Privacy Policy

1. About this policy

This policy explains how The Elements Limited collects, uses, stores and shares your personal information when you use Op Spot. We handle personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles. We do not sell, trade or rent your personal information. “Personal information” means information about an identifiable individual.

Privacy Officer. We have appointed a Privacy Officer, who is responsible for this policy and for handling privacy enquiries and complaints. Contact: privacy@opspot.me.

The Elements Limited — company number 1129206, NZBN 9429036947294, registered office c/- Sothertons Limited, Level 1, 2 Heather Street, Parnell, Auckland 1052 — is the agency that collects and holds your personal information.

2. What we collect

• Account information: your name and email address.
• Profile information (optional): anything else you choose to add to your profile, such as a photo.
• User Content: photos, reviews, ratings and notes you submit about op shops, and your support correspondence with us.
• Location information: your device location, when you have granted permission, so we can show op shops near you and sort results by distance. In the app, if you grant location, we also keep your most recent position on your profile so distance features still work when the app isn't actively locating — a single last-known point, overwritten each time, never a background trail. On the website we also work out your approximate location from your IP address — roughly the town or city, never a street address — so pages that show finds and shops near you can do that straight away, without asking you for permission first. We use it to decide what to show you and how far away it is; we do not store that IP-based location against you, and you can widen or turn off any distance filter on the page itself. Where you have granted the browser precise location, that is used instead.
• Notifications: if you turn on notifications in the app, a push token — a unique identifier for your device issued by Apple or Google — so we can send you the alerts you have asked for. We also record whether you have notifications turned on.
• Device and technical information: device and app information, and diagnostic data such as crash and performance data.
• Email updates sign-up (website): if you ask us to send you updates about op shops, we collect your email address and the date and time you gave that consent. We also record where you signed up, so the updates we send are about places you care about: the page you were on, the shop, region or route it relates to, the approximate country, region and city worked out from your IP address, the map area you were viewing, the website that referred you, and any campaign tags in the link you followed. If you tell us which area you shop in, or how far you are willing to travel for a good find, we record that too — as the name and centre of the town or suburb you chose, not your home address or your device's exact position — so we can send you finds near there.
• Payment information (future): if we introduce paid features, payments would be processed by a third-party payment provider; we would not store your full card details.

3. How we collect it

We mainly collect personal information directly from you — when you create an account, build your profile, submit User Content, grant a permission, or contact us. When we collect personal information directly from you, we take reasonable steps to ensure you are aware of what we collect, why we collect it, who will receive it, that The Elements Limited is the collecting and holding agency, and that you have the right to access and correct it.

We may also receive information about an op shop from public sources or from a person claiming a Listing. If we collect your personal information indirectly (from someone other than you), we will take the steps the Privacy Act 2020 requires to make you aware of that collection.

Some information is collected automatically when you submit a form on our website rather than typed by you — in particular the approximate location worked out from your IP address, the page you submitted from, the site that referred you, and any campaign tags in the link you followed. We use this to make the updates we send relevant to where you are and what you were looking at.

Setting your area when you sign up for updates. When you sign up for op shop updates on our website you may choose to tap Use current location. Only then does your browser ask for your device location, and only if you allow it do we receive it — you can sign up without this, and if you skip or decline it we simply send updates from everywhere. If you do allow it, we round the position to about one kilometre and store that rounded point together with the name of the nearest area we cover; we do not keep your exact position, and we do not track your location over time or in the background. We use it for one thing: to work out which finds are near enough to you to be worth sending, currently within 15 km.

4. Why we use your information

We use personal information to: create and manage your account; provide and operate the Service; show op shops near you; send you the op shop updates you have asked for, and work out which updates are relevant to you; send you the notifications you have turned on; display and moderate User Content; respond to your enquiries and reports; keep the Service secure; understand and improve the Service; and meet our legal obligations.

5. App permissions

The App asks for your permission before it uses certain device features:

• Location (while using the app): to show op shops near you and sort results by distance. We request location only while you are using the App; we do not request background location.
• Notifications: so we can alert you when an item on your wishlist turns up, or a shop near you has fresh finds. You choose what you are notified about, and can turn notifications off at any time in your device settings.
• Camera: so you can photograph items you find at op shops to share.
• Photo library: so you can attach existing photos to listings and reviews.

You can change or withdraw these permissions at any time in your device settings; some features may not work without them.

6. Email updates

You can ask us to email you updates about op shops — new stock, sales and finds — by signing up on our website. We only send these to people who have asked for them, and we confirm your address first by emailing you a link: nothing is sent until you tap it.

Confirming that link also creates a free Op Spot account for you at that email address, so you can sign in to the mobile app and save the shops you like. If you would rather have the updates without an account, email us at privacy@opspot.me and we will set that up.

To stop the updates, reply to any email we send you and tell us, or email privacy@opspot.me. We will take you off the list. Unsubscribing stops the updates; it does not delete your Op Spot account, which you can delete separately (see clause 12 below). We keep a record of addresses that have unsubscribed so that we do not email them again.

If you never confirm your address, we delete the sign-up — including the address — within 30 days.

7. Op shop listing information

Listing information (shop name, address, opening hours, photos) is about op shops, not usually about you. Where a person claims and manages a Listing, that information is provided by them. An op shop or charity may ask us to correct or remove its own Listing by contacting support@opspot.me.

