Privacy policy

Last updated: August 2026

Draft — not yet reviewed by a lawyer. Fill in the bracketed details and have it checked before launch.

flatwhitebread ("we") is operated by Kay Huang, based in New Zealand. This policy explains what personal information we collect and what we do with it. We handle personal information in accordance with the Privacy Act 2020.

What we collect

• Your email address and password — to create and secure your account. Passwords are stored hashed by our authentication provider; we never see them.
• Your display name — shown publicly beside your reviews.
• Your location, when you check in — we record the coordinates your device reports and how far that was from the restaurant. This is the only way to verify you were actually there.
• Your reviews and ratings — published publicly, with your display name.
• Basic technical information — standard server logs kept by our hosting provider.

What we don't collect

We don't track your location in the background. Location is only read at the moment you press the check-in button, and only then. We don't collect payment details — if and when we take payments, our payment provider handles card data and we never see it.

Why we collect it

To run the service: to let you sign in, to verify that reviews come from people who actually visited, to display reviews, and to investigate misuse. We don't sell your information, and we don't share it with advertisers.

Who else sees it

• Supabase — our database and login provider. Your data is stored in their Sydney, Australia region.
• Vercel — hosts the website.
• Google — supplies restaurant information and maps. When the map loads, Google may collect information under its own privacy policy.
• Resend — sends our emails. Booking confirmations contain your name, phone number and booking details, and are processed in the United States.
• Stripe — processes subscription payments from restaurants. Card details go directly to Stripe and are never seen or stored by us.

Sharing with restaurants

When you request a table, the restaurant is sent the name, phone number and any notes you provided, so they can confirm the booking and contact you. Only restaurants that have claimed and verified their listing receive this.

Because our providers store data outside New Zealand, your information may be held overseas. We rely on providers who offer comparable privacy safeguards.

How long we keep it

Account information for as long as you have an account. Check-in records for 12 months, since after that they no longer verify anything. Reviews stay published until you delete them or we remove them under our review policy.

Your rights

Under the Privacy Act 2020 you can ask to see the personal information we hold about you, and ask us to correct it. You can also ask us to delete your account and reviews.

Email admin@flatwhitebread.co.nz and we'll respond within 20 working days.

Complaints

If you're unhappy with how we've handled your information, tell us first. If we don't resolve it, you can complain to the Office of the Privacy Commissioner.