Privacy Policy

1. About this policy

This policy explains how The Elements Limited collects, uses, stores and shares your personal information when you use Op Spot. We handle personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles. We do not sell, trade or rent your personal information. “Personal information” means information about an identifiable individual.

Privacy Officer. We have appointed a Privacy Officer, who is responsible for this policy and for handling privacy enquiries and complaints. Contact: privacy@opspot.me.

The Elements Limited — company number 1129206, NZBN 9429036947294, registered office c/- Sothertons Limited, Level 1, 2 Heather Street, Parnell, Auckland 1052 — is the agency that collects and holds your personal information.

2. What we collect

• Account information: your name and email address.
• Profile information (optional): anything else you choose to add to your profile, such as a photo.
• User Content: photos, reviews, ratings and notes you submit about op shops, and your support correspondence with us.
• Location information: your device location, when you have granted permission, so we can show op shops near you and sort results by distance.
• Device and technical information: device and app information, and diagnostic data such as crash and performance data.
• Payment information (future): if we introduce paid features, payments would be processed by a third-party payment provider; we would not store your full card details.

3. How we collect it

We mainly collect personal information directly from you — when you create an account, build your profile, submit User Content, grant a permission, or contact us. When we collect personal information directly from you, we take reasonable steps to ensure you are aware of what we collect, why we collect it, who will receive it, that The Elements Limited is the collecting and holding agency, and that you have the right to access and correct it.

We may also receive information about an op shop from public sources or from a person claiming a Listing. If we collect your personal information indirectly (from someone other than you), we will take the steps the Privacy Act 2020 requires to make you aware of that collection.

4. Why we use your information

We use personal information to: create and manage your account; provide and operate the Service; show op shops near you; display and moderate User Content; respond to your enquiries and reports; keep the Service secure; understand and improve the Service; and meet our legal obligations.

5. App permissions

The App asks for your permission before it uses certain device features:

• Location (while using the app): to show op shops near you and sort results by distance. We request location only while you are using the App; we do not request background location.
• Camera: so you can photograph items you find at op shops to share.
• Photo library: so you can attach existing photos to listings and reviews.

You can change or withdraw these permissions at any time in your device settings; some features may not work without them.

6. Op shop listing information

Listing information (shop name, address, opening hours, photos) is about op shops, not usually about you. Where a person claims and manages a Listing, that information is provided by them. An op shop or charity may ask us to correct or remove its own Listing by contacting support@opspot.me.

7. Sharing your information

We do not sell your personal information. We share it only:

• with service providers who help us run the Service (such as hosting and IT providers), who may use it only to provide services to us and must protect it to a standard consistent with this policy;
• with a payment provider, if and when paid features are introduced, to process payments and resolve disputes;
• with professional advisers, or where we are required or authorised by law, or to respond to a lawful request from an enforcement agency or court; and
• if the Op Spot business is sold or merged, with the new owner, provided they are bound by privacy obligations consistent with this policy.

8. Where your information is stored

Your information is hosted with Supabase in the Asia-Pacific region. Your personal information may be stored on servers outside New Zealand. Where information is held overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those required under New Zealand law.

9. How long we keep it

We keep personal information only as long as we need it for the purposes described in this policy. As a general rule, we retain account and User Content data for up to five years after your last interaction with us, after which we delete it or de-identify it. Some records must be kept longer where the law requires — for example, financial and transaction records, which New Zealand tax law requires us to keep for at least seven years.

10. Security

We take reasonable steps to protect personal information from loss, misuse and unauthorised access — including using reputable hosting providers with industry-standard security and protecting data in transit. No system is completely secure, and we cannot guarantee absolute security.

11. Your rights

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to ask us to correct it. To exercise these rights, email privacy@opspot.me. We may need to verify your identity first. We will respond to access requests as soon as reasonably practicable, and no later than 20 working days after we receive the request. You can also delete your account and associated personal information from within the App at any time.

12. Children’s privacy

Op Spot is not intended for children under 13, and you must be at least 13 to hold an account. We do not knowingly collect personal information from children under 13; if we learn that we have, we will delete it. Please take care not to submit photos that identify a child without the consent of their parent or guardian.

13. Cookies and the website

The opspot.me website uses Google Tag Manager to load measurement and analytics tags, including Google Analytics and PostHog. These services may set cookies and collect usage information — such as the pages you visit, the approximate location derived from your IP address, and general device and browser information — to help us understand site traffic and improve the site. This information is processed by Google and PostHog as our service providers and may be stored on servers outside New Zealand (including in the United States); we do not use it to identify you personally. You can manage or block these cookies at any time through your browser settings. The App itself does not rely on website cookies.

14. Tracking

Op Spot does not track you across other companies’ apps or websites, and version 1 does not use third-party advertising or attribution SDKs. If this changes, we will update this policy and ask for your permission before any such tracking occurs — on iOS through Apple’s App Tracking Transparency prompt, and on Android in line with Google Play’s requirements.

15. Privacy breaches

If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable after we become aware of it, as required by the Privacy Act 2020.

16. Overseas visitors

If you use Op Spot from outside New Zealand, your information is still handled under this policy and New Zealand law. If you are in the European Economic Area or the United Kingdom, you may have additional rights under the GDPR / UK GDPR — including rights of access, correction, erasure, restriction, objection and portability. To exercise them, contact privacy@opspot.me. We rely on your consent and on our legitimate interests in operating the Service as the basis for processing.

17. Changes to this policy

We may update this policy from time to time. If we make a material change, we will give reasonable notice in the App and/or by email, and update the “last updated” date.

18. Complaints

If you have a privacy concern, contact our Privacy Officer at privacy@opspot.me. We take privacy complaints seriously and will deal with them promptly and confidentially. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner (privacy.org.nz).

App store compliance note: this policy is designed to meet Apple App Store Review Guideline 5.1.1(i) — it identifies what data is collected, how and why (clauses 2–5); confirms that any third party with access provides equal protection (clause 7); and explains retention and deletion and how to withdraw consent or request deletion (clauses 9 and 11). It is also structured to support the disclosures required by Apple’s App Privacy details and Google Play’s Data safety section.