Privacy policy

This policy covers innovators.co.nz. It does not cover anything that happens in person .

Who we are

Innovators Creative. Phone 029 773 9085. Email kirstie@innovators.co.nz.

We are the agency responsible for personal information collected through this site. If you want to talk to someone about privacy, use the address above.

What we collect

Only what you type into our contact form, and only the fields we actually need to reply to you:

• Your name
• Your email address
• Your phone number — optional, and you can leave it blank
• Your message

That is the whole list. We don't ask for anything "just in case". There is nothing on this site for you to sign up to and nothing to pay for, so we never collect a password or a card number from you. Our own staff sign in to a separate area, described below.

If you go on to become a client, we also keep your contact details in that staff area. They are not collected through this website — you will have given them to us directly — but they are held on it, so they are described under our client records below.

Why we collect it

To read your enquiry and reply to it. That's the only purpose. We do not use your details for marketing, we do not add you to a mailing list, and we do not sell, rent or trade personal information to anyone.

What we don't do

This site carries no advertising tags and no tracking pixels. There is no Google Analytics, no Meta pixel and no third-party script of any kind. Nothing on this site follows you to other websites, and nothing about your visit is sent to another company.

We do count how many people read our pages. That happens entirely on our own server and is described under counting page views below.

We also deliberately don't use reCAPTCHA or a similar captcha service, because it would send information about you to an overseas provider. Instead our forms use a hidden field and a timing check that work entirely on our own server.

Cookies

One cookie, named ic_session, and only on pages with a form. It holds a random session identifier used to confirm that a form submission came from the page we served — a standard protection against a forged request being submitted on your behalf. It contains no personal information, it is not used to track you, and it is deleted when you close your browser.

The same cookie keeps our own staff signed in to the staff-only area described below. It still holds nothing but a random identifier.

Counting page views does not use a cookie, so there is no cookie banner on this site and nothing for you to accept or refuse.

Counting page views

We keep a simple count of how often each page is read, so we know which parts of the site are useful and when people are looking. It runs on our own server. Nothing is sent to an analytics company, and no information about your visit leaves us.

For each page view we record the date and time, which of our pages it was, and whether the visitor was using a phone, a tablet or a computer. If you followed a link from another website we record the name of that website — for example google.com — but never the page you came from, and never anything you searched for.

We do not store your IP address, and we do not set a cookie to count you. So that we can tell one visit from ten page views, we store a short scrambled code worked out from your connection and your browser. That code is rebuilt from scratch every day, so it cannot be used to recognise you tomorrow, it cannot be used to follow you over time, and it cannot be turned back into your address. It is not linked to your name, your email, or anything you have ever sent us.

We also count how many of our visitors are not people at all — search engines and AI assistants reading the site — because we would like to be found by both.

These counts are kept for up to 400 days, so we can compare one season with the same season a year earlier, and are then deleted automatically. Only our own management can see them, and what they see is totals — never one person's activity, because we do not hold it.

Our staff area

Part of this site is a password-protected area our staff sign in to. It is not open to the public and nothing you send us through the contact form appears in it.

For each staff account we hold a name, a work email address, a role, and the time of the most recent sign-in. Passwords are never stored — only a one-way cryptographic hash, which cannot be turned back into the password. Accounts are created and removed by our system administrator, and are deleted or disabled when someone no longer needs access.

If you are a staff member and want to see or correct what is held about your account, ask the site administrator, or use the contact details at the end of this page.

Our client records

If you become a client, we keep a record of you in that same staff area: the name we deal with you under, and whichever of an email address, a phone number and a website address you have given us. That is the whole list of personal details — there is nothing in it about you beyond how to reach you.

If we look after your website or domain, we also keep technical notes about it: who it is registered with, where it is hosted, who manages its DNS and email, and when those renew. That is information about your website rather than about you, but it sits on your record, so it is covered by everything on this page. We do not keep your passwords in it.

Alongside it we keep a record of the work we do for you: what each job is, a description of it, who here is carrying it, when it is due, and dated notes of what has happened on it. That is a record of the work rather than of you — but it is filed under your name, so we treat it as part of what we hold about you, and you can ask to read it like anything else on this page.

It is typed in by us, from what you have already told us in the course of doing business. Nothing on the public website adds anyone to it. Sending the contact form does not create a record, and there is no automatic collection of any kind behind it.

We keep it so we can find your details while we are working for you. It is not a mailing list, it is not used for marketing, and it is not shared with anyone outside Innovators Creative. Only our management can see it.

Our server logs

Our server keeps a short technical log so we can tell whether the site is working. It is written to record what happened, not what you submitted — it deliberately contains no names, email addresses, phone numbers or message text.

Your IP address is never stored in readable form. Where we need to recognise repeat requests from the same connection — to stop a bot flooding the contact form — we store a one-way salted hash of the address, which cannot be turned back into the original. Logs are automatically deleted after 30 days.

Who can see your enquiry

Your message is emailed to our own mailbox and read by the people here who handle enquiries. Beyond that:

• Our hosting provider operates the servers this website and its email run on, and can technically access what is stored there.

We don't disclose your information to anyone else unless you ask us to, or the law requires it.

Where your information is stored

This website is hosted on servers provided by Hostinger. Depending on the region our hosting is provisioned in, information you send through the site may be stored on servers outside New Zealand. Where that is the case, we rely on our provider's contractual commitments to protect it to a standard comparable to the Privacy Act.

How long we keep it

Enquiry emails are kept only while they are useful — long enough to deal with your enquiry and any follow-up — and are then deleted. Technical logs are deleted automatically after 30 days.

Client records are kept while we are working with you, and for seven years after that, because that is how long Inland Revenue requires us to be able to produce the business records behind our invoices. We review them and delete what is past that. This one is not automatic on purpose: a client's record is not something we would want a script quietly removing.

Keeping it safe

The site is served over an encrypted HTTPS connection. Form submissions are checked before they are accepted, our configuration and credentials sit outside the publicly reachable part of the server, and the log directory cannot be fetched over the web.

No website can promise perfect security, but we don't hold sensitive information here, and we don't keep more of it or keep it longer than we need.

Seeing or correcting your information

Under the Privacy Act you have the right to ask us what personal information we hold about you, to get a copy of it, and to ask us to correct it if it's wrong. Email kirstie@innovators.co.nz or phone 029 773 9085 and we'll sort it out. We may need to check who you are first. There's no charge, and we'll respond within 20 working days.

You can also ask us to delete an enquiry you've sent, and we will unless we need to keep it for a legal reason.

If you're not happy

Tell us first and we'll try to put it right. If you're still not satisfied you can complain to the Office of the Privacy Commissioner: privacy.org.nz, or 0800 803 909.

Changes to this policy

If we change how this site handles personal information, we'll update this page at the same time. This version was last reviewed on 24 September 2026.