Privacy policy

This policy explains how Whiti Reo Limited (trading as “Mind Your Tongue”, GST 117-143-532) handles personal information for our online shop and the Waka Wetereo learning portal. We follow the Privacy Act 2020 and its 13 information privacy principles, including the indirect-collection principle (IPP3A) in force from 1 May 2026.

Who is responsible

Whiti Reo Limited, Aotearoa New Zealand, is the agency (data controller) for this information. Our Privacy Officer is the Director of Whiti Reo Limited, reachable at kiaora@mindyourtongue.co.nz.

Children and young people

The shop and Waka Wetereo are for people aged 13 and over. If you are under 18, you may only use the service with the consent and supervision of a parent or guardian, who accepts these terms on your behalf. We do not knowingly collect information from children under 13; if we learn we have, we will delete it.

What we collect and why

• Account details — email address and password (stored only as a salted hash). Needed to give you access to your account.
• Order details — name, email, phone, delivery address, items, amounts and GST. Needed to fulfil and invoice your order.
• Payment details — handled entirely by Stripe. We never see or store your full card number; we keep only Stripe's identifiers and the outcome.
• Learning records — course progress, last position, scores and time spent inside Waka Wetereo, so you can pick up where you left off and we can support you.
• Community posts — questions and answers you publish, plus the outcome of automated kindness/appropriateness screening.
• Security logs — sign-in successes, failures, IP address and browser description, kept to detect account takeover.

Every form that asks for your information explains at the time what it is for, so you are never surprised by what we hold. We do not sell personal information, we do not use it for advertising profiling, and we do not use your content to train AI models.

Information we receive from others

Some information reaches us indirectly rather than from you. Under IPP3A we tell you about it here:

• Google Maps address autocomplete — when you type an address at checkout, Google suggests matching addresses. The address you select comes from Google, not from you directly.
• Google Gemini (via Lovable AI) — community posts are screened automatically, and the moderation outcome (approved or flagged) is attached to your post by the screener.
• Password breach lists — new passwords are checked against lists of passwords exposed in known data breaches, and rejected if they appear.
• Stripe — payment outcomes (paid, failed, refunded) come from Stripe rather than from you.

Who we share it with

Only the processors we need to run the service: Stripe (payments), Supabase (database, auth and file storage), Lovable (hosting and transactional email), Google Maps (address autocomplete at checkout), and Google Gemini via Lovable AI (community content moderation). Each is bound by contract and by its own security and privacy commitments.

Some of these providers store or process data outside New Zealand — principally Stripe (United States and global), Google (United States and global), Supabase and Lovable (overseas cloud infrastructure). Before using an overseas provider we assess whether the information will be protected by comparable safeguards to the Privacy Act, and we rely on a combination of enforceable contractual protections, the provider's published security certifications, and encryption in transit and at rest. We only send each provider the minimum it needs to do its job (IPP12).

How long we keep it

• Sales and GST records: 7 years (Inland Revenue requirement).
• Account, learning and community data: while your account is open. When you delete your account it is removed from the live system immediately, and disappears from encrypted backups as they cycle (within about 30 days).
• Security and sign-in logs: 12 months.
• Automated moderation records: 24 months, kept so that moderation decisions can be reviewed and appealed, and so repeat abuse can be detected — then deleted.

Your rights

You can ask to see, correct, take a copy of, or delete your personal information at any time. Signed-in users can do this themselves from your account page, which produces an immediate machine-readable export and can delete your account on the spot. Otherwise email us: we answer access requests within the 20 working days allowed by the Privacy Act, and we action corrections and deletions as quickly as we reasonably can.

Security

Everything is served over HTTPS, encrypted at rest, protected by row-level database authorisation, and admin accounts require two-factor authentication. Read more on our security page.

Cookies

We use only what's needed to keep you signed in and to complete payments securely. We do not run advertising or cross-site tracking cookies.

• Sign-in session cookie — keeps you logged in to your account. Essential.
• Stripe cookies — set during checkout for payment security and fraud prevention. Essential.
• Google Maps — if you use address autocomplete at checkout, Google may set its own cookies under its privacy policy.

Complaints

Contact us first — we want to fix it. If you're not satisfied you can complain to the Office of the Privacy Commissioner (privacy.org.nz).