Privacy Policy

#Introduction

This policy explains how HostCore Limited, a company incorporated in New Zealand (“HostCore”, “we”, “us”), collects and handles personal information. It forms part of our Terms of Service.

#Who this policy covers — and who it doesn't

This policy applies to:

• Tenants — the businesses (and the individuals within them) who register for and use HostCore; and
• Visitors to hostcore.co and our public sites.

It does not cover End Customers — the customers of stores operated by our tenants. If you are an End Customer of a store powered by HostCore, the store owner is responsible for your personal information; their privacy policy applies, and you should contact them directly. We process End Customer data only on tenants’ behalf as described in our Data Processing Addendum (hostcore.co/legal/data-processing).

For the personal information this policy covers, HostCore is the “agency” under the New Zealand Privacy Act 2020 and, where the EU/UK GDPR applies, the controller.

#Information we collect

1. Account and registration information.
   Your name, business name, email address, country, and password (stored hashed). If you select an indicative plan at sign-up, we record that selection.
2. Billing information (paid plans).
   When paid plans launch, subscription and invoicing records. Subscription payments will be processed by Stripe; your card details are collected and stored by Stripe, not by HostCore, and Stripe’s own privacy policy applies to that processing.
3. Payment gateway credentials.
   Tenants supply their own payment-provider credentials (e.g. Stripe restricted API keys, PayPal API credentials) to enable payments on their stores. These are business credentials rather than personal information in most cases, but we treat them with heightened protection regardless: encrypted at rest, used solely to provide the Services, and deleted within 30 days of account termination.
4. Usage and technical data.
   Logs (IP address, browser/user-agent, timestamps, pages and API endpoints accessed) and diagnostic and error data (error reports are sanitized before leaving our systems). Store analytics (for example sales, orders, and churn metrics for your stores) are a service feature computed from your own store’s data and processed on your behalf as described in the Data Processing Addendum; HostCore itself accesses that data only in aggregated, de-identified form across the platform (for example, platform-wide totals used in marketing).
5. Communications.
   Support requests, bug reports, feedback, and emails you exchange with us. Support tickets are handled in our own in-house system. If you choose to link your Discord account, ticket messages can be synced with Discord for your convenience; this is optional, requires you to manually link your account, and involves storing your Discord account identifier and sharing synced messages with Discord. Live chat on our public site is provided by Crisp; if you use it, your messages and anything you share in the chat are processed by Crisp. Emails we send you are delivered via Google Workspace.
6. Website data.
   We do not run advertising trackers or marketing pixels on our websites or in the Services. Our sites and the Services are served through Cloudflare, which processes visitor connection data (such as IP addresses) to provide content delivery and security, and we use Cloudflare Turnstile to protect sign-up, login, and similar forms from automated abuse. We also record which steps of sign-up are reached, on our own systems, under a random identifier your browser creates; these records hold nothing else that identifies you.
7. Product analytics (optional).
   If you allow Experience insights in cookie settings, our websites and the Services send PostHog the pages you visit, your clicks, scrolling and navigation on them, error reports, and recordings of your visits in which everything you type is masked. Once you sign in, this is linked to your account: your account ID, name, email address, business name, and plan. Until you allow it, PostHog’s code on our pages only fetches its settings, with a random identifier that changes on every page and nothing about what you do, and nothing is stored in your browser. Withdrawing your choice stops collection and clears PostHog’s cookie and local storage from your browser.
8. Ad click identifiers.
   If you arrive from one of our Google ads and allow Marketing in cookie settings, we keep the click identifier Google added to the link, and any campaign tags on it, in your browser’s session storage for that tab. If you then sign up, we store them with your account and send the click identifier back to Google Ads so we can measure which ads lead to sign-ups. No cookies are set for this, and nothing is kept if you don’t allow Marketing.

We collect this information directly from you and automatically through your use of the Services. We do not buy personal information from data brokers.

#How we use information

We use personal information to:

• provide, operate, secure, and support the Services (including authenticating you, processing gateway credentials, and delivering webhooks and notifications);
• send you account and service communications — service notices, security alerts, invoices, changes to terms, and the end of the Founding Access period — and occasional product announcements (typically a few per year), each of which includes a working unsubscribe for the non-essential ones;
• monitor, debug, and improve the Services, including through aggregated and de-identified analytics and, where you allow it, product analytics and session recordings;
• measure which of our ads lead to sign-ups, where you allow it;
• detect and prevent fraud, abuse, and security incidents; and
• comply with legal obligations and enforce our Terms.

