eolma Privacy Policy

1. Introduction

This Privacy Policy explains how eolma ("we", "us", or "our") collects, uses, stores, and discloses your personal information when you use the eolma platform, including the website, mobile application, and related services (the "Platform").

We are committed to protecting your privacy in accordance with the Privacy Act 2020 (NZ) and the Information Privacy Principles (IPPs) set out in that Act. By using the Platform, you consent to the collection and use of your information as described in this policy.

2. Information we collect and why

We only collect information that is necessary to provide you with the Platform's services. Below is what we collect, and why.

2.1 Account information

When you sign in with Google or Facebook, we receive your email address, first and last name, profile photo, and a provider-specific account identifier. We use this information only to authenticate you, create or identify your account, and keep you signed in.

2.2 Profile information

Display name and suburb: So other users can identify you and see whether you're in a convenient location for splitting.
Bank account details (optional): If you choose to add them, this makes it easier to share your payment information with split partners so they can reimburse you. Bank details are encrypted before being stored and are only shared with a confirmed split partner when you choose to do so.
Pickup address (optional): If you choose to add one, this makes it easier to share collection details with a confirmed split partner after a split is confirmed. Pickup addresses are encrypted before being stored and are only shared when you actively choose to send them in chat.

2.3 Content you create

Photos of items, item listings, split requests, chat messages, ratings, and feedback you submit are all stored so the Platform can function. Item photos are processed by an AI service to automatically extract item details, saving you from entering them manually. Only the image is sent to the AI service, no other personal information.

2.4 Location (mobile app, with your permission)

If you grant location permission, the mobile app uses your location to show whether you are near a participating store. This helps other users find split partners who are currently in-store and able to pick up items. Your location is not stored permanently. It is only used while you have the app open and is not recorded in our database.

2.5 Automatically collected information

We collect basic usage data to keep you signed in and to help us improve the Platform. This includes authentication and session data such as cookies, refresh tokens, and related security information needed to maintain your signed-in session.

3. How we use your information

We collect and use your personal information only for the purposes for which it was collected (IPP 10). These purposes include:

Providing the service: Creating and managing your account, facilitating split requests, enabling messaging between users, and displaying item listings.
Authentication and security: Verifying your identity, managing sessions, and protecting against unauthorised access.
Communication: Sending system notifications related to your split requests, messages, and account activity.
Improvement: Analysing usage patterns to improve the Platform's functionality, performance, and user experience.
Legal compliance: Complying with applicable New Zealand law, including responding to lawful requests from government agencies.

4. How we share your information

We do not sell your personal information to third parties. We may share your information in the following limited circumstances:

4.1 With other users

As part of the Platform's core functionality, certain information is visible to other users:

Your display name, profile photo, and suburb are visible on your profile and in listings.
Your shopping cart is visible on your profile so other users can discover items you may want to split. Your favourites are not visible to other users.
Your chat messages are visible to the other participant in a conversation.
Your bank account details are only shared with a confirmed split partner when you actively choose to share them.
Your pickup address is only shared with a confirmed split partner when you actively choose to share it.
If you grant location permission on the mobile app, other users may see that you are currently in-store. Your precise coordinates are never shared with other users.
Your ratings are visible on your profile.

4.2 With service providers

We use third-party services to operate the Platform. These providers process data on our behalf and are contractually required to protect your information:

Authentication providers: Google and Meta (Facebook Login), which we use only to sign you in and retrieve the account information described in section 2.1.
Cloud hosting: Infrastructure providers that host the Platform and store Platform data.
AI image processing: AI service providers that we use to extract item details from item photos you upload.

4.3 For legal reasons

We may disclose your information if required by law, court order, or a request from a New Zealand government agency, or if we reasonably believe disclosure is necessary to protect the rights, property, or safety of eolma, our users, or the public.

5. Data security

We take reasonable steps to protect your personal information from unauthorised access, use, or disclosure (IPP 5). Our security measures include:

Sensitive personal information, including bank details and pickup addresses, is encrypted before being stored where appropriate.
All data transmitted between your device and our servers is encrypted in transit.
Users can only access their own data and data explicitly shared with them.

No system is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data storage and overseas disclosure

Your personal information may be stored on or processed by servers located outside New Zealand (for example, in Australia or the United States). Where your information is transferred overseas, we take reasonable steps to ensure it is protected by comparable safeguards (IPP 12).

7. Data retention

We retain your personal information for as long as your account is active or as needed to provide the Platform's services.

Account data: Retained until you request deletion.
Messages: Retained for as long as reasonably necessary to operate the chat service. When your account is deleted, shared chat and split history may be retained in de-identified form, including display as [Deleted user], while personal details and sensitive shared data are removed.
Item listings: Retained while active; may be removed after a reasonable period of inactivity.

When your account is deleted, we remove or de-identify your personal information within a reasonable timeframe, unless we are required by law to retain it. This includes deleting your item comments and ratings and removing sensitive shared details such as bank account information and pickup addresses from retained chat history.

8. Your rights under the Privacy Act 2020

Under the Privacy Act 2020, you have the right to:

Access your information (IPP 6): You may request a copy of the personal information we hold about you.
Correct your information (IPP 7): You may request that we correct any inaccurate or incomplete personal information. You can also update your profile directly in the Platform's settings.
Delete your information: You can delete your account directly in Settings, or email privacy@eolma.com if you cannot access the app.

To exercise any of these rights, use the in-app deletion option in Settings or email privacy@eolma.com. Full deletion steps are available on our data deletion instructions page. We will respond to privacy requests within 20 working days, as required by the Privacy Act 2020.

9. Cookies and tracking

We use essential cookies to keep you signed in and to make the Platform work. These are strictly necessary and are not used for advertising or behavioural tracking.

On the mobile app, we may request tracking permission as required by your device's operating system. If you grant this permission, third parties involved in sign-in may use it for measurement purposes. You can decline or change this at any time in your device settings.

10. Children's privacy

The Platform is not intended for use by anyone under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected information from a person under 18, we will take steps to delete that information promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Platform. The "last updated" date at the top of this page indicates when the policy was last revised.

12. Contact and complaints

If you have questions about this Privacy Policy or wish to make a privacy-related request, please email privacy@eolma.com.

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Privacy Commissioner (Te Mana Matapono Matatapu).