NewlyFound is run by NewlyFound Limited (company number 9463933, NZBN 9429054007628) from New Zealand, and follows the New Zealand Privacy Act 2020. This page covers three groups of people: studios and freelancers who use our accounts, businesses we research, and design studios we may contact. If you're unsure which applies to you, the short version is: we collect only what we need, we don't sell personal information, and you can ask us to correct or delete what we hold. Contact: hello@newlyfound.net.
If you have an account
What we collect. Your name, email address, and studio name (optional); the campaigns you set up and what they've done (businesses researched, opportunities, spend), the charges we've made and whether they've been paid, and your card's brand and last four digits (our payment provider keeps the card itself; we never see it); the opportunities we release to you, and the status, notes and outcomes you record on them; your password, stored only as a one-way hash, never in plain text; your profile (the kind of work you do, services, industries and places you're interested in, a link to your portfolio, and any notes you write); your profile picture and your work, if you add them: the pictures, the name and link you give each project, the details you tag it with (the work you did, and the client's industry and size), which pictures you've allowed businesses to see, and, once we've read your work, what we understood from it (such as the kinds of work, industries and style); the businesses you monitor (your clients and prospects), with any name, town and note you add, any snapshots we prepared for you before 31 October 2026, and the changes we see at those businesses; the messages you send us; if we've emailed your studio a sample Opportunity, the date you first opened its private page; and security records such as your IP address and the time of login attempts, used to block guessing attacks.
If you sign in with Google, we receive your name, email address and Google account ID from Google, and nothing else. We use them only to create your account and sign you in. We don't use them for advertising and don't share them. NewlyFound's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Why. To run your account, prepare and deliver your reports, run your campaigns and charge for them, choose opportunities that suit your profile and your work, and, if you've allowed it, show a business a few pieces of your work when we introduce you, improve how we assess businesses (using any won/lost feedback you choose to give us), send you reminders about opportunities you haven't followed up (you can turn these off in your account), tell you when a business you monitor changes (you can turn the email off), send you a monthly summary of your local market (you can turn this off too), keep the service secure, and reply to you. We don't show advertising on this site. How we count visits is under Cookies below.
Your work and your picture. Only you can see your picture and your work. We remove location, camera and other hidden details from pictures when you upload them. We don't publish your work or use it in our marketing. A business sees a picture only if you've marked it visible and agreed when it's first shown, on a private page when we introduce you. You can remove your picture or any of your work at any time. It's deleted straight away; pictures leave our backups within 5 weeks, and a project's other details within a year.
If your business appears in our research
What we hold. Information about businesses that is publicly available: the business name, location, website, and public contact details; what its public website and online presence look like, including screenshots; and our own assessments, scores and written notes about it. Some businesses are sole traders or partnerships, so this can be information about an individual.
Where it comes from. Public business listings (including Google Maps Platform), the business's own website and public social profiles, and public advertising records. We don't obtain it from private sources.
How it's used. To put together reports for design studios that suggest businesses which might want design help. A person reviews each opportunity before it's sent, and each opportunity goes to one studio at a time. When a report is built, we refresh the business's details from the source, and we drop businesses that have closed. We don't contact businesses on a studio's behalf; the studio decides whether to get in touch.
Businesses our customers monitor. A business can also come into our research because one of our customers monitors it, as their client or as a business they'd like to work with, so we can tell them when it changes. For these we read its public website, about once a day, and for customers on a paid plan we may also look for public news about it, such as an opening, new owners or a move. We never get round a website that asks not to be read. Changes go only to the customers monitoring that business; we never contact the business for them. Monthly market summaries contain counts only, never a business's name. The same choices below apply.
Your choices. You can ask us to remove your business at any time. We'll delete what we hold about it and stop researching it, keeping only a reference number on a do-not-research list so it isn't picked up again. You can also ask what we hold and ask us to correct it. A report already sent to a studio can't be recalled, and we'll tell you if yours was in one.
If you run a design studio and we contact you
We may email design studios and agencies about NewlyFound, using business contact details published on their own websites. We aim to keep this to a small number of relevant, plainly-written messages. Reply "no thanks", or write to hello@newlyfound.net, and we won't contact you again. We'll delete your contact details, except your studio's name and email address, which we keep on a do-not-contact list so that we never do.
AI processing
We use AI to help assess businesses' public websites. The website content and screenshots we analyse are sent to Anthropic, whose systems are based in the United States, through their API. Your account details are not sent for this. A person reviews every opportunity before it reaches a customer.
We also use AI to understand your own work, so we can find opportunities that suit it. If you give us your website when you sign up, text from its pages may be sent to Anthropic to suggest the industries you work in. If you add your work, each project's pictures, its name and the details you tag it with are sent to Anthropic to understand the kinds of work, industries and style. You'll see what we understood on your Portfolio page. Your name, email address, payment details and other account details are not sent. We don't use your work to train AI models.
Who else handles information
We use a small number of service providers to run NewlyFound: a cloud hosting provider for our servers, an email delivery service for messages such as account confirmations, a payment processor (Stripe) that holds the card you save and takes each charge, so we never see or store your card details, Google (Maps Platform for business listings, optional Google sign-in, and the fonts loaded on this site), Plausible (website visit counts, as below), and Anthropic (as above). They handle information only to provide that service to us. We don't sell personal information, and we share it otherwise only when the law requires.
Overseas storage and disclosure
Some of these providers operate outside New Zealand, so information may be stored or processed overseas, including in the United States. We choose providers that protect information to a standard we consider comparable to the Privacy Act, and we don't send more than they need. Your profile picture and your work are stored on our servers, and are sent to Anthropic in the United States only to understand your work, as described above.
Cookies and similar technology
We use one session cookie to keep you signed in and protect forms against forgery. It is essential to the service and we don't use it to track you. Your light or dark mode choice is saved in your own browser (local storage) and never sent to us. We load fonts from Google, so Google receives your IP address when a page loads. We use no advertising or analytics cookies. To see how many people visit our public pages, where they came from and how many sign up, we use Plausible Analytics, which doesn't use cookies or keep personal information: it counts visits and sign-ups in total, not people. It isn't used inside your account.
Security
Passwords are hashed, the site is served over HTTPS, and access to our systems is limited to the person running NewlyFound. No system is perfectly secure. If a breach is likely to cause you serious harm, we'll tell you and the Privacy Commissioner, as the Privacy Act requires.
How long we keep information
Account information stays while your account is open, and we delete it when you ask. We keep payment records for as long as tax and accounting rules require. For a business that asks to be removed, we keep only a record that the request happened and an identifier that prevents it being researched again. Research on other businesses is refreshed and cleared out over time as it becomes stale.
Your picture and your work stay while your account is open, until you remove them. When you remove them they're deleted straight away. Pictures leave our backups within 5 weeks, and a project's name, link and other details within a year; we keep backups only to restore the service if something goes wrong. If you close your account, we delete your picture and your work with it.
Your rights
You can ask to see the personal information we hold about you, ask us to correct it, and ask us to delete it. Write to hello@newlyfound.net. We'll respond within 20 working days. If you're not happy with how we've handled something, you can complain to the Office of the Privacy Commissioner.
Changes
If we change this policy in a way that matters, we'll update the date above and, for account holders, tell you by email.