Kept · Legal
Privacy Policy
Effective: 2 July 2026 · Version 003
1. Who we are
Lino Architecture Ltd, 178 Old Coach Rd, Mahana 7173, New Zealand (NZBN 9429031884716). Privacy contact: hello@kept.build.
2. Information we collect
- Account data: name, email, password hash, organisation, trade/designation, professional registration number (e.g. LBP), contact details.
- Usage data: pages visited, feature interactions, device/browser, IP, timestamps.
- Content: anything you upload (photos, video, documents, records).
- Billing: handled by Paddle as merchant of record. We receive transaction metadata only — we never see full card numbers.
3. How we use it
To operate the Service, authenticate you, process payments, send transactional and invitation emails, improve features, prevent abuse, and meet legal obligations.
4. Sharing / sub-processors
We use:
- Lovable / Supabase — hosting, database, auth, storage
- Paddle — payments, tax, invoicing (paddle.com/legal/privacy)
- Google — optional sign-in
- Resend — transactional and invitation mail
- Plausible — privacy-friendly product analytics
- Microsoft Clarity — session analytics to diagnose UX issues
We do not sell personal data.
5. Invitations & contact data
When a builder or trade adds another person to a project, we send that person a clearly-attributed invitation email with an easy way to decline and opt out. We do not enrol invited people in marketing without separate consent. We do not auto-populate one user's personal contact details into another user's records from a global search — details are shared only by the person they belong to, when they join or accept a project.
People on a project (owner, builder, trades) are visible to other active members of the same project — name, role, company, and the contact details they've chosen to share — so the team on the job can coordinate. This visibility is scoped to that project only and ends when a member is removed.
6. Security
TLS in transit, encryption at rest, row-level security on all tables, principle of least privilege, MFA on admin accounts, regular security scans.
7. Retention
Account data is retained while your account is active and for 30 days after deletion (then permanently erased except where law requires longer, or where a record forms part of a property's Kept Record). Backups roll off within 90 days. If you delete your account, any Home Record you created remains with the property unless the current property owner also requests deletion.
8. Your rights
Access, correct, export, or delete your data by emailing hello@kept.build. We respond within 30 days. NZ residents can complain to the Office of the Privacy Commissioner (privacy.org.nz). EU/UK residents have GDPR/UK-GDPR rights including portability and the right to object.
9. Cookies
We use three categories of cookies and similar technologies:
- Essential — required to keep you signed in and to remember your consent choice. Always on.
- Product analytics (Plausible) — aggregate page views and feature usage. No cross-site tracking. Loaded only with your consent.
- Session replay (Microsoft Clarity) — records mouse movement, scrolls and clicks in your session to help us diagnose UX issues. Sensitive fields are masked. Loaded only with your consent.
On your first visit we show a banner that lets you accept, reject or manage the optional categories. You can change your choice at any time via the "Cookie preferences" link in the site footer.
10. Children
The Service is not directed to under-16s. We do not knowingly collect data from children.
11. Changes
Material changes notified by email at least 14 days before taking effect.
12. Contact
hello@kept.build