DayDrop Privacy Policy

This policy explains how Arman Oganesian, a sole trader in New Zealand trading as DayDrop ("DayDrop", "we", "us"), collects, uses, shares and protects personal information when you use the DayDrop app and website at daydrop.nz (together, the "Service"). We follow the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs).

1. Who we are and how to contact us

• •

  Agency: Arman Oganesian, a sole trader in New Zealand trading as DayDrop.

• •

  Privacy officer: Arman Oganesian, [email protected].

Contact the privacy officer with any question, request or complaint about your personal information.

2. What we collect directly from you

All users

• •

  Account details: email address, and your name and email from Google if you sign in with Google.

• •

  Profile: display name, profile photo (optional), phone number (optional), whether you are a buyer or vendor, notification preferences.

• •

  Device push token, so we can send notifications you have allowed.

• •

  Support chat messages you send us.

• •

  Reports you make about a listing or vendor, and the reason.

• •

  Technical data our providers log automatically, such as IP address, device type, app version, and timestamps.

Buyers

• •

  Reservations: what you reserved, quantity, amount, status, pickup time, what you took at pickup (including anything you did not take), and your pickup QR code (one per vendor).

• •

  Favourite vendors.

• •

  Your location, only if you allow it, to show drops near you. Location is used on your device to filter by distance and is not stored on our servers.

Vendors

• •

  Stall details: business or stall name, description, categories, address, map location, phone, photos, logo.

• •

  NZBN, if you choose to give it. It is shown on your public stall page (the Vendor Terms and the form say so).

• •

  Food Act 2014 details: registration type (Food Control Plan, National Programme or exempt), registration number, registering authority, expiry date, exemption reason, declarations you make, and (only if we ask for evidence) a photo of your registration certificate. While Food Act details are self-declared, the app does not ask for the certificate photo.

• •

  Deals you post, including photos, prices and quantities.

• •

  Reservations made at your stall and pickup records.

• •

  Billing details once paid plans begin. Payments will be handled by our payment provider; we will not store full card or bank account numbers.

Most of this is needed to provide the Service. If you do not provide required details (for example an email address, or Food Act details for categories that need them) you cannot use that part of the Service. Optional items are marked as optional in the app.

3. What we collect from other sources (IPP 3A)

• •

  NZBN register (Ministry of Business, Innovation and Employment): we do not currently look NZBNs up on the register; we show the number as the vendor entered it.

• •

  Food safety registers (MPI and councils): we do not routinely check vendors' Food Act details. We may look a vendor up on a public register by hand, for example after a complaint.

• •

  Google: if you sign in with Google, we receive your name, email address and Google account identifier.

• •

  Other users: a buyer may report a vendor or listing, and a vendor may record that a buyer did not collect a reservation.

If we collect information about you from someone else, we will tell you about it as required by IPP 3A, usually through this policy and in the app, unless an exception applies (for example the information is publicly available).

4. How we use your information

• •

  To create and run your account and sign you in.

• •

  To show listings, let buyers reserve and let vendors manage pickups.

• •

  To share the details needed for a pickup between the buyer and vendor (see section 6).

• •

  To show vendors' declared business and food safety registration details on their stall page, and to remind vendors before a registration expires.

• •

  To send notifications you have turned on (for example new drops from vendors you follow, reservation updates, support replies).

• •

  To respond to support requests and reports, moderate content, and prevent fraud, misuse and safety risks. This includes looking at a buyer's no-shows, items not taken at pickup and last-minute cancellations when deciding whether to limit their reservations for a while (Buyer Terms section 3).

• •

  To keep a blocked person off DayDrop: if we permanently block an account for listing prohibited products, we keep its email, phone number, NZBN and Food Act number and refuse new accounts or stalls that use them.

• •

  To bill vendors once paid plans start.

• •

  To understand how the Service is used and improve it (aggregate statistics, for example number of active vendors and reservations).

• •

  To comply with the law and respond to lawful requests.

We do not sell personal information and we do not use it for third-party advertising.

5. What is public

The following is visible to anyone using the Service, including people who are not signed in:

• •

  Vendor stall name, description, categories, photos, phone number (if provided), address and map location.

