How we handle your data

Our commitment

Hatched is built around integrity, transparency and ownership. We collect the information needed to provide our services, keep Hatched running well, improve the experience, and communicate with you. Your information is here to support your experience with Hatched. It is never treated as a product to package, trade or sell.

What we collect

We collect the minimum amount of information needed to provide our services and improve the experience for everyone.

• 1.Account information — Your name and email address when you sign up for any Hatched product.
• 2.Contact form submissions — The information you provide when you reach out to us, including your project details and budget range.
• 3.Usage analytics — Anonymised data about how you interact with our products, so we can make them better. We use privacy-respecting analytics only.
• 4.Technical data — Your browser type, device, and IP address, collected automatically to keep our services running and secure.

What we don't do

This is just as important as what we do collect.

• -We don't sell, rent, or trade your personal data. Ever.
• -We don't use dark patterns to trick you into sharing more than you intend to.
• -We don't share your information with third-party advertisers.
• -We don't track you across the web.
• -We don't retain data longer than necessary.

How we use your information

• 1.To provide our services — Your account data powers authentication, your product settings, and your experience across our tools.
• 2.To communicate with you — Responding to your enquiries, sending transactional emails (receipts, password resets), and occasional product updates you can opt out of at any time.
• 3.To improve our products — Anonymised analytics help us understand what works and what doesn't, so we can build better tools for you.
• 4.To keep things secure — Monitoring for suspicious activity, preventing abuse, and maintaining the integrity of our platform.

Where your data lives

All data is stored on Neon Serverless Postgres infrastructure with globally distributed edge nodes. Data is encrypted in transit (TLS) and at rest (AES-256). We do not store data on third-party platforms outside of our core infrastructure.

Who we are

Hatched Digital is a New Zealand company. For privacy purposes we are the controller of your personal information — we decide why it is collected and how it is used. The services we list below act as our processors and may process data only on our instructions.

Where we process your information to deliver a service you asked for, our legal basis is performing our contract with you. Marketing email is sent with your consent, which you can withdraw at any time. We rely on legitimate interests for security logging and for understanding how the product is used so we can improve it, and we have assessed that this does not override your rights. We do not sell personal information, and we do not use automated decision-making that produces legal or similarly significant effects for you.

How long we keep it

We keep information only as long as we need it:

• -Account and project data — while your account is active, then deleted within 30 days of closure.
• -Invoices and payment records — 7 years, because New Zealand tax law requires it.
• -Call recordings and transcripts — 12 months after the call, unless you ask us to keep them longer as part of your project.
• -Server and security logs — 90 days.
• -Product analytics — cookieless, with no identifier that survives your visit. See Cookies.

Third-party services

These providers process personal information on our behalf. We list them so you know where your data goes; we will tell you before adding a materially different one.

• -Neon — database hosting, including the databases we provision for your project.
• -Vercel — application hosting and edge delivery, including the sites we host for you.
• -Cloudflare — DNS, object storage, and network delivery.
• -Stripe — payment processing. We never see or store your full card details.
• -Cal.com — scheduling, so we can agree on meeting times and send reminders.
• -SenderKit and Purelymail — transactional email delivery, including confirmations and receipts.
• -Stream — in-app messaging, used to deliver notifications inside the product.
• -PostHog — cookieless product analytics. See Cookies for what this means in practice.
• -GitHub — source code and deployment pipeline.

Cookies and analytics

We use essential cookies only — the ones required to sign you in and to remember preferences like dark mode. We do not use tracking cookies, retargeting pixels, or any cookie-based advertising technology.

We do measure how the product is used, using PostHog. It is configured to be cookieless: it sets no analytics cookie and stores nothing in your browser between visits, so the events it records cannot be linked back to you across sessions or across sites. We also create a profile only for people who are signed in, never for anonymous visitors, and we honour Do Not Track. Because there is no cookie and no cross-site identifier, there is nothing here for you to consent to.

If you would rather we measured nothing at all, you can block analytics in your browser, and the product works exactly the same way. We would just be guessing at what to improve.

Where your data lives

We are based in New Zealand. Some of the providers above store information on servers outside New Zealand, including in the United States, the European Economic Area and Australia. Where information leaves New Zealand we rely on the safeguards recognised for that transfer — including the EU Standard Contractual Clauses and the UK International Data Transfer Agreement where they apply. We do not sell your information, and we do not share it for anyone else's advertising.

If you are in the EU or UK and want to complain about how we handle your data, you can contact your local data protection authority. We would rather you came to us first — email privacy@hatched.digital and we will resolve it.

Your rights

You have full control over your data. At any time you can:

• -Request a copy of all data we hold about you.
• -Request correction of inaccurate data.
• -Request deletion of your data and account.
• -Receive your data in a portable, machine-readable format, so you can take it to another provider.
• -Object to processing based on legitimate interests, and restrict processing while a concern is resolved.
• -Withdraw consent for marketing email at any time.
• -Complain to your privacy regulator. We would rather you told us first, but that is your right, not a condition.

To exercise any of these rights, email privacy@hatched.digital and we'll respond within 5 business days. We do not charge for this, and we will not treat you differently for asking.

Children's privacy

Our services are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with their data, please contact us and we will remove it immediately.

Changes to this policy

If we make meaningful changes to how we handle your data, we'll notify you via email and update this page. We won't quietly change the terms and hope you don't notice — that's not how we operate.

Talk to us

Privacy should feel understandable and approachable. If you have a question about how we handle your information, or you want to exercise any of the rights listed above, email privacy@hatched.digital. We are real people, and we are happy to talk it through with you.

Hatched Digital Ltd — New Zealand
Privacy enquiries: privacy@hatched.digital