Privacy policy
What we collect when you use this website or work with us, why, where it goes, and how to see or correct it. Last updated 16 October 2026.
This policy covers Net Potential Ltd (NetPotential), 28 Constellation Drive, Rosedale, Auckland 0632. We follow the Privacy Act 2020. If anything here is unclear, ask our privacy officer, whose details are at the end.
The short version
- We only collect what we need to reply to you and to do the work you ask for.
- We never sell personal information, and we never use it to train AI models.
- You can ask to see or correct anything we hold about you, at any time, for free.
What we collect
When you use the contact form
Your name, email address, phone number (optional), what you need and your message. We also record which page you sent it from and your IP address, which we use only to stop spam and abuse.
When you apply to the Burn Queue
Your name, business, email, mobile, website, your pitch and the other answers on the form, whether you are happy for us to show the build, and any campaign tags in the link you followed. We keep the application in our customer relationship system so we can shortlist, contact you (including a short interview by text or email from our AI agent) and offer you a price. We record your IP address only to stop spam and abuse.
When you email or call us
Whatever you choose to tell us, plus your email address or phone number.
When you browse the site
Like nearly every website, we collect information about visits: pages viewed, the site that referred you, your browser and device type, and an approximate location (city or region, not your address). We use it to understand which pages help people and which do not.
When you become a client
Contact and billing details for the people we work with, and the project information you give us. Personal information about your own customers that we handle while hosting or building your systems belongs to you; we process it only on your instructions.
How we use it
- To reply to your enquiry and prepare a quote.
- To deliver, host and support the work you engage us for, and to invoice for it.
- To keep this website secure and free of spam.
- To improve the website, using visit statistics.
We will not add you to a mailing list because you sent an enquiry. If we ever send you marketing, it will be with your consent and every message will have a way to opt out.
Who we share it with
We use a small number of service providers to run this website. Some of them are overseas, so some personal information is processed outside New Zealand. We choose providers that protect it to a standard comparable to the Privacy Act.
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Delivers and protects this website, the spam check on the contact form, and visit statistics | Global network, including New Zealand |
| Twilio SendGrid | Delivers contact form messages to our inbox | United States |
| HighLevel (LeadConnector) | Our customer relationship system: Burn Queue applications and enquiries we follow up | United States |
| Our email (Google Workspace), website analytics (Google Analytics, sent through Cloudflare), and the map on the contact page | United States and elsewhere |
We also send ourselves a text message when a new enquiry arrives, through an SMS gateway we run ourselves. Beyond these providers we only share personal information if you ask us to, or if the law requires it.
Cookies and analytics
The site itself needs no cookies to work. We measure visits with Cloudflare Web Analytics, which uses no cookies, and with Google Analytics 4. Google Analytics is loaded through Cloudflare rather than directly from Google, but it can still set first-party cookies to tell new visits from return ones. The map on the contact page is provided by Google and may set its own cookies. You can block or delete cookies in your browser settings; the site works the same without them.
Where it is stored and how it is protected
The website and the client systems we host run on infrastructure we operate in New Zealand, on encrypted storage. Off-site backups are encrypted before they leave, and are held overseas as data nobody can read without a key kept offline in New Zealand. How we handle your data explains this in more detail. Enquiries arrive by email and are kept in our Google Workspace account.
If we ever have a privacy breach that is likely to cause serious harm, we will tell the people affected and the Office of the Privacy Commissioner, as the Act requires.
How long we keep it
Enquiries that do not become projects are deleted within two years. Client and billing records are kept for seven years, because New Zealand tax law requires it. Visit statistics are kept in aggregate.
Your rights
You can ask to see the personal information we hold about you, and ask us to correct it. We will respond within 20 working days, and there is no charge. You can also ask us to delete it, and we will unless we are required to keep it.
If you are not happy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Office of the Privacy Commissioner.
Contact our privacy officer
Tim Thomas, Net Potential Ltd
[email protected], 021 535 832
28 Constellation Drive, Rosedale, Auckland 0632
We may update this policy. The date at the top shows when it last changed.