• •

  Deals and their photos.

• •

  The vendor's NZBN, if they provided one.

• •

  The vendor's Food Act registration type and number as they declared them (or that they declared an exemption, without the reason).

• •

  The vendor's exact stall address and map pin.

Vendors: if your stall is at your home, your address will be public. The exact address and map pin are always shown; there is no option to hide them. Do not include personal information you do not want public in descriptions or photos.

Buyer accounts are not public.

6. Who we share information with

• •

  Between buyers and vendors. When you reserve, the vendor you reserved with sees your display name, your profile photo if you added one, and the reservation details. Vendors do not see your email address, phone number or any other account details, and other vendors see nothing about you. Buyers see the vendor's public stall details.

• •

  Service providers who process information for us (section 7).

• •

  Authorities, where required or allowed by law, for example MPI or a council about a food safety concern, or the Police.

• •

  A buyer of our business, or the company that will take over DayDrop from the sole trader. We will tell you if this happens.

7. Service providers and overseas storage (IPP 12)

We use these providers to run DayDrop. Several are based or store data outside New Zealand.

These providers process information on our behalf and are not permitted to use it for their own purposes, except where their own terms allow limited use (for example Google and Apple for their own sign-in and push services). Where information is disclosed overseas in a way IPP 12 covers, we take reasonable steps to make sure it is protected in a way comparable to New Zealand law, including through contractual terms.

8. Security

We use access controls in the database so users can only see what they should, encrypted connections, restricted administrator access, and secrets kept outside the app. No system is perfectly secure. If a privacy breach is likely to cause serious harm, we will notify the Privacy Commissioner and affected people as the Privacy Act requires.

9. How long we keep information

10. Deleting your account

You can delete your account in the app under Account > Delete my account. You can also delete it at daydrop.nz/delete-account or ask us by emailing [email protected].

When you delete your account:

• •

  your account is closed straight away and can no longer be used. Your open reservations are cancelled and we stop sending you notifications. If you are a vendor, your stall is hidden and its drops and their reservations are cancelled;

• •

  for 30 days you can change your mind: sign in with the same email address or Google account and choose Restore my account. Your profile and stall come back (a stall stays closed if its Food Act registration number is now on another stall: contact support); cancelled reservations and drops stay cancelled;

• •

  after 30 days your account is deleted automatically. If you do not want to wait, choose Delete now and it is deleted straight away. A deleted account cannot be restored;

• •

  when the account is deleted, we remove your profile details (including your profile photo), push token, favourites and support chat, and, if you are a vendor, your stall, its details (including NZBN and Food Act details) and photos. Your sign-in record (email address and Google link) is deleted at the same time, and at the latest within 7 days;

• •

  we send a confirmation email when your account has been deleted.

Some records are kept without your contact details, for the periods in section 9: past reservations and reports (no longer linked to you), the activity log, the record of the Vendor Terms you accepted, and a blocklist entry if your account was permanently blocked. Encrypted backups expire on the schedule in section 9.

11. Your rights: access and correction

You can ask for a copy of the personal information we hold about you (IPP 6) and ask us to correct it (IPP 7). Contact the privacy officer. We will respond as soon as reasonably practicable and within 20 working days. Most profile and stall details can also be edited directly in the app.

If you are not happy with how we handle your request or your information, you can complain to the Office of the Privacy Commissioner at www.privacy.org.nz.

12. Notifications and messages

Push notifications are optional and controlled in the app and in your device settings. We send service messages (for example sign-in codes, reservation updates, account notices) as needed to run the Service. We will only send marketing email or messages with your consent, and every marketing message will include a way to unsubscribe.

13. Cookies and local storage

The app and website store your sign-in session on your device (app storage, or browser local storage on the web) so you stay signed in. We do not use analytics, advertising or third-party tracking cookies. Map tiles are loaded from the map provider, which receives your IP address.

14. Children

DayDrop is not intended for children. You must be at least 16 to create a buyer account and at least 18 to register as a vendor. If we learn we hold information about a child under 16, we will delete it.

15. Changes to this policy

We may update this policy. We will post the new version with a new date and, for significant changes, notify you in the app or by email at least 7 days before they take effect.