Privacy policy

This policy explains how Whiti Reo Limited (NZBN trading as “Mind Your Tongue”, GST 117-143-532) handles personal information for our online shop and the Waka Wetereo learning portal. We follow the Privacy Act 2020 and its 13 information privacy principles. Where learners are in the EU or UK, we also apply GDPR standards.

Who is responsible

Whiti Reo Limited, Aotearoa New Zealand, is the agency (data controller) for this information. Our privacy contact is kiaora@mindyourtongue.co.nz.

What we collect and why

• Account details — email address and password (stored only as a salted hash). Needed to give you access to your account.
• Order details — name, email, phone, delivery address, items, amounts and GST. Needed to fulfil and invoice your order.
• Payment details — handled entirely by Stripe. We never see or store your full card number; we keep only Stripe's identifiers and the outcome.
• Learning records — course progress, last position, scores and time spent inside Waka Wetereo, so you can pick up where you left off and we can support you.
• Community posts — questions and answers you publish, plus the outcome of automated kindness/appropriateness screening.
• Security logs — sign-in successes, failures, IP address and browser description, kept to detect account takeover.

We do not sell personal information, we do not use it for advertising profiling, and we do not use your content to train AI models.

Who we share it with

Only the processors we need to run the service: Stripe (payments), Supabase (database, auth and file storage), Lovable (hosting and transactional email), and Google Gemini via Lovable AI (community content moderation). Each is bound by their own security and privacy commitments. Some of these providers store data outside New Zealand; we only use providers with comparable protections.

How long we keep it

• Sales and GST records: 7 years (Inland Revenue requirement).
• Account, learning and community data: while your account is open, then deleted.
• Security and sign-in logs: 12 months.
• Automated moderation records: 24 months.

Your rights

You can ask to see, correct, take a copy of, or delete your personal information at any time. Signed-in users can do this themselves from your account page, which produces an immediate machine-readable export and can delete your account on the spot. Otherwise email us and we'll reply within 20 working days.

Security

Everything is served over HTTPS, encrypted at rest, protected by row-level database authorisation, and admin accounts require two-factor authentication. Read more on our security page.

Cookies

We use only what's needed to keep you signed in and to complete payments securely. We do not run advertising or cross-site tracking cookies.

Complaints

Contact us first — we want to fix it. If you're not satisfied you can complain to the Office of the Privacy Commissioner (privacy.org.nz).