Privacy policy

Last updated 22 October 2026

This page says what we hold about you and why, in the order you're likely to ask: if you just visit, if you ask for the free report, if you get in touch, and if you become a client. We don't sell your information, we don't use it for advertising, and we don't sign you up to a mailing list.

Who we are

The Boring Web Co Limited (company number 9461823), trading as The Boring Web Co. Our address is 155 Gulf Harbour Drive, Gulf Harbour, Whangaparaoa 0930, New Zealand. We follow the Privacy Act 2020. Craig is our privacy officer, and you can reach him at craig@boringweb.co.nz or on 027 831 6910.

If you just visit

• Cloudflare, which hosts this site, sees your IP address and basic browser details, as any web host does, to deliver the pages and block attacks.
• We count visits with Cloudflare Web Analytics and Umami. Neither sets cookies or identifies you. We also count taps on our phone number and email address, and form sends. Those counts carry nothing about who you are.
• The site sets no advertising cookies and carries no tracking pixels.
• Our Facebook page is run by Facebook, and its own privacy policy applies once you're there.

If you ask for the free report

The report form asks for the web address you want checked, your name, your business name, what you do, your town, and the email address to send the report to. The form uses Cloudflare Turnstile to check that a person is filling it in, which reads information from your browser, including your IP address.

We store the request in a database we run on Cloudflare, generate the report (it runs your site through Google's PageSpeed test, takes a picture of your home page, and searches Google for what you do in your town), and email it to you. Craig may then get in touch about what it found. We keep the request for 12 months after we last hear from you, then delete it, or sooner if you ask.

If you get in touch

The contact form asks for your name, email address and message. Your phone number, the kind of business you run, your website and the plan you're looking at are optional. It uses Turnstile the same way. What you send goes by email to our inbox, which Apple (iCloud) provides, and Craig replies from there. We keep an enquiry for 12 months after we last hear from you, then delete it, or sooner if you ask.

If you become a client

We keep your contact details, your agreement, the cover sheet that goes with it, and your invoices, to build and run your website and to bill you. The agreement and the invoices are kept for seven years, because Inland Revenue requires it.

You pay through Stripe, by card or from your New Zealand bank account. Stripe holds your payment details; we never see your card number. Stripe sends you the receipts, and for a bank account the notices its direct debit scheme requires. Stripe also uses what it collects for its own purposes, such as preventing fraud, under its own privacy policy.

The intake

Before we quote or write, we read what is public about your business online, such as your website, your Google listing and its reviews, and keep notes in your intake folder.

Before we build, you fill in a fact sheet about your business on our own site at intake.boringweb.co.nz, and you can upload your logo, photos, and recent enquiries from your customers. Please take your customers' names and contact details out of those enquiries before you send them. We read them only to learn what your customers ask; we never contact or name them, and we delete them once your site's words are written. The sheet and the uploads are stored in a database and file storage we run on Cloudflare.

Craig then records a conversation with you about your jobs and customers, with your consent, stated at the start of the recording, so we can quote you accurately. The recording is written out, with each speaker labelled, by a speech-to-text model running inside our own Cloudflare account. Only Craig and Emma listen to it. Anything you tell us about your staff or customers is used only to write your site, and we don't name them on it unless you agree by email. The recording, the transcript and the sheet are what your website is written from. We keep them while you're a client, and delete them within 90 days of your plan ending unless the law requires us to keep something or you ask us to keep them.

Reviewing your site

While we build and review your site, you and the people you nominate sign in to the working copy with a one-time code sent to your email, and leave comments on the pages. Signing in uses cookies from Cloudflare to keep you signed in. We hold those names, email addresses and comments while you're a client and delete them within 90 days of your plan ending.

Your customers' information

When someone fills in a form on your website, their details go straight to the email addresses you nominate. We don't store them. We count how many people visited, tapped your number or sent a form, without recording who they were. Under the Privacy Act, your customers' information is yours: we handle it only as your agent, only to run your site, and never for our own purposes, and we tell you as soon as we can if anything goes wrong with it in our hands. Your site carries its own privacy notice, which we write for you from what the site does.

Who else holds it, and where

Cloudflare hosts this site, our clients' sites and the databases and file storage behind them, on servers outside New Zealand, including in the United States. Apple (iCloud) provides our email. Stripe handles payments, through Stripe New Zealand Limited and its parent in the United States. Google runs the Search Console and Business Profile we set up in your name, and its PageSpeed test runs on the address you give us. Each of them holds information for us so we can run those services; each has its own privacy policy.

Seeing, correcting or deleting your information

You can ask us for a copy of what we hold about you, and ask us to correct it. Email craig@boringweb.co.nz. When we give you a copy, you can ask us to correct anything in it. The Privacy Act gives us 20 working days to respond, and we'll usually be much quicker. We'll delete it on request too, unless the law says we have to keep it, as with invoices.

If something goes wrong

If a privacy breach is likely to cause you serious harm, we'll tell you and the Privacy Commissioner, as the law requires.

If you're unhappy with how we've handled your information, tell us first and we'll try to put it right. If we can't, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this page

If we change how we handle your information, we'll update this page and the date at the top.