Privacy Notice

1. Who is responsible

Mimik Studios Ltd, New Zealand, trading as BUILDBY, collects and holds personal information for this website. Contact our privacy officer through Get in Touch and select “Privacy request”. You can use that form without an account. This notice explains our handling of personal information; it is not a waiver of rights or blanket consent to unrelated uses.

2. Information we collect

Account information includes your name, email, account role, password hash, sign-in and security records, settings, and the version, time and method of legal acceptance. Where enabled and chosen, Google sign-in supplies identity details needed to authenticate you. We do not receive your Google password.

Listing and business information can include your business name, NZBN, GST status, trade categories, region, approximate business-base coordinates and service radius if you choose to share them, services, prices, biography, portfolio, photos, reviews and verification details you submit. Private records may include enquiries, messages, attachments, quotes and acceptance records, job addresses and instructions, schedules, team membership and permissions, signatures, invoices, receipts, supplier or customer records, and manually entered payment information. BUILDBY does not process project payments or collect payment-card credentials.

We also receive support enquiries, complaints, reports, moderation decisions, marketing preferences and delivery records, and technical information such as IP-related security records, request times and logs needed to operate and protect the service. Identity documents submitted through the designated verification feature are used for the stated identity-review purpose, not public display. Customers are not required to upload identity documents for ordinary customer registration. Do not send identity documents through the general contact form.

If phone verification is enabled, we process your current phone number, verification status, request times, protected code-validation records and delivery outcomes. A verification SMS necessarily passes its destination and message through the authorised delivery device or provider and mobile networks. Phone verification is not a promise that someone’s identity, trade competence or trustworthiness has been established.

3. Where information comes from and why we use it

We usually collect information directly from you. We may also receive it from a customer, tradie, authorised team member, reviewer or complainant, from your chosen sign-in provider, or from relevant public business registers where checks are made. For example, a tradie may add a customer’s contact details or a team invitation may contain an employee’s email. Only supply another person’s information where you have a lawful basis and have given any required notice.

We use information to create and secure accounts; publish the listings you submit for publication; connect members; provide messaging and job administration; perform requested checks; send service notices; investigate complaints and misuse; maintain and improve the service; and meet lawful recordkeeping and other obligations. Marketing is handled separately as described below. We will not treat this notice as permission to use private job information for unrelated advertising.

Where information is collected indirectly, we will take reasonable steps to make the affected person aware of the collection, purpose, intended recipients, who holds it and their access and correction rights, as required by information privacy principle 3A, unless a lawful exception applies. Simply asking an uploader to comply does not remove our own obligations.

Required form fields are needed to provide the requested feature. You may decline optional information or checks, but some features or verification indicators may then be unavailable. We may need limited identity information to safely handle an access or correction request.

4. What other people can see

Published listings, portfolio images, reviews, public discussions and selected display details may be viewed by anyone, indexed by search engines and copied independently. Do not publish private addresses, identity documents, access codes or other unnecessary sensitive information. Removing content from BUILDBY cannot guarantee removal of copies outside our control.

Messages, shared contact details, job records and attachments are made available to the relevant participants and authorised team members according to the feature and access permissions. Calendar subscription links provide access to the information included in that feed: keep them private and revoke them if exposed. Check recipients and team access before sharing. A participant may retain a lawful copy of a shared agreement or conversation after your account closes.

Authorised administrators may access relevant records where reasonably needed for support, verification, moderation, security, dispute handling or legal compliance. Private messages are not represented as end-to-end encrypted or inaccessible to authorised operators. Identity documents are restricted rather than published on profiles. Tradies and customers may independently hold information you share with them and have their own privacy responsibilities.

5. Providers, disclosures and overseas processing

Cloudflare hosts the website and stores platform data and uploaded files. We also use Cloudflare Turnstile on signup, password-reset and contact forms to detect automated abuse. It processes technical browser and connection signals and verification tokens for that purpose; it is not used here for advertising. Resend processes email addresses and message content when email delivery is configured. Google processes sign-in information if you choose that enabled feature. Linked or embedded third-party content may receive connection information when your browser loads it. Where SMS verification is enabled, the authorised gateway and telecommunications providers process the destination, SMS content and delivery information needed to send it.

We may disclose relevant information to service providers acting for us, your intended recipients, professional advisers, or authorities where authorised or required by law, and where lawfully necessary to address fraud, security threats, legal claims or a serious threat to safety. We do not sell personal information or give members a right to harvest it for marketing. A business transfer would require lawful and appropriately limited handling of personal information and notice where required.

Providers may process or store information outside New Zealand. When an overseas provider acts only as our agent, we remain responsible for the information under the Privacy Act. Where a disclosure to a separate overseas recipient is covered by principle 12, we must have an applicable lawful basis, such as reasonable grounds to believe comparable safeguards apply. We do not rely on acceptance of these Terms as blanket consent to lower privacy protection.

6. Cookies, service messages and marketing

Essential cookies support sign-in, session protection and account security. Browser storage is used for preferences and some interface features. Disabling it may prevent those features working. Service messages can include verification, password resets, enquiries, reminders and security notices; delivery depends on the relevant provider and your contact settings.

Promotional emails require an applicable lawful consent basis and a working unsubscribe method. Our marketing preference records are separate from acceptance of the Terms. Unsubscribing from marketing does not stop necessary security or service messages. We will explain any materially different analytics or advertising tracking before introducing it and obtain consent where required.

7. Retention and deletion

We retain information only for as long as reasonably necessary for the purpose for which it may lawfully be used. The appropriate period depends on whether an account or job is active, whether records are needed for a dispute or security investigation, and legal recordkeeping requirements. Identity-document images require particular care: you can remove a submitted document using the available account controls or request removal, and we will assess any continuing lawful need separately from the verification outcome.

Request account closure or deletion through Get in Touch. We will explain any information that must be retained and why. Account closure does not automatically erase shared contractual records, another party’s lawful copies, or records subject to an applicable retention obligation. Restricted backups may take longer to expire and are not used for ordinary public display. We do not promise a particular backup capability or recovery time; retain your own important records.

8. Security and incidents

We use access controls and measures designed to protect personal information, including password hashing and restrictions on private records. No service is completely secure, and you should protect credentials, devices and shared links. Report suspected unauthorised access promptly through Get in Touch. We will investigate, take reasonable containment and recovery steps, and notify the Privacy Commissioner and affected people as soon as practicable where the Privacy Act requires notification of a breach that has caused or is likely to cause serious harm. Contractual liability wording does not remove these duties.

9. Access, correction and complaints

You may request access to personal information we hold about you and ask for correction. If we do not make a requested correction, you can ask us to attach a statement of correction. We may verify your identity proportionately and protect other people’s information when responding. We generally must make a decision on an access or correction request within 20 working days; any lawful extension or refusal will be explained. Contact the privacy officer through Get in Touch.

You may complain to us and to the Office of the Privacy Commissioner. We will notify material changes to this notice. A new use requiring further notice, authority or consent is not authorised merely by publishing different wording here.