Privacy Policy

1. Who We Are

BoundFor is a New Zealand-based service that provides school information, comparison tools, and personalized reports to help families make informed education decisions. We are committed to protecting your privacy and handling your personal information in accordance with the New Zealand Privacy Act 2020 and its 13 Information Privacy Principles.

Privacy Officer Contact:
Email: privacy@boundfor.nz

2. Information We Collect

Under Information Privacy Principle 1, we only collect personal information that is necessary for our legitimate purposes. We collect the following types of information:

2.1 Information You Provide Directly

• Account Information: Name, email address, and password when you create an account
• Profile Information: Location, number of children, children's ages, and education priorities during onboarding
• Payment Information: Billing details processed securely by our payment provider (Stripe) - we do not store your card details
• Communications: Content of emails or messages you send to us
• Feedback: Any feedback, suggestions, or bug reports you submit

2.2 Information Collected Automatically

• Device Information: Browser type, operating system, and device identifiers
• Usage Data: Pages visited, features used, and interaction patterns
• Log Data: IP address, access times, and referring URLs
• Cookies: See our Cookie Policy for details

2.3 Information from Third Parties

• School Data: Publicly available information from the Ministry of Education, Education Review Office (ERO), and other government sources
• Map Data: Geographic and commute information from Google Maps

3. How We Use Your Information

Under Information Privacy Principles 9 and 10, we only use your personal information for the purposes for which it was collected, or for directly related purposes. We use your information to:

• Provide, maintain, and improve our services
• Process payments and deliver purchased reports
• Personalize your experience with relevant school recommendations
• Send you transactional emails (order confirmations, password resets)
• Respond to your enquiries and provide customer support
• Detect and prevent fraud or abuse
• Comply with legal obligations
• Improve our services through analytics (with your consent)

4. Information Sharing and Disclosure

Under Information Privacy Principle 11, we do not sell your personal information. We may share your information with the following third parties who process data on our behalf:

We may also disclose your information if required by law, to protect our legal rights, or in response to a valid legal request from authorities.

5. International Data Transfers

Some of our service providers are located outside New Zealand, primarily in the United States. When we transfer your personal information internationally, we ensure appropriate safeguards are in place in accordance with Information Privacy Principle 12. These providers maintain security standards and privacy practices that are comparable to New Zealand requirements.

6. Data Security

Under Information Privacy Principle 5, we take reasonable steps to protect your personal information from unauthorized access, use, modification, or disclosure. Our security measures include:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing
• Row-level security on database tables
• Regular security reviews
• Access controls limiting who can view your data

However, no method of transmission over the Internet is 100% secure. During this beta period, we recommend not storing highly sensitive information in your profile.

7. Data Retention

Under Information Privacy Principle 9, we retain your personal information only for as long as necessary to fulfil the purposes for which it was collected:

• Account data: Retained while your account is active, deleted upon account closure
• Purchase records: Retained for 7 years for tax and legal compliance
• Generated reports: Available for download for 30 days after purchase
• Analytics data: Retained for 26 months (Google Analytics default)
• Server logs: Retained for 30 days

8. Your Rights

Under the Privacy Act 2020, you have the following rights regarding your personal information:

• Right to Access (IPP 6): You can request a copy of the personal information we hold about you
• Right to Correction (IPP 7): You can request correction of any inaccurate or incomplete information
• Right to Deletion: You can request deletion of your account and associated data
• Right to Withdraw Consent: You can withdraw consent for analytics at any time through our cookie preferences

To exercise these rights, please contact us at privacy@boundfor.nz. We will respond to your request within 20 working days as required by law.

9. Privacy Breaches

In the event of a privacy breach that poses a risk of serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020. If you become aware of any potential breach, please contact us immediately at privacy@boundfor.nz.

10. Children's Privacy

Our service is designed for parents and guardians to research schools for their children. We do not knowingly collect personal information directly from children under 16. The information about children (such as ages) that we collect is provided by parents/guardians for the purpose of providing relevant school recommendations.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us and Complaints

If you have any questions about this Privacy Policy or wish to make a complaint about how we have handled your personal information, please contact us:

Privacy Officer
Email: privacy@boundfor.nz

If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner at www.privacy.org.nz.