We only collect personal information that is reasonably necessary for our functions and for providing the Service.

1.1 Information You Provide

We collect information you provide directly to us, including:

• Email address
• Nickname
• Password
• Contact number
• Region of residence (e.g., Auckland)
• Profile content (e.g., posts, listings, images)

Providing certain personal information is necessary to create an account and use key features of the Service. If you choose not to provide this information, some parts of the Service may not be available.

1.2 Social Login

If you register or log in using a third-party provider (such as Google), we may receive:

• Your unique provider ID
• Name
• Email address
• Profile image

1.3 Automated Information

We automatically collect certain technical information when you use our Service, including:

• IP address
• Device and browser type
• Access logs
• Cookies and similar technologies
• For business (microsite) owners: timestamps of your site-management activity — such as dashboard access, content edits, and publishing actions

We use the site-management activity timestamps to identify long-inactive business websites for maintenance, security, and the archiving process described in our Terms of Service, and to display a “last activity” indicator to site administrators.

1.4 Orders, Reservations and Enquiries on Business Microsites

When you place an order, make a reservation, or send an enquiry on a business microsite hosted on our platform (e.g., yourshop.udong.nz or udong.nz/site/…), we collect on behalf of that business:

• Name and contact number
• Email address (optional — used for order/booking notifications)
• Order or reservation details (items, amounts, date/time, party size) and request notes
• Payment status (e.g., paid by card, bank-transfer pending) and, for bank transfers, a deposit reference code — we do not collect or store card numbers (see Section 3)
• IP address (for abuse and fraud prevention)

1.5 AI Chat Consultations

If you use the AI chat widget on a business microsite, your chat messages and the AI responses are logged and made available to that business owner so they can follow up on your enquiry. Please do not include sensitive personal information in chat messages.

We use your information to:

• Operate, maintain, and provide the core features of the marketplace
• Manage U-Points, rewards, and paid promotions
• Operate the AI business-website builder, including maintaining, securing, and archiving long-inactive sites
• Deliver your orders, reservations, and enquiries to the relevant business owner, and send transactional notifications (e.g., order received, payment or deposit confirmed) to the email address you provide
• Verify identity and prevent fraud, abuse, or scams
• Communicate important service updates and respond to inquiries
• Improve the Service through internal analytics (using anonymised data where possible)
• Send service-related and, where permitted, marketing communications

You may opt out of marketing communications at any time.

We do not sell or rent your personal information.

We may disclose your information in the following circumstances:

3.1 Service Providers

We use trusted third-party providers for services such as hosting, analytics, payment processing, and email delivery. These providers may store or process data outside New Zealand.

We take reasonable steps to ensure that overseas recipients are subject to privacy protections comparable to those required under New Zealand law, including contractual safeguards where appropriate.

3.2 Business Owners (Microsite Orders and Chats)

Information you submit through a business microsite (orders, reservations, enquiries, chat messages — see Sections 1.4 and 1.5) is disclosed to the business owner concerned so they can fulfil your request. Each business is responsible for its own handling of that information once received.

3.3 Payment Processing (Stripe)

Card payments on business microsites are processed by Stripe under the payment account of the business you are paying. Your card details are entered directly on Stripe's secure checkout page — uDong Market never receives or stores your card number. We receive only the payment status and amount needed to update the order. Stripe may process data overseas; see Stripe's privacy policy for details. Bank-transfer payments are made directly from your bank to the business's bank account and are confirmed manually by the business.

3.4 AI Service Providers

The AI website builder and AI chat features send relevant business information (and, for chat, your messages) to the AI provider selected by the business — currently Google (Gemini), Anthropic (Claude), or OpenAI — under the business's own API account. These providers process data overseas, and free-tier AI services may use inputs to improve their models. Do not include sensitive personal information in AI chat messages.

3.5 Legal Requirements

We may disclose personal information if required to do so by law, court order, or where necessary to:

• Enforce our terms
• Prevent or investigate unlawful activity
• Protect the safety of users or the public

4.1 Retention

We retain personal information only as long as necessary to:

• Provide the Service
• Fulfil the purposes outlined in this policy
• Comply with legal obligations

Transactional and financial records may be retained for up to 7 years to comply with New Zealand tax and accounting laws.

Microsite orders and reservations: the personal details attached to microsite orders and reservations (name, contact number, email, request notes, IP address) are automatically anonymised 12 months after submission by default. Order amounts and statuses are retained in anonymised form for business statistics. AI chat consultation logs are limited to a rolling window of recent entries per business.

4.2 Deletion

You may request deletion of your account and personal data. Upon deletion:

• Your personal information will be removed or anonymised
• Some data may be retained where required for legal, fraud prevention, or safety purposes

We take reasonable technical and organisational measures to protect your personal information, including:

• Encryption (SSL)
• Access controls
• System monitoring

However, no method of transmission over the internet is completely secure.

Under the Privacy Act 2020, you have the right to:

• Request access to the personal information we hold about you
• Request correction of your personal information

To make a request, contact us using the details below.

We may require proof of identity before processing your request. We will respond within a reasonable timeframe as required by law.

We use cookies and similar technologies to:

• Keep you signed in
• Remember your preferences
• Understand how users interact with our Service

We may use analytics tools (such as Google Analytics) to improve our platform.

You can manage or disable cookies through your browser settings. Please note that some features of the Service may not function properly without cookies.

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children.

If we become aware that we have collected personal information from a child, we will take steps to delete it.

In the event of a privacy breach that is likely to cause serious harm, we will:

• Notify affected individuals
• Notify the relevant authorities

as required under the Privacy Act 2020.

If you believe we have breached your privacy rights, please contact us first so we can investigate.

If you are not satisfied with our response, you may contact the New Zealand Office of the Privacy Commissioner.

We may update this Privacy Policy from time to time. We will notify users of any significant changes by posting an updated version on our website.

If you have any questions, requests, or complaints about this Privacy Policy or our privacy practices, please contact:

Webtrain Co. (uDong Market)

Email: [email protected]

Location: North Shore, Auckland, New Zealand