Privacy & Data Sovereignty

YourHQ is the trading name of Lian Tovine, sole trader, based in Whangārei, Aotearoa New Zealand. YourHQ is an agency under the Privacy Act 2020 and follows the thirteen Information Privacy Principles.

This policy covers:

• Personal information collected through yourhq.co.nz
• Personal information collected when you enquire, buy or become a client
• Personal information I handle while building and maintaining client websites

The Privacy Officer is Lian Tovine. Contact details are at the bottom of this page.

If you visit the website. Pages viewed, time on site, approximate location by region, device and browser type, and referring source. This comes from analytics and hosting logs. It is aggregated and I do not use it to identify you personally.

If you enquire or subscribe. Your name, email address, phone number, business name, and whatever you choose to tell me in the message.

If you become a client. Contact and business details, billing details, the content you send me for your site including text, images, logos and files, logins and access credentials for your existing platforms, your project correspondence, and your invoicing history.

If you do a Drive-Home Interview. An audio recording of the conversation and a text transcript of it.

If you buy something. Your name, email, billing address and the transaction record. I never see or store your full card number. Stripe handles that.

Sensitive information. I do not seek it and I do not want it. If your business is in a health, wellbeing or similar field, avoid sending me anything about identifiable patients or clients. If you do send it, I will delete it and tell you.

Mostly directly from you: forms, emails, texts, calls, interviews, shared drives, uploaded files.

Some of it I collect automatically when you use the site, through analytics and server logs.

Some of it I collect from public sources when I research your market or your competitors as part of an Audit or a build. That is public business information, not personal information dug out of anywhere private.

I use personal information to:

• Answer your enquiry and give you a quote
• Build, write, host and maintain your website
• Turn your Drive-Home Interview into website copy in your voice
• Research your market and competitors for an Audit or build
• Take payment and manage your subscription
• Send you service messages: invoices, renewal notices, outage notices, changes to terms
• Send you marketing emails, if you have opted in
• Meet my tax, accounting and legal obligations

I do not use your information for anything else without asking you first.

I do not sell personal information. Ever. To anyone.

The site uses cookies and similar technologies for three things: basic functionality, analytics that tell me which pages people actually read, and advertising measurement through Meta. Plausible, one of the analytics tools, is cookieless.

You can block or delete cookies through your browser settings, and you can opt out of advertising tracking through your browser or your Meta account settings. Some parts of the site may not work properly if you block cookies entirely.

This one deserves its own section, because it is the least ordinary thing I do.

The Drive-Home Interview is a conversation you have with an AI agent that speaks in a synthesised version of my voice. You start it deliberately, from a link, and you see a consent notice before you begin.

Here is exactly what happens:

• The conversation is recorded and transcribed
• The recording and transcript are used to write the copy for your website, and for nothing else
• The recordings are stored in my private logs, not published anywhere
• I do not clone your voice. The synthesised voice is mine, not yours. Your audio is never used to train, build or improve a voice model, mine or anyone else's
• I do not share the recordings with third parties for marketing
• Processing happens through ElevenLabs, which is based in the United States

Retention. Recordings and transcripts are kept for the duration of your project and for 12 months after your site goes live, so I can go back to your own words when I update your copy. After that they are deleted. You can ask me to delete them sooner and I will, as long as your copy is already written.

If you would rather not talk to an AI agent, the written intake form does the same job. Just say so.

I use AI tools in my work: to draft and refine copy, to help write code, to analyse research, and to run the Website Audit pipeline.

What that means for your information:

• Your business content and project material may be processed by AI tools as part of doing the work you hired me for
• I use business or enterprise tiers where the provider's terms say inputs are not used to train their public models
• I do not put customer lists, patient information, financial records or anything similarly sensitive into AI tools
• A human, me, reviews and approves everything before it reaches you or goes live
• AI does not make decisions about you. It drafts, and I decide

If you would prefer I did not use AI tooling on your project, tell me before we start and we will work out what is practical.

Most of the services above are based outside New Zealand, mainly the United States, Australia and the European Union. That means your personal information is stored and processed overseas.

