Privacy Policy

About This Privacy Policy

This Privacy Policy explains how Chattel Limited ("Chattel," "we," "our," or "us") collects, uses, discloses, and protects your personal information in accordance with the Privacy Act 2020 (New Zealand).

In this policy, "you" and "your" refers to an identifiable individual or other user of our platform or services.

By using our website or services, you agree to the collection and use of information in accordance with this policy.

Our Privacy Officer

We have appointed a Privacy Officer responsible for ensuring compliance with the Privacy Act 2020.

If you have any questions about this Privacy Policy or our privacy practices, please contact our Privacy Officer.

Information We Collect

Personal Information You Provide

We collect personal information that you voluntarily provide when you:

• Sign up for our waitlist (email address, feature requests)
• Create an account (name, email address, password)
• Write reviews (review content, property address, tenancy dates)
• Verify your tenancy (tenancy agreement details, address history)
• Upload photos or documents (property images, documentation)
• Contact us for support (name, email, message content)

If you provide us with personal information about another identifiable individual, you must ensure that you are entitled to disclose that information to us and that we are entitled to collect, use and disclose that information for the purposes described in this Privacy Policy.

Information Collected Automatically

When you use our services, we automatically collect:

• Technical data: IP address, browser type and version, operating system, device information
• Usage data: Pages visited, time spent on pages, links clicked, features used
• Location data: General location based on IP address (not precise GPS)
• Cookies and tracking: See our Cookie Policy below

Information From Third Parties

Where reasonable, we will collect your personal information only directly from you. We do not currently collect personal information from third parties. If this changes, we will update this policy and notify you.

How We Use Your Information

We collect and use your personal information only for the purposes disclosed at the time of collection or for purposes that are directly related. Specifically, we use your information to:

• Provide, maintain, and improve our rental review platform
• Send you updates about our launch, new features, and service announcements
• Verify your identity and tenancy information before publishing reviews
• Moderate content and maintain platform integrity
• Respond to your inquiries and provide customer support
• Detect, prevent, and address fraud, security issues, or technical problems
• Comply with legal obligations and enforce our Terms of Use
• Analyse usage patterns to improve user experience (aggregated and anonymised)
• Send you marketing communications (with your consent, which can be withdrawn at any time)

Disclosure of Your Information

We do not sell, rent, or trade your personal information. We may share your information in connection with any of the purposes set out in the How We Use Your Information section above as well as the following circumstances:

Public Information

• Reviews: Reviews you post will be publicly visible on our platform. You control what information you include in your review.
• Username/Display Name: Your chosen username will be visible with your reviews.
• Property addresses: Addresses of reviewed properties will be publicly searchable.

Service Providers

We share information with trusted third-party service providers who help us operate our platform:

• Hosting services: Supabase (database and authentication)
• Email services: [Your email provider] - for sending notifications and updates
• Analytics: [Your analytics provider] - for understanding platform usage
• Payment processing: [If applicable] - for handling subscription payments

All service providers are required to protect your information and use it only for the purposes we specify.

Legal Requirements

We may disclose your information if required by law or in good faith belief that such action is necessary to:

• Comply with a legal obligation or court order
• Protect and defend our rights or property
• Prevent fraud or investigate potential wrongdoing
• Protect the personal safety of users or the public

Business Transfers

If Chattel is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Secure authentication and password hashing
• Regular security assessments and updates
• Access controls limiting who can view personal information
• Employee training on data protection and privacy
• Incident response procedures

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

International Data Transfers

Your personal information may be stored and processed on servers located outside of New Zealand. Specifically:

• Cloud hosting: We use cloud-based database and authentication services which may store data on servers outside New Zealand
• Email services: Email communications may be processed through overseas servers
• Analytics services: Website analytics data may be processed by overseas service providers

We ensure that any overseas data transfer complies with the Privacy Act 2020 by:

• Only using reputable service providers with strong security practices
• Ensuring contractual protections are in place to safeguard your information
• Verifying that overseas jurisdictions provide comparable privacy protections, or implementing additional safeguards where necessary
• Maintaining the ability to access, correct, and delete your information regardless of where it is stored

Countries where your data may be processed: Data is stored on a database hosted in Sydney which is also where our hosting is done. Our marketing emails are hosted in Japan.

You have the right to request information about where your data is stored and the safeguards we have in place. Contact our Privacy Officer at privacy@chattel.co.nz for more information.

Privacy Breach Notification

Under the Privacy Act 2020, we are required to notify you and the Privacy Commissioner if a privacy breach occurs that is likely to cause serious harm to you. We will:

• Notify affected individuals as soon as practicable
• Describe the nature of the breach
• Explain what information was affected
• Provide steps you can take to protect yourself
• Outline what we are doing to address the breach

Your Privacy Rights

Under the Privacy Act 2020, you have the following rights regarding your personal information:

Right to Access

You can request access to the personal information we hold about you in accordance with our obligations under the Privacy Act 2020.

Right to Correction

You can request correction of any inaccurate, incomplete, or out-of-date personal information we hold about you.

To exercise any of these rights, contact our Privacy Officer at privacy@chattel.co.nz

How to Make a Privacy Complaint

If you believe we have breached your privacy rights:

1. Contact us first: Email our Privacy Officer at privacy@chattel.co.nz with details of your complaint
2. We will investigate: We will acknowledge your complaint within 5 working days and investigate thoroughly
3. We will respond: We will provide a written response within 20 working days (unless extended)
4. Not satisfied? If you're not satisfied with our response, you can complain to the Privacy Commissioner

Data Retention

We retain your personal information only for as long as we consider commercially reasonable to fulfil the purposes for which it was collected. We will retain your personal information for specific periods in the following circumstances:

• Account information: Retained while your account is active and for 2 years after account closure for legal compliance
• Reviews: Retained indefinitely (but anonymised if you delete your account) to maintain platform integrity
• Verification documents: Deleted immediately after verification is complete
• Communication records: Retained for 7 years for legal compliance
• Analytics data: Aggregated and anonymised after 2 years

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve your experience:

What are Cookies?

Cookies are small text files stored on your device when you visit our website.

Types of Cookies We Use

• Essential cookies: Necessary for the website to function (e.g., authentication, security)
• Performance cookies: Help us understand how visitors use our site (e.g., Google Analytics)
• Functionality cookies: Remember your preferences and settings

Managing Cookies

You can control cookies through your browser settings. Note that disabling cookies may affect website functionality. Visit www.aboutcookies.org for instructions.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will:

• Post the updated policy on this page
• Update the "Last updated" date
• Notify you of material changes via email or prominent notice on our website
• For significant changes, we may seek your renewed consent

We encourage you to review this Privacy Policy periodically.

Contact Information

For any questions about this Privacy Policy or our privacy practices, please contact our Privacy Officer using the details set out above.