What we do with your information, in plain words.

When you send the contact form, we receive:

• your first and last name;
• your email address;
• the answers you select — what you’re looking to build, your budget and your timeline;
• your brief — whatever you choose to write about the business and the project.

The brief is a free text box, so it may end up holding anything else you decide to include: a phone number, a company name, a link to your current site. Please only put in what you’re comfortable sending — there’s nothing we need beyond enough to understand the project and write back.

If you book a call rather than sending the form, the booking is handled by Cal.com. You give Cal.com your name, your email address and anything you add to the booking notes, and we receive those same details on the calendar invitation.

There are no accounts on this site, we take no payment details here, and we don’t buy contact lists or collect information about you from anywhere other than you (IPP 2).

Our web host, Vercel, keeps standard server logs: the usual request records, which can include IP addresses. We don’t use them to identify anyone, and we see only what Vercel’s own dashboard shows us. Vercel keeps them for [VERCEL LOG RETENTION — TO CONFIRM].

One purpose: to read your enquiry, reply to it, and — if it turns into a project — scope, quote and run that project (IPP 1). Nothing is collected “just in case”.

We don’t add you to a mailing list, we don’t run advertising, and we never sell, rent or trade personal information. If we ever wanted to use what you sent for something other than answering you, we’d ask first (IPP 10).

Nobody outside the studio reads your enquiry. Inside it, that means the two of us — Sujen and Dylan — and there is no sales list. We do not disclose personal information to anyone else (IPP 11), with these narrow exceptions:

• Resend, which carries the form submission from this site to our inbox and so handles the message in transit (their privacy policy);
• Apple, which provides the iCloud mailbox the resulting message is stored in;
• Vercel, which hosts the site and keeps the server logs described above;
• Google, which provides the analytics described further down;
• Cal.com, which runs the booking calendar if you choose to book a call;
• where the law requires it, or to establish or defend a legal claim.

All five of those providers are based in the United States and store data on servers outside New Zealand. Each one publishes a privacy policy and contractual data-protection terms that we rely on to meet the comparable-safeguards requirement in IPP 12. If you would rather nothing of yours left the country, email or call us instead of using the form.

We only hold personal information for as long as we actually need it for the purpose it was collected (IPP 9), then delete it.

• An enquiry that doesn’t become a project: kept for 12 months, then deleted.
• An enquiry that becomes a project: kept for the life of the project and then for seven years, because New Zealand tax and company record-keeping rules require business records to be held that long.

You can ask us to delete it sooner — see below.

Enquiries live in the studio email account, and only Sujen and Dylan have access to it. We take reasonable steps to protect it against loss, misuse and unauthorised access (IPP 5).

In practice that means two-factor authentication on the email and hosting accounts, unique passwords kept in a password manager and never reused, and full-disk encryption with a passcode on the machines the enquiries are read on.

This site uses Google Analytics to understand which pages people read and how they arrived. It records the pages you view, roughly where in the world you are, and what browser and device you used. It sets cookies and an identifier so repeat visits can be counted as one person instead of several.

We use it to decide what to write and what to fix. We don’t run advertising, we don’t build profiles, and we never connect analytics data to an enquiry you send us. Google processes this data in the United States.

You can opt out with Google’s browser add-on, or by blocking analytics in your browser or an extension. Nothing on this site stops working if you do.

We set no advertising cookies and carry no third-party advertising pixels.

Under the Privacy Act 2020 you can ask us to confirm whether we hold personal information about you and to give you a copy of it (IPP 6), and you can ask us to correct anything that’s wrong (IPP 7). Both are free.

You can also ask us to delete what we hold. The Act gives a right of access and correction rather than an absolute right to erasure, but in practice we’ll delete an enquiry on request unless we’re required to keep it — and we’ll tell you if that’s the case and why.

We’ll respond as quickly as we can, and no later than 20 working days after we receive your request, as the Act requires. If we can’t make a correction, we’ll attach a note of the correction you asked for to the information we hold.

Email hello@lycheeweb.co.nz with “Privacy request” in the subject line, or call +64 22 530 8438. Tell us what you’d like — a copy, a correction, or deletion.

We may need to check that you are who you say you are before releasing anything, so that we’re not handing someone else’s information to the wrong person.

Tell us first — most things are a misunderstanding we can fix quickly. If you’re still not satisfied, you can complain to the Office of the Privacy Commissioner, the independent regulator for privacy in New Zealand, at privacy.org.nz (opens in a new tab).

If how we handle personal information changes, we’ll update this page and change the date at the top. The version published here is always the current one.