Privacy Policy

This page is provided for pilot transparency. In case of conflict, the latest version is the controlling version.

Last updated: 20 February 2026

This Privacy Policy explains how Small Bridge Ltd ("we", "us", "our") collects, uses, stores, and discloses personal information when you use the DeliveryMate platform at deliverymate.nz ("Platform").

We are committed to protecting your privacy in accordance with the Privacy Act 2020 (New Zealand) and the Information Privacy Principles (IPPs) contained within it.

1. Who We Are

The Platform is operated by Small Bridge Ltd, a New Zealand registered company. We have appointed a Privacy Officer to oversee personal information held by the Platform. If you have any privacy-related questions or requests, contact us at: admin@deliverymate.nz

2. What Personal Information We Collect

Providing personal information to us is voluntary. However, if you choose not to provide certain required information, you may be unable to register an account, access the Platform, or use specific features (such as requesting or fulfilling deliveries).We collect personal information that is reasonably necessary to operate the Platform. This includes:

2.1 Account Information

• Name and email address
• Password (stored as a secure hash — never in plain text)
• Role (Sender, Driver, or both)
• Account creation date and invite code used

2.2 Driver-Specific Information

• New Zealand driver licence declaration
• Vehicle type and description
• Warrant of Fitness (WOF) status declaration
• Insurance declaration
• Right-to-work declaration
• Stripe Connect account details (processed and stored by Stripe)

2.3 Delivery Request Information

• Recipient Information: Name and delivery address of the intended recipient (as provided by the Sender).
• Pickup and drop-off addresses
• Parcel description and size
• Requested delivery timing
• Bids, offers, and accepted prices
• Delivery status updates and completion records
• Photographs submitted as proof of pickup or delivery

2.4 Payment Information

• Payment transaction records (amounts, dates, status)
• Stripe customer and payment intent IDs
• Escrow status and payout records
• Card details are not stored by us — they are processed directly by Stripe

2.5 Communications

• Messages and notifications sent through the Platform between Senders and Drivers
• Emails sent to or received from admin@deliverymate.nz

2.6 Technical Information

• IP address and browser type (server logs)
• Session tokens (stored in your browser)
• General usage activity on the Platform

3. How We Collect Personal Information

We collect personal information:

• Directly from you when you register, create a delivery request, submit a bid, or contact us
• Automatically through server logs and session management when you use the Platform
• From Stripe when payment events are processed (via webhooks)
• From Google Maps Platform when you use the address autocomplete feature to enter pickup or drop-off locations

We do not collect personal information from third-party data brokers or social media platforms. We do not use cookies for tracking or advertising — see our Cookie Policy for details.

4. Why We Collect and Use Personal Information

We use your personal information for the following purposes:

• Account management — to register and authenticate you on the Platform
• Facilitating deliveries — to display delivery requests to Drivers and allow Senders to review bids
• Payment processing — to manage escrow, process payments via Stripe, and release funds to Drivers
• Platform operations — to maintain security, detect misuse, and administer the Platform
• Communications — to send you notifications about your delivery requests, bids, and account activity
• Legal and compliance — to comply with our legal obligations under New Zealand law
• Pilot improvement — to gather feedback and improve the Platform during the pilot phase

We do not use your personal information for direct marketing without your consent.

5. Who We Share Personal Information With

We share personal information only where necessary:

5.1 Between Platform Users

When a Sender and Driver form a Delivery Contract, we share relevant contact and delivery information (such as name, pickup address, and drop-off address) between those parties to enable the delivery to proceed.

5.2 Stripe

We use Stripe Inc. to process payments and manage Driver payouts via Stripe Connect. Stripe processes payment card data directly and is subject to its own privacy policy at stripe.com/nz/privacy. Stripe is certified to the PCI Data Security Standard.

5.3 Hosting and Service Providers

We use the following third-party providers to operate the Platform. Each may store or process personal data on servers outside New Zealand, primarily in the United States.

• Render — hosts our application and database servers in the United States. Your account data, delivery request details, and payment records are stored on Render's infrastructure. See render.com/privacy.
• Cloudflare — provides DNS and content delivery. Technical metadata such as your IP address may be processed at Cloudflare data centres globally, including in Australia. See cloudflare.com/privacypolicy.
• Resend — delivers transactional emails such as account notifications and delivery alerts. Your email address and notification content pass through Resend's infrastructure in the United States. See resend.com/legal/privacy-policy.
• Google Maps Platform — powers address autocomplete when you enter pickup or drop-off locations. Address input is sent to Google's servers, which may process it globally. See policies.google.com/privacy.

5.4 Legal Requirements

We may disclose personal information if required to do so by law, court order, or a lawful request from a New Zealand government authority.

We do not sell, rent, or trade personal information to third parties. We do not share personal information with advertisers.

6. Storage and Security

Personal information is stored in a PostgreSQL database. We apply reasonable technical and organisational measures to protect personal information from unauthorised access, loss, misuse, or disclosure. These measures include:

• Passwords stored as secure hashes (bcrypt)
• HTTPS encryption for all data in transit
• Session token authentication
• Access controls limiting database access to authorised systems only

No security system is completely impenetrable. If we become aware of a privacy breach that is likely to cause serious harm, we will notify affected individuals and the Office of the Privacy Commissioner as required under the Privacy Act 2020.

7. How Long We Retain Personal Information

We retain personal information for as long as necessary to:

• Operate your account and provide Platform services
• Comply with our legal obligations (including financial record-keeping obligations)
• Resolve disputes and enforce agreements

During the pilot phase, we will review retention periods before moving to full production. When personal information is no longer required, we will securely delete or anonymise it.

If you close your account, we will delete or anonymise your personal information within a reasonable period, except where retention is required by law.

8. Offshore Disclosure

Several of our infrastructure providers store or process personal information on servers outside New Zealand, primarily in the United States. Specifically:

• Stripe — payment processing, United States (PCI-DSS certified)
• Render — application and database hosting, United States
• Resend — transactional email delivery, United States
• Cloudflare — DNS and content delivery, global network including Australia
• Google Maps Platform — address autocomplete, United States and globally

Before disclosing personal information offshore, we take reasonable steps to ensure the recipient protects it in a manner comparable to New Zealand's Privacy Act 2020. Each provider above maintains industry-standard security certifications and publishes their own privacy policies and data processing agreements.

9. Your Privacy Rights

Under the Privacy Act 2020, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct any personal information that is inaccurate or out of date
• Complaint — complain to us about how we have handled your personal information

To exercise any of these rights, contact us at admin@deliverymate.nz We will respond within a reasonable time and in any event within 20 working days as required by the Privacy Act 2020.

If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz or by calling 0800 803 909.

10. Children's Privacy

The Platform is not intended for use by persons under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us and we will promptly delete it.

11. Links to Third-Party Sites

The Platform may contain links to third-party websites (such as Stripe). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing personal information to them.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your personal information, please contact:

Privacy Officer
Small Bridge Ltd
admin@deliverymate.nz