Privacy Policy

1. Introduction

Flitz Systems Limited ("Flitz", "we", "us", or "our") is a New Zealand company that operates a cloud-based booking and business management platform at flitz.cloud (the "Platform").

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information. It applies to all users of the Platform, including:

• Workspace Operators — businesses and their staff who use Flitz to manage bookings, customers, and operations.
• End Users — individuals who create bookings, purchase memberships, or otherwise interact with a Workspace Operator through the Platform.

We are committed to complying with the New Zealand Privacy Act 2020 and the Australian Privacy Act 1988 (including the Australian Privacy Principles). Where those laws differ, we apply the higher standard of protection.

2. Information We Collect

2.1 End Users (Customers)

When you create an account, make a booking, or interact with a Workspace Operator through the Platform, we may collect:

• Identity and contact information — name, email address, phone number, and postal address.
• Account credentials — a password (stored in hashed form only) and multi-factor authentication settings.
• Booking information — appointment date, time, service, staff member, location, and any notes you provide.
• Payment information — transaction amounts, payment status, and timestamps. Card details are processed directly by our payment partners (Stripe and Afterpay) and are never stored on our systems.
• Form responses — answers to intake or consent forms configured by the Workspace Operator.
• Profile picture — if you choose to upload one.
• Walk-in information — if a Workspace Operator records a walk-in booking on your behalf, they may enter your name and phone number without you creating an account.

2.2 Workspace Operators (Businesses and Staff)

When you register a workspace or accept a staff invitation, we may collect:

• Identity and contact information — name, email address, and phone number.
• Account credentials — a password (stored in hashed form) and multi-factor authentication settings, or authentication via Google or Facebook where you choose to sign in that way.
• Business information — workspace name, business type, location names, and addresses (including street, city, region, postcode, country, and coordinates).
• Branding assets — logos and banner images you upload.
• Operational data — services, schedules, staff messages, customer notes, and email campaign content.
• Payment configuration — Stripe Connect account identifiers and Afterpay merchant credentials needed to process payments on your behalf.

2.3 Automatically Collected Information

When you use the Platform, we automatically collect certain technical information:

• Session data — we use essential session cookies to keep you signed in.
• Usage analytics — we use Google Analytics on the workspace management application to understand how the Platform is used. This collects anonymised page-view data and standard analytics metrics.

3. How We Use Your Information

We use the personal information we collect to:

• Provide, operate, and maintain the Platform and its features.
• Process bookings, class registrations, and membership subscriptions.
• Process payments through our third-party payment partners.
• Send transactional communications such as booking confirmations, reminders, verification emails, password resets, and one-time passcodes.
• Send marketing emails on behalf of Workspace Operators (you can opt out at any time).
• Authenticate your identity and protect account security, including multi-factor authentication.
• Analyse Platform usage to improve our services.
• Respond to support enquiries.
• Comply with legal obligations.

4. Sharing Your Information

We do not sell your personal information. We share personal information only in the following circumstances:

4.1 With Workspace Operators

When you book with a Workspace Operator, they can see your name, contact details, booking history, form responses, and any notes or communications related to your appointments. Workspace Operators are independent controllers of the customer data they collect through the Platform.

4.2 With Third-Party Service Providers

We use the following third-party services to operate the Platform:

Each provider processes your information under their own privacy policy. We encourage you to review those policies.

4.3 Legal Requirements

We may disclose personal information where required by law, regulation, legal process, or enforceable government request.

5. Our Role in Handling Your Data

Flitz acts in different capacities depending on the context:

• As a controller — for Platform account data, staff accounts, and our own billing relationships. We decide how and why this information is processed.
• As a processor — for customer data entered by Workspace Operators, including booking records, intake form responses, customer notes, and marketing campaigns. The Workspace Operator decides how and why this information is processed; we process it on their behalf.

If you have questions about how a specific Workspace Operator handles your data, please contact them directly.

6. Cross-Border Data Transfers

Flitz is based in New Zealand and operates in both New Zealand and Australia. Our infrastructure is hosted on Amazon Web Services in the Asia Pacific (Sydney) region.

Some of our third-party service providers (such as Stripe and Google) may process data in other jurisdictions. We take reasonable steps to ensure that any overseas recipient handles your information in a manner consistent with the New Zealand Privacy Act 2020 (Information Privacy Principle 12) and the Australian Privacy Act 1988 (Australian Privacy Principle 8).

7. Data Security

We take the security of your information seriously and implement measures including:

• Passwords are hashed using industry-standard algorithms (bcrypt) and are never stored in plain text.
• All data in transit is encrypted using HTTPS/TLS.
• Multi-factor authentication is available for all account types.
• Access to customer data is scoped to the authenticated workspace, preventing cross-tenant access.
• Infrastructure is secured using AWS best-practice configurations.
• Verification tokens, password reset tokens, and one-time passcodes expire automatically.

While we take reasonable precautions, no method of transmission or storage is completely secure. If you become aware of a security issue, please contact us immediately.

8. Data Retention

• Account data is retained for as long as your account remains active.
• Booking and transaction records are retained for business continuity and to meet legal and tax obligations.
• Verification and reset tokens expire after a short period and are invalidated after use.
• Marketing preferences (including unsubscribe status) are retained to ensure we respect your communication choices.

If you request deletion of your account, we will delete or anonymise your personal information unless we are required to retain it for legal, tax, or legitimate business purposes.

9. Your Rights

Under the New Zealand Privacy Act 2020

You have the right to:

• Request access to the personal information we hold about you (Information Privacy Principle 6).
• Request correction of any information that is inaccurate, incomplete, or misleading (Information Privacy Principle 7).

Under the Australian Privacy Act 1988

You have the right to:

• Request access to the personal information we hold about you (Australian Privacy Principle 12).
• Request correction of information that is inaccurate, out of date, incomplete, irrelevant, or misleading (Australian Privacy Principle 13).

Additional Rights

• Marketing opt-out — you can unsubscribe from marketing emails at any time using the unsubscribe link in those emails.
• Account deletion — you can request that we delete your account and associated personal information by contacting us.

To exercise any of these rights, please contact us using the details in section 13 below. We will respond within 20 working days (NZ) or 30 calendar days (AU), as applicable.

10. Cookies and Tracking

We use a limited number of cookies and browser storage mechanisms:

• Session cookies — essential for keeping you signed in. These are deleted when you close your browser or your session expires.
• Google Analytics — used on the workspace management application only to collect anonymised usage data. Google Analytics is not used on customer-facing booking or account pages.
• Local and session storage — used to store temporary user-interface state (such as in-progress booking details). This data stays in your browser and is not transmitted to our servers.

11. Children's Privacy

The Platform is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. Workspace Operators are responsible for ensuring that their use of the Platform complies with applicable laws regarding minors.

If you believe we have inadvertently collected information from a child under 16, please contact us so we can promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective date" at the top of this page and, where appropriate, notify you by email or through the Platform.

We encourage you to review this page periodically to stay informed about how we protect your information.

13. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

If you are not satisfied with our response, you may lodge a complaint with the relevant authority:

• New Zealand — Office of the Privacy Commissioner
  privacy.org.nz
• Australia — Office of the Australian Information Commissioner
  oaic.gov.au