Privacy policy
We collect the least we can get away with: enough to take your money, send you your gear, and answer you when you write in. Nothing is sold, and nothing is handed to advertisers.
Last updated 23 September 2026
Who we are
Coast & Cast (Coast & Cast) runs this shop from Tauranga, New Zealand. We are an “agency” under the Privacy Act 2020 and this policy explains how we handle personal information.
What we collect, and when
| Placing an order | Name, email, delivery address, phone (if you give one) |
| Creating an account | Email, and a password we never see in readable form |
| Signing in with Google or Facebook | Your name and email from that account. We never receive your password |
| Joining the mailing list | Email address |
| Saving a search or a wishlist | Email address, or the items you saved |
| Offering us gear to buy | Name, email, phone, and what you wrote about the gear |
| Just browsing | Nothing that identifies you. See Cookies below |
We never see or store your card details. Payment happens on Stripe’s own page. Your card number never touches this site or our database.
Why we hold it
- To take payment, pack your order and get it to the right address
- To email you a receipt and a tracking number
- To answer you when you contact us, and to sort out returns or faults
- To keep the records the Inland Revenue and the Consumer Guarantees Act expect
- To send you the newsletter, if you asked for it
That is the whole list. We do not build profiles, we do not score you, and we do not use your information to decide what to charge you.
No tracking, no advertising pixels
This site runs no analytics and no advertising trackers. There is no Google Analytics, no Meta Pixel, no session recording, no heatmaps.
If that ever changes we will update this page and say so before turning anything on.
Who else touches it
Running a shop means using a few specialist services. Each one only gets what it needs to do its job, and none of them may use your information for their own marketing.
| Service | What it does | What it sees |
|---|---|---|
| Stripe | Takes the payment | Your name, email, address and card details |
| Supabase | Database and sign-in | Everything listed above except card details |
| Resend | Sends order emails | Your email address and the contents of the email |
| Vercel | Hosts and serves the site | Technical request logs |
| NZ Post or the courier | Delivers the parcel | Your name, address and phone number |
These services store data on servers outside New Zealand. Under the Privacy Act we only use providers that are required to protect your information to a comparable standard.
We will also disclose information where the law requires it — for example a court order, or a formal request from a government agency that is entitled to it.
Cookies and what your browser stores
| What | Why | How long |
|---|---|---|
| Your cart | So it survives a refresh. Stored in your browser, never sent to us until checkout | Until you clear it |
| Currency choice | So the site stays in NZ$ or A$ as you picked | One year |
| Sign-in session | Only if you have an account and are signed in | Until you sign out |
All of these are needed for the site to work. There are no advertising or analytics cookies, which is why you do not get a cookie banner.
How long we keep it
- Orders: seven years. Inland Revenue requires business records to be kept that long
- Account, wishlist, saved searches: until you ask us to delete the account
- Mailing list: until you unsubscribe. Every email has a one-click link
- Trade-in enquiries: twelve months, then deleted
Your rights
Under the Privacy Act 2020 you can ask us for a copy of the personal information we hold about you, and you can ask us to correct anything that is wrong. Both are free.
Email [hello@yourstore.co.nz] and we will reply within 20 working days, which is the limit the Act sets.
You can also ask us to delete your account and the information attached to it. We will do that, except for order records we are legally required to keep.
Keeping it safe
The site runs over HTTPS everywhere. Passwords are hashed, never stored in a form anyone can read. Access to the database is limited to the people who need it.
If something does go wrong and a breach is likely to cause you serious harm, we will tell you and notify the Office of the Privacy Commissioner, as the Act requires.
Privacy Officer
Questions, requests and complaints all go to the same place: [hello@yourstore.co.nz]
If you are not happy with how we handle it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Changes to this policy
If we change anything material we will update the date at the top and, where it affects how your information is used, tell you directly.
See also: returns and warranty · shipping