8. Sharing your information

We do not sell your personal information. We share it only:

• with service providers who help us run the Service, who may use it only to provide services to us and must protect it to a standard consistent with this policy. These include Supabase (hosting and database), Vercel (website hosting), Resend (sending the emails you have asked for), Cloudflare (protecting our forms from automated abuse), Expo (delivering push notifications to your device, via Apple and Google) and Google and PostHog (measuring how the website is used);
• with a payment provider, if and when paid features are introduced, to process payments and resolve disputes;
• with professional advisers, or where we are required or authorised by law, or to respond to a lawful request from an enforcement agency or court; and
• if the Op Spot business is sold or merged, with the new owner, provided they are bound by privacy obligations consistent with this policy.

9. Where your information is stored

Your information is hosted with Supabase in the Asia-Pacific region. Some of our service providers — including our website host, our email delivery provider and our form-protection provider — process information on servers outside New Zealand, including in the United States and the European Union. Where information is held or processed overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those required under New Zealand law.

10. How long we keep it

We keep personal information only as long as we need it for the purposes described in this policy. As a general rule, we retain account and User Content data for up to five years after your last interaction with us, after which we delete it or de-identify it. Some records must be kept longer where the law requires — for example, financial and transaction records, which New Zealand tax law requires us to keep for at least seven years.

Sign-ups for email updates that are never confirmed are deleted within 30 days. If you unsubscribe, we delete the sign-up record but keep a minimal record of your email address on a suppression list, so that we do not email you again by mistake.

We keep your device push token while you have notifications turned on; if you turn them off, or the token stops working, we delete it.

11. Security

We take reasonable steps to protect personal information from loss, misuse and unauthorised access — including using reputable hosting providers with industry-standard security and protecting data in transit. No system is completely secure, and we cannot guarantee absolute security.

12. Your rights

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you, and to ask us to correct it. To exercise these rights, email privacy@opspot.me. We may need to verify your identity first. We will respond to access requests as soon as reasonably practicable, and no later than 20 working days after we receive the request. You can also delete your account and associated personal information from within the App at any time.

If you signed up for updates on our website and do not use the App, you can ask us to delete your sign-up and any account created with it by emailing privacy@opspot.me.

13. Children’s privacy

Op Spot is not intended for children under 13, and you must be at least 13 to hold an account. We do not knowingly collect personal information from children under 13; if we learn that we have, we will delete it. Please take care not to submit photos that identify a child without the consent of their parent or guardian.

Our website sign-up forms are not intended for children under 13. If you believe a child under 13 has given us their email address, contact privacy@opspot.me and we will delete it.

14. Cookies and the website

The opspot.me website uses two measurement services — Google Analytics 4 and PostHog — to understand how the site is used. They may set cookies and collect usage information, such as the pages you visit, the approximate location derived from your IP address, and general device and browser information. For ordinary visitors this is not tied to a named person: we deliberately configure PostHog not to build a personal profile for visitors who are not signed in, and we do not record your screen or your session. If you sign in to the shop console, the actions you take there are linked to your account so we can support you and see which tools are being used. This information is processed by Google and PostHog as our service providers and may be stored on servers outside New Zealand (including in the United States). You can manage or block these cookies at any time through your browser settings. The App itself does not rely on website cookies.

Shop pages show a few recent Google reviews, and Google’s terms require us to display each reviewer’s name and profile picture alongside their review. Those pictures are loaded directly from Google’s servers when the page opens, which means Google receives your IP address and browser details, in the same way it would if you visited a page on Google. We set the page to withhold which Op Spot page you were looking at. We do not send Google anything about you ourselves, and these images set no cookies for us. If you follow one of the review links through to Google Maps, you are then on Google’s site and their privacy policy applies.

15. Tracking

Op Spot does not track you across other companies’ apps or websites, and version 1 does not use third-party advertising or attribution SDKs. If this changes, we will update this policy and ask for your permission before any such tracking occurs — on iOS through Apple’s App Tracking Transparency prompt, and on Android in line with Google Play’s requirements.

16. Privacy breaches

If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable after we become aware of it, as required by the Privacy Act 2020.

17. Overseas visitors

If you use Op Spot from outside New Zealand, your information is still handled under this policy and New Zealand law. If you are in the European Economic Area or the United Kingdom, you may have additional rights under the GDPR / UK GDPR — including rights of access, correction, erasure, restriction, objection and portability. To exercise them, contact privacy@opspot.me. We rely on your consent and on our legitimate interests in operating the Service as the basis for processing.

18. Changes to this policy

We may update this policy from time to time. If we make a material change, we will give reasonable notice in the App and/or by email, and update the “last updated” date.

19. Complaints

If you have a privacy concern, contact our Privacy Officer at privacy@opspot.me. We take privacy complaints seriously and will deal with them promptly and confidentially. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner (privacy.org.nz).

App store compliance note: this policy is designed to meet Apple App Store Review Guideline 5.1.1(i) — it identifies what data is collected, how and why (clauses 2–6); confirms that any third party with access provides equal protection (clause 8); and explains retention and deletion and how to withdraw consent or request deletion (clauses 10 and 12). It is also structured to support the disclosures required by Apple’s App Privacy details and Google Play’s Data safety section.