Privacy Policy
List-It is operated by Bay Web Co Limited (NZBN [Bay Web Co Ltd NZBN]), trading as "List-It" ("List-It", "we", "us", "our"). This policy explains how we collect, use, store, share and protect personal information, and your rights under the Privacy Act 2020.
Last updated: [effective date]. Contact for privacy matters: info@list-it.nz (Attn: Privacy Officer, [name]).
1. Who this applies to
This policy covers everyone who uses List-It: people who browse, people who create a member account, business owners who claim or manage a listing, people who post or respond to classifieds, and businesses whose details appear in our directory (see section 4 about directory data).
2. Information we collect
- Account information: name, email address, password (stored hashed — we never see it in plain text), and optionally a profile photo, town, and phone number.
- Listings & content you create: classified listings (photos, descriptions, price, area, contact phone), business profile content, specials/events, reviews, likes, and messages you send through the site.
- Business directory data: publicly available business-register information sourced from the New Zealand Business Number (NZBN) register operated by MBIE (see section 4).
- Usage & technical data: IP address, device/browser type, pages viewed, and similar analytics (see our Cookies & Tracking notice).
- Payment data: if you buy a paid plan, payment is processed by Stripe. We do not store your full card number; we receive only a token and limited details (e.g. card brand, last 4 digits, billing status).
3. How we use your information
We use personal information to: create and run your account; publish and manage listings; deliver messages between users; verify business claims; process payments and manage subscriptions; send service ("transactional") emails such as message alerts, claim codes and listing-expiry reminders; moderate content and prevent fraud, scams and abuse; improve the service; and meet legal obligations. We will only send you marketing emails or newsletters with your consent, and every such email has a one-click unsubscribe (Unsolicited Electronic Messages Act 2007).
4. Business directory data (NZBN) — important
List-It publishes profile pages for New Zealand businesses using information from the public NZBN register (operated by MBIE under the Companies and other registers). This information is already publicly available. For sole traders and some small entities, this may include personal information (such as a trading name that is a person's name).
- We attribute the source as required by our agreement with MBIE.
- We default to showing only the town/region, not a full street address, unless a verified owner chooses to reveal more.
- If you are a business owner, you can claim, correct, restrict, or request removal of your listing — see "NZBN data & your listing" (
/legal/your-listing) and section 7 below.
5. When we share information
We do not sell your personal information. We share it only: with service providers who help us run List-It (e.g. Supabase for hosting/database, Vercel for hosting, Stripe for payments, Resend/Amazon SES for email, Pexels for imagery, AI providers for content assistance) under confidentiality obligations; with other users only as you intend (e.g. your public listing, or a message you send); and where required by law, or to prevent harm, fraud or a crime. Some providers are overseas; where information leaves New Zealand we take reasonable steps to ensure comparable protection.
6. Messaging & contact details
To keep people safe, buyer↔seller contact happens through on-site messaging by default — we do not display your email, and we display a phone number only if you choose to add one to a listing. Message content is stored so we can moderate it for scams and abuse.
7. Your rights
Under the Privacy Act 2020 you can access the personal information we hold about you and ask us to correct it. You can also: edit or delete your listings and account at any time; ask us to delete your personal information (subject to legal retention needs); withdraw marketing consent; and, if you're a business, opt your listing down to minimal data or request removal. To make a request, email info@list-it.nz. We'll respond within 20 working days.
8. Keeping information safe
We protect information with industry-standard measures: encrypted connections (HTTPS), hashed passwords, database row-level security so users can only access their own data, access controls, and auto-moderation. No system is perfectly secure, but we work to a strong standard and review it. If we have a notifiable privacy breach (one likely to cause serious harm), we will notify affected people and the Office of the Privacy Commissioner as required by law.
9. Retention
We keep personal information only as long as needed for the purposes above or as required by law. Expired classifieds are removed after 30 days. Closed accounts are deleted or anonymised, except where we must retain records (e.g. financial records, or to handle a dispute).
10. Children
List-It is not intended for people under 16. We do not knowingly collect their information.
11. Changes & complaints
We may update this policy; we'll post the new version with a new "last updated" date and, for material changes, notify account holders. If you have a privacy concern, contact our Privacy Officer at info@list-it.nz. If you're not satisfied, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).