Where the GDPR applies, our legal bases are: performance of our contract with you (service provision, account communications); our legitimate interests (security, product improvement, business operations — balanced against your rights); consent (product analytics and session recordings, ad conversion measurement, and marketing where required); and legal obligation.

#How we share information

We do not sell personal information. We share it only with:

• Service providers — OVH (infrastructure hosting in Australia, the United States, and the European Union); Cloudflare (content delivery, security, Turnstile bot protection, and encrypted backup storage); Google (Google Workspace, for email we send you, and Google Ads, which receives ad click identifiers as described above); PostHog (product analytics and session recordings, hosted in the United States — only if you allow Experience insights); Crisp (live chat on our public site); Sentry (error tracking — error reports are sanitized before transmission); and Discord (only if you opt into ticket syncing). Where tenants configure their own providers (for example their own SMTP or email API credentials, or their own CAPTCHA keys for their stores), those providers act for the tenant, not for HostCore;
• Stripe — when paid plans launch, to process your subscription payments (Stripe acts as an independent controller for payment processing);
• Professional advisers (lawyers, accountants) under confidentiality;
• Authorities where required by law, or where necessary to protect the rights, safety, or property of HostCore, our tenants, or others; and
• A successor entity in connection with a merger, acquisition, or sale of assets — in which case this policy continues to apply to information transferred.

#International transfers

We are a New Zealand company with infrastructure in Australia, the United States, and the European Union; personal information may also be accessed from New Zealand for administration and support. New Zealand holds a European Commission adequacy decision. Where information covered by the GDPR is transferred to a jurisdiction without an adequacy decision (including the United States), we rely on appropriate safeguards as described in our Data Processing Addendum.

#Retention

We keep personal information for as long as your account is active and as needed afterwards for the purposes above. Specifically:

• account data and Tenant Data: deleted following the 30-day post-termination export window in our Terms, subject to residual copies in backups, which are retained for no more than 30 days (full backups run daily, with continuous database backups; all expire within 30 days);
• gateway credentials: deleted from active systems within 30 days of termination;
• ad click identifiers: removed from your account 90 days after sign-up, with the records of the sign-ups and stores they led to deleted after 180 days;
• product analytics: events kept for 1 year and session recordings for 30 days;
• sign-up step records: deleted after 180 days;
• records we must keep by law (e.g. tax and accounting records): for the legally required period, typically 7 years in New Zealand.

#Security

We protect personal information with measures appropriate to an early-access service, including encryption in transit (TLS), encryption at rest for gateway credentials and other sensitive values, access controls, and network isolation between tenant stores. No internet service can guarantee absolute security; our Terms describe our breach-notification commitment.

#Your rights

Under the New Zealand Privacy Act 2020, you may request access to and correction of your personal information. Complaints may be made to us first, and to the Office of the Privacy Commissioner (privacy.org.nz).

Where the GDPR or UK GDPR applies to you, you additionally have rights to erasure, restriction of processing, data portability, and objection (including to direct marketing), and the right to lodge a complaint with your supervisory authority.

To exercise any right, contact legal@hostcore.co. We will respond within the timeframes required by applicable law (20 working days under the Privacy Act; one month under the GDPR). Note that requests concerning End Customer data must go to the relevant store owner; where such a request reaches us directly, we will refer it to them.

Our privacy officer for the purposes of the Privacy Act 2020 can be reached at legal@hostcore.co.

#Cookies

Some cookies are required for the Services to function: session and authentication cookies (including access and refresh tokens) and cookies set by Cloudflare for security and bot protection (including Turnstile). Our public site also loads Crisp, our live chat provider, which sets its own cookie to keep a chat conversation going as you move between pages.

Optional cookies are set only with your consent. If you allow Experience insights, PostHog sets a cookie, and uses your browser’s local storage, to recognise your browser across visits; the cookie lasts up to a year, and withdrawing your choice removes it. We do not use advertising or cross-site tracking cookies, and ad conversion measurement sets no cookies at all.

Your choice is kept in your browser for 12 months, or 6 if you turned everything optional off, before we ask again. You can change it at any time with “Cookie settings” at the foot of our sites.

#Children

The Services are business tools and are not directed at children. We do not knowingly collect personal information from anyone under 18. Contact us if you believe we have.

#Changes to this policy

We may update this policy. Material changes will be notified by email or dashboard notice at least 30 days before taking effect, consistent with our Terms. The date at the top reflects the current version.

#Contact

Privacy contact: legal@hostcore.co

General support: support@hostcore.co