Under Information Privacy Principle 12, I only disclose personal information to an overseas provider where that provider is subject to privacy safeguards comparable to those in the Privacy Act 2020, whether through the laws of their country, binding contractual commitments, or industry standard data processing agreements.

Overseas providers are subject to the laws of their own country, and in some circumstances a foreign authority may be able to compel access. That is the honest position for anyone using modern cloud infrastructure, and I would rather say it than pretend otherwise.

If you would like specific detail on any provider's arrangements, ask me and I will tell you what I know.

Real measures, not vague reassurance:

• Supabase databases use Row Level Security, so records are segregated and only accessible to the right account
• Multi-factor authentication on every account that supports it
• Passwords and credentials held in an encrypted password manager, never in plain text, never in email
• Data encrypted in transit with TLS, and at rest by the providers listed above
• Access limited to me, and to any subcontractor who genuinely needs it for a specific job
• Devices are encrypted and password protected
• Client logins you give me are used only for the work agreed, and I will ask you to rotate them at the end of a project

No system is perfectly secure. If something goes wrong, section 12 tells you what I do about it.

• Enquiries that go nowhere: 12 months, then deleted
• Client project material: for the life of the engagement and 12 months after it ends
• Voice recordings and transcripts: as set out in section 6
• Site backups: rolling, and 30 days after your subscription ends, then deleted
• Invoices, tax and financial records: 7 years, because the Tax Administration Act 1994 requires it
• Marketing subscribers: until you unsubscribe, plus a suppression record so I do not accidentally email you again

I do not keep information longer than I need it, except where the law says I must.

If there is a privacy breach that has caused, or is likely to cause, serious harm, I will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, as the Privacy Act 2020 requires.

I will tell you what happened, what information was involved, what I have done about it, and what you should do. I will not sit on it and hope.

Under the Privacy Act 2020 you can:

• Ask what I hold about you. Under Principle 6, I will confirm whether I hold personal information about you and give you access to it
• Ask me to correct it. Under Principle 7, if something is wrong, I fix it. If we disagree, I attach your statement of correction to the record
• Ask me to delete it, subject to records I am legally required to keep, mainly billing and tax
• Withdraw consent to marketing, or to voice recording, at any time
• Complain, if you are not happy with how I have handled it

Email lian@yourhq.co.nz. I will respond as soon as I can and within 20 working days at the latest. There is no charge for a reasonable request. I may ask you to confirm your identity first, which protects you, not me.

I only send marketing to people who asked for it.

Every marketing email has a working unsubscribe link and my contact details, as the Unsolicited Electronic Messages Act 2007 requires. Unsubscribing takes effect straight away.

Service messages, like invoices, renewal notices and outage alerts, are not marketing and continue while you are a client.

Important distinction, and worth getting right.

Your site's visitors are your responsibility. When someone fills in the enquiry form on your site or joins your email list, that information is collected by you, for you. You are the agency for that information under the Privacy Act. You need your own privacy policy on your own site, and I will help you get one there.

My role is technical. I host the infrastructure and I have technical access to it, so I handle that information on your behalf, on your instructions, and only to keep your site running. I do not use it, mine it, sell it, or add it to any list of mine.

If your site collects health information, financial information or anything similarly sensitive, tell me at the start so it can be built properly.

The website links to other sites. Once you are on someone else's site, their privacy policy applies, not mine. I have no control over how they handle your information.

The services are for businesses. The site is not aimed at children and I do not knowingly collect information from anyone under 16. If you think I have, tell me and I will delete it.

I work mainly with New Zealand businesses, but not only.

If you are in the European Union or the United Kingdom, you may have additional rights under the GDPR, including data portability and objecting to processing. Ask and I will do my best to honour them.

If you are in Australia, the Australian Privacy Principles may apply to some of what I do. Same answer: ask, and I will work with you.

Come to me first. Email lian@yourhq.co.nz and I will take it seriously and reply within 20 working days.

If you are not satisfied with how I have handled it, you can complain to the Office of the Privacy Commissioner:

I will update this policy when what I do changes. The current version is always on this page with the date at the top.

If a change materially affects how I handle your information, I will tell you directly rather than quietly changing the page.