Your privacy.

This policy explains, in plain language, what personal information SmallPie collects, why we collect it, how we use and protect it, and the choices you have. We are a New Zealand studio and the New Zealand Privacy Act 2020 is our starting point. If you contact us from outside New Zealand, there is a short section for you near the end.

Who we are

SmallPie is a boutique web studio based in Auckland. When we say "we", we mean SmallPie and the contractors who work under our instructions. We are the agency responsible for the personal information described here. To reach us about anything in this policy, email info@smallpie.co.nz.

Information we collect

When you send a project inquiry

Our contact page runs a short guided inquiry and an indicative estimate calculator. When you use it, we collect the details you enter: your name, company, and email, and your answers about project type, scope, features, timeline, budget range, and a free-text description. We use those answers to produce an indicative estimate and to reply to you. Submitting the form sends this information to us by email so a real person can respond.

When we work together

• Contact and billing details for you and your team
• Project notes, preferences, and the content you share with us
• Limited credentials or access you provide so we can build or support your site, held securely and only for as long as needed

When you use the client portal

If we set up a client portal for your project, it stores your project details, invoices, shared files, and the account you sign in with. Authentication and that data are handled through Supabase (see processors below). We keep a session so you stay signed in; that session is stored in your browser and cleared when you sign out.

When you visit the site

• Basic technical information such as device, browser, and approximate location from your IP address
• Which pages you view, to understand what content is useful and to fix errors

When you pay an invoice

Payments are processed by Stripe. Your card details are entered directly with Stripe and are never seen or stored by SmallPie. We receive only the billing name, the amount, and whether the payment succeeded.

How and why we use it

• To reply to inquiries and prepare quotes, proposals, and invoices
• To design, build, host, and support the work we agree on
• To run the client portal and keep your account secure
• To keep the site fast, secure, and working, and to fix problems
• To meet our tax, accounting, and legal obligations

We ask for your consent before sending any marketing, or before publishing a case study that identifies you.

Who we share it with

We share personal information only where it is needed to run the studio and deliver your project. Our main service providers ("processors") are:

• Netlify for website hosting and delivery of inquiry-form submissions
• Supabase for the client-portal database and sign-in (authentication)
• Stripe for payment processing
• An email provider we use to receive inquiries and correspond with you

Each provider handles data under its own terms and security controls, and some process or store data outside New Zealand (see below). We do not sell your personal information, and we do not share it for advertising. We may disclose information if the law requires it, to protect our rights or users, or as part of a genuine business sale, in which case we would tell you if required.

Where your information is held

We are based in New Zealand. Some of our providers, including Supabase and Stripe, may store or process data on servers in other countries. When information is handled overseas, we rely on providers that offer recognised safeguards and contractual protections. If your project needs data kept in a particular region, tell us and we will do our best to arrange it.

Cookies

We keep cookies to a minimum. The public site uses only what is needed for it to work, such as remembering that the page loader has run and supporting smooth scrolling. The client portal uses a sign-in session stored in your browser. We do not currently run third-party advertising or cross-site tracking cookies. If we add analytics in future, we will update this section and ask for consent where the law requires it. You can block or delete cookies in your browser at any time and still email us directly.

How we protect and keep it

• Encryption in transit, and at rest where our providers support it
• Access on a least-privilege basis, limited to the people who need it
• We review the privacy and security posture of the providers we use

We keep project and account data for the life of the project and its support period, and billing records for as long as the law requires. When we no longer need information, we delete or anonymise it.

Your rights

Under the New Zealand Privacy Act 2020 you can ask us for a copy of the personal information we hold about you, and ask us to correct it. We will tell you what we hold, why we hold it, and who we share it with, and if we decline a request we will explain why unless the law prevents us. We aim to respond within 20 working days. If a notifiable privacy breach ever occurs, we will act and notify as the Act requires, including the Office of the Privacy Commissioner where appropriate.

• Request a copy of your data
• Ask us to correct your data
• Ask us to delete your data (we will delete what we can and keep only what the law requires, such as invoices)

If you are not happy with our response, you can contact the Office of the Privacy Commissioner.

If you are outside New Zealand

If you deal with us from Australia, the United Kingdom, the European Union, or elsewhere, we will honour the privacy rights your local law gives you, including, where they apply, rights to access, correct, delete, and object to certain uses of your data, and to withdraw consent. Tell us where you are based when you write to us so we apply the right rules. Where the UK or EU GDPR applies to you, we act as controller for the information described here and rely on your consent, our contract with you, and our legitimate interests in running the studio.

Children

Our services are for businesses and adults. We do not knowingly collect information from children. If you believe a child has given us information, email us and we will remove it.

Changes to this policy

We update this page when our practices change. If a change is significant, we will post a clear notice here, or contact you if we hold your email. The effective date at the top shows when this version took effect. If anything here is unclear, email info@smallpie.co.nz and we will explain it in normal language.