Your privacy matters to us.

Information We Collect

Information you give us. When you contact us, we collect what you provide, typically your name, email address, phone number, business name and details of your project.

When you use the Scorecard. You give us your business name and website address and, if you choose to, the addresses of your Google Business Profile, Facebook, Instagram and LinkedIn pages. We check those public pages and produce scores and findings for you.

When you create a free Dashboard account. We collect your name, business name, email address and a password. Your password is stored only as a secure hash; we cannot read it. Your account holds your Scorecard results and history and anything you buy.

When you buy a Technical Review, additional Technical Reviews or a 90-Day Growth Plan. Payment is processed by Stripe, in Stripe's environment. When you pay, you are on Stripe's own page, and your card details are entered there and never reach Napa. Stripe's own privacy and cookie practices apply to what happens on Stripe's services: see the Stripe Privacy Policy and Stripe's Cookie Settings. Those links describe Stripe's practices on Stripe's services. They do not mean that Napa uses Stripe advertising or tracking cookies on napa-creative.com. We keep a record of what you bought, the amount in New Zealand dollars, the date and Stripe's payment reference. The reports and files we produce for you are stored privately and are available only to you and to Napa staff who need them to deliver and support your purchase.

Where you came from. When you arrive at our website we note, in your browser's local storage, the campaign details in the link you used (source, medium, campaign and content), the first page you landed on and the time. If you then create an account we copy those details into your account so we can understand which of our marketing is working. Until you register this stays only in your own browser, and you can remove it by clearing your browser data. If you would like it removed from your account, ask us.

Information collected automatically. Like most websites, ours collects some technical information when you visit, such as browser type, device, approximate location derived from your IP address, pages viewed and how you found the site. See "Cookies & Website Analytics" below.

How We Use Your Information

We use your information to run your Dashboard and produce your Scorecard results; to prepare and deliver the Technical Reviews and Growth Plans you buy; to take payment, issue receipts and handle refunds and support; to respond to enquiries and provide quotes; to understand which of our marketing is working and improve the site; and to meet our legal and tax record-keeping obligations.

Service emails. We will email you about your account, your results and your purchases. These are part of the service and are sent whether or not you have agreed to marketing.

Marketing emails. When you create an account you can tick an optional box to receive occasional tips and offers from us. It is not ticked by default and ticking it is not required to register or buy. We record that you agreed, when, and which wording you saw. Each marketing email will include an unsubscribe link, and you can also withdraw by emailing hello@napa-creative.com. Withdrawing never affects your account or your service emails.

We will never use your information for a purpose you wouldn't reasonably expect, and we won't use it to make automated decisions that affect you without a person being involved.

We Never Sell Your Data

Your information is not for sale.

We do not sell, rent, or trade your personal information to any third party, ever. We don’t run an advertising network and we don’t monetise visitor data. The only time your information leaves our hands is when it’s necessary to deliver our services to you (for example, our hosting provider or email platform), and those parties are bound by their own confidentiality and data protection obligations.

How We Keep Your Data Safe

We take reasonable technical and organisational steps to protect the information we hold from loss, misuse, unauthorised access, and disclosure. This includes:

• Secure hosting & encryption — our website and any data collected through it are hosted on secure infrastructure, with encrypted connections (HTTPS) throughout.
• Restricted access — only team members who need it to do their job can access your information.
• Trusted tools — the third-party platforms we use for email, forms, and project management are reputable providers with their own strong security and privacy practices.
• Regular review — we periodically review our data handling practices to make sure they still stack up. No system is 100% risk-free, but we treat your information with the same care we’d want for our own.

Cookies & Website Analytics

We do not use advertising cookies, marketing pixels or Google Analytics on this site. Visitors who are not logged in are not given any cookies by us.

We use Jetpack and WordPress.com site statistics, which count page views and measure performance using an image or beacon request to WordPress.com servers, without setting a cookie in your browser. These requests include the page address, your device and browser details and the page you came from.

If you log in to your Dashboard, WordPress sets the cookies that are strictly necessary to keep you signed in.

We store a small amount of information in your browser's local storage: the first-visit campaign details described under "Where you came from", and temporary information that lets you continue a purchase after signing in. You can clear these at any time through your browser settings.

Stripe. If you go on to pay, you leave our site and use Stripe's checkout. Stripe's own privacy and cookie practices apply there (see the links under "When you buy" above). That is separate from this website.

How AI Is Used

We use AI-assisted tools to analyse public information about your business and to help prepare your Technical Review and Growth Plan. Reports go through Napa's quality checks before they are released to you. For the live AI search testing in a Technical Review, we run test questions, which may include your business name and category, against AI platforms to see whether your business is mentioned. We give these tools the business details you provided and public information about your business. We do not give them your password, your payment details or your marketing preferences.

When We Share Your Information, and Who Handles It

We share your information only with the service providers who help us run the site and deliver what you buy, and they may use it only for that purpose. They include WordPress.com / Automattic (hosting, Jetpack statistics, image and file delivery, the email-list software on our site, and email sent by the site), Stripe (payment processing), our email provider (Titan) for our mailbox and enquiry emails, and the AI and analysis tools described above. When you open the Scorecard your browser also loads an open-source PDF library from Cloudflare's cdnjs service, which sees your IP address as any website host does.

Some of these providers process information outside New Zealand, including in the United States and Australia. We take reasonable steps to make sure they handle it in a way that is comparable to the protections in the New Zealand Privacy Act.

We otherwise share your information only if you clearly ask us to, if the law requires it, or if it is necessary to protect the rights, property or safety of Napa Creative & Co, our clients or the public.

How Long We Keep Your Information

We keep personal information for as long as we need it for the purposes described in this policy, and for as long as the law requires us to keep it. In practice:

• Purchase and invoice records are kept for at least seven years, because New Zealand tax and business record-keeping rules require it.
• Your account, Scorecard results, reports and acquisition details are kept while your account is open. If you ask us to delete your account, we will delete or de-identify this information, except what we are required or entitled to keep (for example purchase records, and a note of your deletion request itself).
• Marketing consent: we keep a record of your choice, and of any withdrawal, for as long as we need it to show that we have honoured it.
• Enquiry emails are kept for the life of the relationship and a reasonable period afterwards.

When we no longer need information and the law does not require us to keep it, we delete or de-identify it.

Your Rights Under the Privacy Act 2020

As a New Zealand business, we handle your personal information in line with the Privacy Act 2020 and its Information Privacy Principles. Under the Act, you have the right to:

• Ask us what personal information we hold about you.
• Ask us to correct that information if it’s wrong.
• Ask us to explain why we hold or use it.
• Make a complaint if you think we’ve mishandled your information.

You can correct your name, business and channel details in your Dashboard, and you can ask us to delete your account.

To make any request, email hello@napa-creative.com. We will respond as soon as reasonably practicable and within the timeframe the Act requires (generally 20 working days). If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner, which is independent of us and free to contact.

Changes to This Policy

We may update this policy from time to time, for example if our services or the law change. Any updates will be posted on this page with a new “last updated” date above. We encourage you to check back occasionally.