Draft — being reviewed before launch

Privacy policy.

What we collect, why, who sees it, and your choices. Last updated 26 September 2026.

NewlyFound is run from New Zealand and follows the New Zealand Privacy Act 2020. This page covers three groups of people: studios and freelancers who use our accounts, businesses we research, and design studios we may contact. If you're unsure which applies to you, the short version is: we collect only what we need, we don't sell personal information, and you can ask us to correct or delete what we hold. Contact: hello@newlyfound.co.nz.

If you have an account

What we collect. Your name, email address, and studio name (optional); the plan or order you pay for and whether it's been paid (not your card details); the opportunities we release to you, and the status, notes and outcomes you record on them; your password, stored only as a one-way hash, never in plain text; your profile (the kind of work you do, services, industries and places you're interested in, a link to your portfolio, and any notes you write); the details of the orders you place; the messages you send us; and security records such as your IP address and the time of login attempts, used to block guessing attacks.

If you sign in with Google, we receive your name, email address and Google account ID from Google, and nothing else. We use them only to create your account and sign you in. We don't use them for advertising and don't share them. NewlyFound's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Why. To run your account, prepare and deliver your reports, confirm and invoice your orders, choose opportunities that suit your profile, improve how we assess businesses (using any won/lost feedback you choose to give us), send you reminders about opportunities you haven't followed up (you can turn these off in your account), keep the service secure, and reply to you. We don't run advertising or analytics on this site.

If your business appears in our research

What we hold. Information about businesses that is publicly available: the business name, location, website, and public contact details; what its public website and online presence look like, including screenshots; and our own assessments, scores and written notes about it. Some businesses are sole traders or partnerships, so this can be information about an individual.

Where it comes from. Public business listings (including Google Maps Platform), the business's own website and public social profiles, and public advertising records. We don't obtain it from private sources.

How it's used. To put together reports for design studios that suggest businesses which might want design help. A person reviews each opportunity before it's sent, and each opportunity goes to one studio. When a report is built, we refresh the business's details from the source, and we drop businesses that have closed. We don't contact businesses on a studio's behalf; the studio decides whether to get in touch.

Your choices. You can ask us to remove your business at any time. We'll delete what we hold about it and stop researching it. You can also ask what we hold and ask us to correct it. A report already sent to a studio can't be recalled, and we'll tell you if yours was in one.

If you run a design studio and we contact you

We may email design studios and agencies about NewlyFound, using business contact details published on their own websites. We aim to keep this to a small number of relevant, plainly-written messages. Reply "no thanks", or write to hello@newlyfound.co.nz, and we won't contact you again and will delete your contact details.

AI processing

We use AI to help assess businesses' public websites. The website content and screenshots we analyse are sent to Anthropic, whose systems are based in the United States, through their API. Your account details are not sent for this. A person reviews the results before they reach a customer.

Who else handles information

We use a small number of service providers to run NewlyFound: a cloud hosting provider for our servers, an email delivery service for messages such as account confirmations, a payment processor (Stripe) that handles card payments, so we never see or store your card details, Google (Maps Platform for business listings, optional Google sign-in, and the fonts loaded on this site), and Anthropic (as above). They handle information only to provide that service to us. We don't sell personal information, and we share it otherwise only when the law requires.

Overseas storage and disclosure

Some of these providers operate outside New Zealand, so information may be stored or processed overseas, including in the United States. We choose providers that protect information to a standard we consider comparable to the Privacy Act, and we don't send more than they need.

Cookies and similar technology

We use one session cookie to keep you signed in and protect forms against forgery. It is essential to the service and we don't use it to track you. Your light or dark mode choice is saved in your own browser (local storage) and never sent to us. We load fonts from Google, so Google receives your IP address when a page loads. We use no advertising or analytics cookies.

Security

Passwords are hashed, the site is served over HTTPS, and access to our systems is limited to the person running NewlyFound. No system is perfectly secure. If a breach is likely to cause you serious harm, we'll tell you and the Privacy Commissioner, as the Privacy Act requires.

How long we keep information

Account information stays while your account is open, and we delete it when you ask. We keep order and payment records for as long as tax and accounting rules require. For a business that asks to be removed, we keep only a record that the request happened and an identifier that prevents it being researched again. Research on other businesses is refreshed and cleared out over time as it becomes stale.

Your rights

You can ask to see the personal information we hold about you, ask us to correct it, and ask us to delete it. Write to hello@newlyfound.co.nz. We'll respond within 20 working days. If you're not happy with how we've handled something, you can complain to the Office of the Privacy Commissioner.

Changes

If we change this policy in a way that matters, we'll update the date above and, for account holders, tell you by email.