your information is stored and processed outside New Zealand, and you should know where. Our database, and the servers behind the app, are in Sydney, Australia. Our website, payments, email and notification providers are based in or operate from the United States and other countries. We choose established providers who are required to protect information to a standard comparable to New Zealand's, but once information is held overseas it is also subject to the laws of those countries.

• Passwords are stored only as a bcrypt hash. Nobody at Eversweet can read your password, and we will never ask you for it.
• Password reset links are stored only as a hash, so a copy of our database could not be used to reset anyone's password.
• Verification and reset codes expire after 15 minutes and can be used once.
• Traffic between your phone or browser and us is encrypted.
• Sign-in, password reset and code requests are rate limited, by address and by account.
• Changing your password immediately invalidates sessions signed in with the old one.
• Names hidden from the leaderboard are removed on our servers, before they are sent anywhere.
• Our error messages and server logs deliberately leave out personal information.
• No system is perfectly secure, and we cannot guarantee that information sent over the internet is safe in transit.

We should be straightforward about this rather than say "no longer than necessary" and leave it there. We do not currently delete customer records on a schedule, and there is no automatic clear-out.

• Order records, including the name, email address and phone number given for the order, are kept indefinitely. We are required to keep business records that support our tax returns for seven years.
• Account details, Sweet Points and their history, memberships, leaderboard placings and prize records are kept while the account exists.
• Feedback is kept indefinitely.
• A cart you abandon is deleted 12 hours after you last touched it, and any points spent in it are returned to you.
• Verification and reset codes are removed when used and in any case expire within 15 minutes.
• If that is longer than you would like, you can delete your account - see section 16.

Under the Privacy Act 2020 you can ask to see the personal information we hold about you, and ask us to correct it if it is wrong.

• In the app you can already see your account details, your order history, your Sweet Points balance, your membership and your saved cards.
• In the app you can change your first name, last name, phone number and email address yourself.
• A new email address only takes effect once you enter the code we send to it, so that an account cannot be moved to an inbox its owner has never seen. We then email the old address to say it has changed.
• Corrections apply from then on. The name and contact details recorded against orders you have already placed stay as they were, because they are part of the record of that sale.
• If you ordered on the website as a guest, there is no account to look in - contact us with the order details and we will tell you what we hold.
• To ask for anything above, email eversweet@eversweet.co.nz. We will reply within 20 working days, as the Act requires.

You can delete your account in the app: open Account details and tap Delete account. We ask for your password, and the account is deleted seven days later, in the early hours of the day the app shows. Until then it works as normal and you can cancel the deletion in the app. We email you when you ask, so that you would know if someone else had. If you no longer have the app, email eversweet@eversweet.co.nz from the email address on your account, and we will schedule the deletion for you in the same way.

• When it is deleted we remove your account and its details, your Sweet Points and their history, your cart, your offers, your notification token, and your customer record with Stripe, which holds your saved cards.
• A membership stops renewing as soon as you ask, and ends when the account is deleted. The rest of that month is not refunded.
• If an order of yours is still being made or waiting to be collected on the day, the account is deleted the night after it is finished.
• We cannot remove the record of orders you have placed. We are required to keep records of our sales for tax purposes. We keep them with your name, email address and phone number removed and no longer linked to an account, so they are no longer identifiable as yours.
• Where you have appeared in a past month's leaderboard results, the placing stays on record but is no longer linked to you. Any prize not yet collected can no longer be claimed.
• Stripe keeps its own record of the payments you have already made, as payment providers have to. Ask Stripe about it; we will also ask them on your behalf if you prefer.
• If you ordered on the website as a guest there is no account to delete. Email eversweet@eversweet.co.nz and we will remove what we can by hand, within the limits above.
• New Zealand law gives you a right to ask for correction rather than a general right to erasure, but we will honour a deletion request as far as the records above allow.

Our app and website are not intended for children under 13, and we do not knowingly collect information from them. People aged 13 to 17 may use them only under the supervision of a parent or legal guardian, as our Terms and Conditions set out. We do not verify anyone's age. If you are a parent or guardian and believe a child under 13 has given us their information, contact us at eversweet@eversweet.co.nz and we will remove what we can. A parent or guardian of someone aged 13 to 17 can also contact us to see or correct what we hold about them.

We can update this policy. The date at the top shows when it last changed, and it changes only when the text does. If we make a change that materially affects how we use your information, we will say so in the app. We suggest reading it again if the date has moved since you last looked.

For anything in this policy, including a request to see, correct or delete your information, or a complaint about how we have handled it:

• Eversweet Limited, trading as Eversweet
• 5D/119 Meadowland Drive, Somerville, Auckland 2014
• Email: eversweet@eversweet.co.nz
• Phone: 09 949 1050
• If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.