Privacy Policy

1. Who we are

CoreHub Limited ("CoreHub", "we", "us" or "our") provides the CoreHub POS platform and the website at corehub.co.nz. We are a New Zealand company and we handle personal information in accordance with the Privacy Act 2020. This policy explains what we collect, why, and the choices you have.

2. Information we collect

We collect the following kinds of information:

• Account information — your name, email address, phone number, business name and login details when you register a shop or add staff.
• Billing information — your plan, billing history and payment details. Card details are handled by our payment processor and are not stored on our servers.
• Your business data — the customer, sales, stock, repair ticket and settings data you and your staff enter into the Service. This may include personal information about your customers (for example names, phone numbers and device details).
• Contact and enquiry details — what you send us through the contact form, email or phone, including your name, business, email, phone and message.
• Technical information — IP address, browser type, device and pages visited, collected through server logs and strictly necessary cookies (such as your login session).

3. How we use it

We use personal information to:

• provide, operate and secure the Service and your account;
• send transactional messages on your behalf (for example repair status texts and emailed invoices to your customers) when you or your staff trigger them;
• process subscription payments and send invoices and receipts;
• respond to enquiries and provide support;
• monitor performance, fix faults and improve the Service;
• meet our legal and tax obligations.

We do not sell personal information, and we do not use your business data for advertising.

4. Your customers' information

When you enter your customers' details into the Service you are the agency responsible for that information under the Privacy Act 2020 and we process it on your instructions as your service provider. You are responsible for telling your customers how their information is used, for having grounds to send them messages, and for responding to their requests to access or correct their information. We will help you do this where you need us to.

5. Cookies

The Service uses strictly necessary cookies to keep you logged in and to protect against cross-site request forgery. The marketing website does not use advertising or tracking cookies. Fonts are loaded from Google Fonts, which may receive your IP address when the page loads.

6. Sharing and third parties

We share personal information only with service providers who help us run the Service, and only to the extent needed for that purpose. These include our hosting provider (servers located in New Zealand), Cloudflare (content delivery and security), SMS and email delivery providers used to send the notifications you trigger, and payment processors used for subscription billing. Some of these providers may store information outside New Zealand; where they do, we take reasonable steps to ensure it is protected to standards comparable to New Zealand law.

We may also disclose information where required by law, to enforce our Terms, or to protect the rights and safety of CoreHub, our customers or others.

7. Security

We protect information with encryption in transit (HTTPS), hashed passwords, access controls, regular backups and monitoring. No system is completely secure, so please use a strong password, keep it confidential and remove access for staff who leave your business.

8. Retention

We keep account and business data for as long as your subscription is active. After you cancel we keep your data available for export for at least 30 days, then delete or anonymise it within a reasonable time unless we are required to keep it longer (for example, for tax records). Contact-form enquiries are kept for as long as needed to respond and follow up. Data entered into the shared demo shop is deleted from time to time without notice.

9. Your rights

You have the right to ask for access to, and correction of, the personal information we hold about you. You can update most account details yourself within the Service. To make a request, or to ask us to delete your account and data, email [email protected]. We will respond within 20 working days as required by the Privacy Act 2020.

If you are not satisfied with how we have handled your information you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and, for significant changes, notify account holders by email or within the Service.