Privacy Policy

He Whare Ora is committed to protecting the privacy of tenants, operators, contractors and visitors. This Policy explains what personal information we collect, how we use it, and your rights under the New Zealand Privacy Act 2020 and equivalent overseas regimes (including the GDPR where applicable).

1. Information we collect

• Account data: name, email, phone, organisation, language preference.
• Tenancy data: property records, tenancy agreements, maintenance tickets, and communications uploaded by operators.
• Payment data: handled by Stripe; we receive a token and subscription status, never your full card number.
• Usage data: pages visited, device type, region (for analytics and security).

2. How we use it

• To provide, maintain and improve the Platform.
• To send transactional and service notifications (e.g. maintenance updates, invoices).
• To meet legal, tax and tenancy compliance obligations.
• To detect, prevent and respond to fraud, abuse or security incidents.

We do not sell personal information. We do not use tenant data to train third-party AI models.

3. Legal basis

We process information under the lawful bases of contract (to deliver the Platform you signed up for), legitimate interest (operating and securing the Platform), legal obligation, and consent (e.g. marketing emails, where required).

4. Sharing

We share information only with:

• Sub-processors: Supabase (database & auth), Stripe (payments), and email infrastructure providers — all bound by data processing agreements.
• Operators: tenant data is shared with the property operator that invited the tenant.
• Authorities: where required by law or to protect rights, safety or property.

5. International transfers

Data is primarily stored in regions chosen for proximity to New Zealand. Where data is transferred overseas, we ensure comparable protections through contractual safeguards.

6. Retention

We keep personal information only as long as needed to provide the Platform, comply with legal obligations (e.g. financial records), or resolve disputes. Tenancy records are retained for 7 years where required by New Zealand law. You can request earlier deletion subject to those obligations.

7. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Request deletion or portability of your data, subject to legal limits.
• Withdraw marketing consent at any time via the unsubscribe link in our emails.
• Lodge a complaint with the Office of the Privacy Commissioner (NZ) or your local data authority.

8. Tikanga & taonga

We recognise that whānau, hapū and iwi data is taonga. Where the Platform is used to manage papakāinga or kaupapa Māori housing, we work with the operator to apply appropriate kaitiakitanga and access controls.

9. Cookies & analytics

We use a minimal set of essential cookies for authentication and a privacy-respecting analytics tool to understand aggregate usage. We do not use advertising cookies.

10. Contact

Privacy questions or requests: mahi@coruscant.ch.