Privacy Policy

How we handle your information

Last updated: 4 September 2026

Who we are

Webisto Tech Limited (NZBN 9429046262523) is a web design, hosting and e-commerce company based in Rolleston, Selwyn, New Zealand. In this policy, "we", "us" and "our" refer to Webisto Tech Limited.

What we collect

What we collect depends on how you use this website:

  • Contact form — your name, email address, phone number (optional), the service you are interested in, and your message.
  • Free Build application — your name, email, phone, business details, a link to a video you provide, your written answers, and the consents you give on the application form.
  • Pricing & interest survey — your answers are not identifying unless you choose to give us your email address. If you do, and tick the box to say we may contact you, we use it only to follow up about the programme, and keep it for 12 months.
  • Content brief — if you are selected, the business content you provide for your website, including photos and your logo.
  • Technical information — a hashed version of your IP address and your browser type (see Analytics below).

We do not use third-party advertising cookies.

How we use your information

We use the information you provide to:

  • Respond to your enquiry, discuss your project requirements, and provide a quote or proposal if requested
  • Process and assess your Free Build application, communicate with you about it, and — if you are selected — build and support your website
  • Understand demand and pricing for the Free Build programme, from survey responses

We will not use your information for marketing unless you ask us to, and we will never sell or share it with third parties for their own purposes.

AI-assisted processing

For the Free Build programme, we may use AI tools to help us summarise applications and check them against our eligibility criteria, draft routine emails (such as acknowledgements and status updates), draft the text for your website based on your content brief, and check a draft against your brief before it is shown to you. A person on our team watches your video themselves — we do not download it or process it with AI tools.

A person makes every decision. AI tools only ever assist — they do not decide who is selected or declined, and you approve all text before it appears on your website. AI tools do not receive your name or email address during eligibility review.

We only use AI providers that are contractually barred from training on your data, and only those named at /sub-processors.html.

How we send your message

When you submit the contact form, your message is sent to us via email using Hostinger's SMTP service. Your information passes through Hostinger's servers for delivery only and is not stored there beyond normal email transit.

Bot protection

We use Cloudflare Turnstile to protect our contact form from automated abuse. Turnstile may set cookies and collect limited technical data (such as browser type and interaction patterns) to verify you are a real person. This data is processed by Cloudflare under their privacy policy.

Analytics

We use first-party, server-side analytics (PostHog, hosted in the EU) to understand how the website and the Free Build application process are performing. When a form is submitted — or fails, or is rate-limited — our server records an event with a pseudonymous identifier derived from your IP address by hashing it with a secret salt, along with coarse details such as the form type, the region or service selected, and the outcome. We do not send your name, email address, phone number, message content or application answers to analytics, and no analytics cookies are set in your browser.

Cookies

This website uses only essential cookies:

  • Theme preference — remembers your light/dark mode choice. Stored in your browser only.
  • Cloudflare Turnstile — sets a temporary cookie to verify the contact form challenge. See the bot protection section above.

We do not use analytics cookies, advertising cookies, or any third-party tracking. Our analytics runs server-side and sets no cookies (see the analytics section above).

Where your information is stored

Contact form submissions are delivered to our email inbox. Free Build applications, brief content and uploaded photos/logos are stored in a database and file storage located in Sydney, Australia. Applications are also tracked in Zendesk, our support ticketing platform. We use PostHog, hosted in the EU, for server-side analytics. Hostinger sends our outgoing email and hosts preview builds of your website before it goes live; once your site is selected and live, it is hosted in New Zealand.

The full, current list of providers who may process your information on our behalf — what each one does, what they can see, and where they are located — is published at /sub-processors.html, which forms part of this policy.

Our website is served over HTTPS with modern security headers, and we follow industry practices to protect your data in transit.

Overseas disclosure

Some of the providers listed above are located, or store data, outside New Zealand — including in Australia and the European Union. Under Information Privacy Principle 12 of the Privacy Act 2020, before we disclose your information to an overseas person we must be satisfied they are subject to privacy standards comparable to New Zealand's, whether by law or by contract. We only use overseas providers who are bound — by their own published policies, by contract, or both — to protect your information to a comparable standard, and we keep /sub-processors.html up to date as this changes.

How long we keep your information

We do not keep personal information longer than we need it for the purpose we collected it for:

  • General enquiries (contact form) — 12 months
  • Unsuccessful Free Build applications — 90 days after the round closes; the video link is removed as soon as a decision is made
  • Selected applicants — for the length of your hosting term, plus 12 months afterwards
  • Audit trail of decisions made about your application — 2 years
  • Support tickets — 12 months
  • Analytics events — 12 months
  • Survey responses — 12 months
  • Invoices — 7 years, as required by the Tax Administration Act 1994

Deleting your information

You can ask us to delete your personal information at any time — see "Your rights" below. We action deletion requests within 20 working days, in line with the timeframes in the Privacy Act 2020. Some information, such as invoices, must be kept for the periods required by law even after you ask us to delete other records.

Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

  • Ask what personal information we hold about you
  • Request correction of any inaccurate information
  • Ask us to delete your information
  • Ask a person on our team to personally carry out any step in the Free Build process that would otherwise involve AI assistance
  • Ask us to explain any AI-assisted step in how your application or brief was handled

If you are in Australia, equivalent rights apply under the Australian Privacy Act 1988.

To exercise any of these rights, email us at contact@webisto.tech.

Children's privacy

Our services are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has submitted information through our form, please contact us and we will delete it promptly.

Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review it periodically.

Contact us

If you have questions about this policy or how we handle your information:

You can also lodge a complaint with the Office of the Privacy Commissioner if you believe we have breached your privacy.