What we collect,
and why.

Who we are

NZ Startup Ground is a New Zealand directory connecting founders with cofounders, pilot customers, talent, mentors and investors. This policy explains how we handle personal information under the Privacy Act 2020.

If you have a question about anything here, email constanza.e-iversen@outlook.com.

What we collect

When you create an account

• Your name and email address
• If you sign in with Google or LinkedIn, your name, email address and profile picture from that provider. We never receive your password.
• An encrypted password, if you choose to set one

When you add a startup

• Startup details you choose to publish — name, description, location, stage, sector, website, LinkedIn and logo
• Optional discovery labels you self-declare, such as women-founded or Māori-founded. These are never inferred, always optional, and exist so funds and programmes looking for founders like you can find you. You can remove them at any time.
• Your New Zealand Business Number, if you choose to verify

When you respond to a listing

• Your name, email address, organisation and your message
• This is shared with the startup you responded to. That is the point of responding — but it means they will see your contact details.
• Answers to the startup’s own questions, where they have asked any. These go to that startup only.
• Your CV, if you attach one. Some cofounder and role listings invite a CV. Attaching one is always optional — you can send a response without it.

When you test a startup’s product

• Your email address and your answers to that startup’s questions. No account is needed. Your email is used to make sure one person responds once, and is shared with that startup so they can follow up.

Automatically

• When you last signed in and when you last edited a profile. We use this to show whether a listing is actively maintained, and only ever as a rough indication such as “active today”. We never publish exact times.
• Which profiles and listings get viewed, saved and clicked. We record that a view happened, along with the region and stage of the startup involved, so founders can see how much interest their listing is attracting.

What founders see about visitors

Counts only, never identities.A founder sees “42 views this month”. They cannot see who you are, that you in particular visited, or when. This is enforced in our database, not merely in the design of the page: the viewing records are not readable by any user account, and the statistics founders see are produced by a function that returns totals and nothing else.

The exception is when you deliberately make yourself known — by registering interest in a listing or answering a startup’s test questions. Then that startup sees what you sent them, because you chose to send it.

Your CV, specifically

CVs are stored in private file storage, not on the public web. There is no public link, and a file cannot be reached by guessing an address. Only the team of the startup you applied to can open it, and only through a short-lived link generated at the moment they view your application.

You need to be signed in to attach a CV. That is deliberate: we need to know whose file it is so we can delete it if you ask us to.

Why we collect it

To run the service: to let you sign in, publish a profile, receive responses, and be discoverable by the people you want to reach. We also use your email to tell you when someone responds to one of your listings, and occasionally to ask whether a profile is still current.

We do not sell your personal information. We do not sell placement or ranking in our directory.

Where your information is stored

Our database and file storage are provided by Supabase, hosted in Singapore. Our website is hosted by Netlify, which serves content from data centres worldwide. Authentication is handled by Supabase, and optionally by Google or LinkedIn if you choose those sign-in methods.

This means your personal information is stored and processed outside New Zealand. We rely on these providers’ contractual and technical safeguards to protect it, as required by information privacy principle 12.

Who we share it with

• Startups you respond to — your name, email, organisation, message, any answers to their questions, and your CV if you attached one
• Our service providers — Supabase (database, authentication, storage), Netlify (hosting), and our email provider for notifications
• Anyone — anything you choose to publish on a public profile or listing. Please do not put personal information in those fields unless you intend it to be public.

We may also disclose information where the law requires it, or to protect someone’s safety.

How long we keep it

Account and startup information is kept while your account is active. If a profile is not confirmed as current for six months it drops down our listings, but it is not deleted. Responses to listings are kept so startups can refer back to them.

If you ask us to delete your account, we will remove your personal information within 30 days, except where we are required to keep it.

CVs are deleted 30 days after the listing closes. Listings run for 60 days. Your CV stays available to that startup’s team while the listing is open and for a month afterwards, so they can finish reviewing — then it is deleted automatically. We don’t keep it in case something else comes up.

Your message and answers stay with the startup as their record of the conversation. The file does not. You can ask us to delete yours sooner at any time.

Viewing records are aggregate and short-lived. We keep them to produce the counts founders see, and they are never published or shared with anyone in a form that identifies a visitor.

Your rights

Under the Privacy Act 2020 you can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Most of it you can view and edit yourself in your dashboard. For anything else, email us and we will respond within 20 working days.

If you are not satisfied with how we have handled your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Cookies

We use cookies that are necessary to keep you signed in. We do not use advertising cookies, and we do not track you across other websites.

Changes

If we change this policy we will update the date at the top. If the change is significant we will tell account holders by email.