Privacy

LAST UPDATED · AUGUST 2026

The short version

We collect only what we need to run Kitset and reply to you. We don't sell your information, and we don't share it with anyone who doesn't need it to make the service work.

What we collect

• If you contact us - your name, email address and whatever you write in the form. We use it to reply, nothing else.
• If you create an account - your email address and a password (stored securely hashed - we never see it). Anything you put into a site you build is stored so we can host it for you.
• Visit counts - our own analytics count page views anonymously. No cookies, no tracking across sites, no way to identify you.

Where it lives

Account data and messages are stored with our infrastructure providers (Supabase and Netlify) in secured data centres. Emails we send you go through Resend. Each of these providers only processes data on our behalf.

Websites we host for clients

Sites built with Kitset belong to their owners. If you fill in a contact form on a Kitset-hosted site, your message goes to that business - their handling of it is covered by their own privacy policy (we require one for embedded booking or tracking tools).

Your rights

Under the New Zealand Privacy Act 2020 you can ask to see the information we hold about you, ask us to correct it, or ask us to delete your account and everything in it. Site owners can also export their complete site at any time - your website is yours.

How long we keep it

Contact form messages are kept while we are dealing with them and for up to two years after, so we can pick up a conversation you started. Account and site data is kept for as long as your account is open. If you close your account, your site and its content are deleted within 30 days, apart from anything we have to keep for tax records, which is seven years for invoices and payment records under New Zealand tax law.

Who is responsible

Kitset is operated by Kerehama Andrews, trading as Kitset, a sole trader in Aotearoa New Zealand. Under the Privacy Act 2020 that is the agency holding the information described on this page, and the one your rights above are exercised against.

Questions

Email us via the contact form - a real person replies. You can delete your own account at any time under Settings in your dashboard. If you are asking to see, correct or delete your information, say so and we will treat it as a Privacy Act request. We will reply within 20 working days, which is the time the Privacy Act allows. If you are not happy with how we handle it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz, and you do not need our permission to do that.