Sign upClaim free
Claim

Privacy Policy

List-It is operated by Bay Web Co Limited, trading as "List-It" ("List-It", "we", "us", "our"). This policy explains how we collect, use, store, share and protect personal information, and your rights under the Privacy Act 2020.

Last updated: 20 September 2026. Contact for privacy matters: info@list-it.nz, marked for the attention of our Privacy Officer.

1. Who this applies to

This policy covers everyone who uses List-It: people who browse, people who create a member account, business owners who claim or manage a listing, and businesses whose details appear in our directory (see section 4 about directory data).

2. Information we collect

  • Account information: name, email address, password (stored hashed: we never see it in plain text), and optionally a profile photo, town, and phone number.
  • Listings & content you create: business profile content (photos, descriptions, contact details, service areas), specials/events, reviews, likes, and messages you send through the site.
  • Business directory data: publicly available business-register information sourced from the New Zealand Business Number (NZBN) register operated by MBIE (see section 4).
  • Information from public sources about businesses, as described in section 4A.
  • Usage & technical data: IP address, device/browser type, pages viewed, and similar analytics (see our Cookies & Tracking notice).
  • Payment data: if you buy a paid plan, payment is processed by Stripe. We do not store your full card number; we receive only a token and limited details (e.g. card brand, last 4 digits, billing status).

3. How we use your information

We use personal information to: create and run your account; publish and manage listings; deliver messages between users; verify business claims; process payments and manage subscriptions; send service ("transactional") emails such as message alerts, claim codes and listing-expiry reminders; moderate content and prevent fraud, scams and abuse; improve the service; and meet legal obligations. We send marketing emails or newsletters where you have consented, or where the Unsolicited Electronic Messages Act 2007 allows it (for example a business address published for business contact). Every such email has a one-click unsubscribe, and we stop as soon as you use it.

4. Business directory data (NZBN): important

List-It publishes profile pages for New Zealand businesses using information from the public NZBN register (operated by MBIE under the Companies and other registers). This information is already publicly available. For sole traders and some small entities, this may include personal information (such as a trading name that is a person's name).

  • We attribute the source as required by our agreement with MBIE.
  • We default to showing only the town/region, not a full street address, unless a verified owner chooses to reveal more.
  • If you are a business owner, you can claim, correct, restrict, or request removal of your listing, see "NZBN data & your listing" (/legal/your-listing) and section 7 below.

4A. Information we collect from other public sources

Some of the information on a business page, and some of the contact details we use to invite a business to claim its page, does not come from you directly. It comes from:

  • The NZBN register, operated by MBIE, which publishes the registered name, trading names, status, entity type and registered address of every New Zealand business, and for some businesses a public contact detail.
  • The business's own website, where a business has published a contact email address, phone number, logo, opening hours, services or a description. We read the pages a business has made public and record those details against its listing.
  • Public business profile platforms (for example Google Business Profile, Apple Maps, Facebook, Instagram and LinkedIn), where we record only the fact that the business has a profile there and the link to it, never the content of reviews.

We collect this information because it is publicly available, and we use it for one purpose: to build and keep accurate a page about the business, and to tell the business that the page exists. For a sole trader or a very small business, some of this can be personal information, such as a trading name that is a person's name, or a contact email that is a person's name.

What we do and do not do with it

  • We never publish an email address taken from the NZBN register. Contact details from the register are kept private unless the business owner chooses to show them.
  • We send a business at most one invitation to claim its page and one reminder, from an address you can reply to, with an unsubscribe link that works in one click, and we keep a record of where each address came from. We do not send anything else to an address until the owner has claimed the page.
  • We do not sell this information, and we do not build profiles of individuals across sources.

Your choices

  • Claim your page to correct anything on it, or to add to it.
  • Ask us to restrict or remove your page, or any detail on it, at any time: see "NZBN data & your listing" and section 7.
  • Unsubscribe from our email with the link in any message, or by writing to info@list-it.nz. We keep your address on a suppression list so it is never emailed again.

5. When we share information

We do not sell your personal information. We share it only: with service providers who help us run List-It (e.g. Supabase for hosting/database, Vercel for hosting, Stripe for payments, Resend/Amazon SES for email, Unsplash and Pexels for imagery, AI providers for content assistance) under confidentiality obligations; with other users only as you intend (e.g. your public listing, or a message you send); and where required by law, or to prevent harm, fraud or a crime. Some providers are overseas; where information leaves New Zealand we take reasonable steps to ensure comparable protection.

6. Messaging & contact details

To keep people safe, contact between members and businesses happens through on-site messaging by default. We do not display your email, and we display a phone number only if you choose to add one to a listing. Message content is stored so we can moderate it for scams and abuse.

7. Your rights

Under the Privacy Act 2020 you can access the personal information we hold about you and ask us to correct it. You can also: edit or delete your listings and account at any time; ask us to delete your personal information (subject to legal retention needs); withdraw marketing consent; and, if you're a business, opt your listing down to minimal data or request removal. To make a request, email info@list-it.nz. We'll respond within 20 working days.

8. Keeping information safe

We protect information with industry-standard measures: encrypted connections (HTTPS), hashed passwords, database row-level security so users can only access their own data, access controls, and auto-moderation. No system is perfectly secure, but we work to a strong standard and review it. If we have a notifiable privacy breach (one likely to cause serious harm), we will notify affected people and the Office of the Privacy Commissioner as required by law.

9. Retention

We keep personal information only as long as needed for the purposes above or as required by law. Closed accounts are deleted or anonymised, except where we must retain records (e.g. financial records, or to handle a dispute).

10. Children

List-It is not intended for people under 16. We do not knowingly collect their information.

11. Changes & complaints

We may update this policy; we'll post the new version with a new "last updated" date and, for material changes, notify account holders. If you have a privacy concern, contact our Privacy Officer at info@list-it.nz. If you're not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

This is general information, not legal advice.