Privacy policy.

What I collect

Only what the work needs.

I collect personal information when you deal with me directly - never quietly in the background. Specifically:

• Contact enquiries - your name, email and phone number where you give it, and whatever you type into the contact form.
• Client portal - your name and email for your login, plus the project files, drawings, photos and comments you upload while we're working together.
• Feasibility study orders - the site address and project details you enter, your contact details, and payment for the order (see "Who I share it with" below).
• Email correspondence - whatever we discuss by email while I'm working on your enquiry or project.
• Portal session cookie - stored server-side, in Cloudflare KV, purely to keep you signed in.

No tracking

No ad trackers on this site.

This site doesn't run Google Analytics, ad pixels, or any other third-party tracker. Nothing here watches what you do and reports it elsewhere. The list above is genuinely the whole list.

Why

To do the work, and not much else.

I use this information to design your project - drawings, consent documentation, correspondence with council - run the client portal, invoice you, and reply to whatever you send through. That's it.

Where it's stored

Cloudflare's global network.

The site's database, file storage and sign-in system all run on Cloudflare - a global hosting provider. That means personal information may be stored or processed on servers outside New Zealand as part of how that infrastructure works. Cross-border storage like this is specifically addressed by the Privacy Act 2020, which sets out the conditions it has to meet.

Who I share it with

A short list, and nothing beyond it.

Running the practice means a few other services touch your information. Here's the complete list:

• Cloudflare - hosting: the database, file storage and portal sign-in.
• Stripe - processes card payments for feasibility report orders. I never see your card number; Stripe handles that end entirely.
• Xero - invoicing and accounting.
• Resend - sends transactional email, like portal notifications.

Beyond those services, your project's own team sees what it needs to - the engineers, surveyors and drainlayers a job requires, and the council I lodge your consent with. That's part of getting the work designed and consented, not a separate use of your information.

Nothing else. No analytics companies, no advertisers, and I don't sell information to anyone.

How long I keep it

As long as the work needs.

I keep project records for as long as the project runs, and afterwards for as long as building-work records sensibly need keeping. Consent documentation especially has long-term value to you as the owner - it's the kind of thing worth having on hand years later, not something I delete the day a project wraps.

Your rights

Ask, and I'll sort it.

The Privacy Act gives you the right to ask what personal information I hold about you (Information Privacy Principle 6), and to ask for it to be corrected if it's wrong (Information Privacy Principle 7). Email dan@stoak.co.nz and I'll respond within the timeframes the Act requires.

Questions or concerns

Tell me first.

If you're unhappy with how your information's been handled, tell me first - dan@stoak.co.nz - and I'll do my best to put it right. If we can't resolve it between us, you can take it to the Office of the Privacy Commissioner, who handles privacy complaints in New Zealand.

This policy is written to meet the Privacy Act 2020. Last updated: 24 July 2026.