Privacy statement

TRUE VALUE PROPERTY LIMITED (“True Value”, “we”, “us”) is a New Zealand company that provides buyer-side property intelligence reports. We are the agency that collects and holds the personal information described below.

• Website: https://truevalueproperty.co.nz
• Privacy contact: privacy@truevalueproperty.co.nz

We currently collect and hold:

• Your email address used for sign-in. Previously linked mobile numbers may remain on existing accounts; new SMS sign-in is no longer offered.
• Your display name and selected New Zealand region, if you choose to enter them in Account settings.
• Authentication identifiers — an internal account ID, sign-in timestamps, and email or phone verification timestamps held by our authentication provider.
• Basic Google account profile information (name, email address and profile metadata) if you choose to sign in with Google.
• Property addresses you search for, and the search history generated by those searches.
• Properties you save, together with any note you add to them.
• The property reports we generate for you, and the PDF exports you create (stored in a private file store).
• If you buy an additional PDF export: the order, amount, currency, payment status, receipt email and Stripe transaction identifiers needed to deliver, support, refund and reconcile the purchase.
• Comparison activity — which of your saved or searched properties you compare.
• Messages you send us by email, and any feedback you submit in the app (including a contact email address if you provide one).
• Product analytics events (for example: page viewed, address search started, report completed, PDF exported) linked either to your account ID or to a random device identifier stored in your browser.
• Technical and security logs — error messages, provider call logs, timing and diagnostic data generated when the service runs.
• Public property information about the addresses you search, obtained from Land Information New Zealand (LINZ), territorial authorities and councils, Stats NZ, the Ministry of Education and the Education Review Office, Tenancy Services and other public sources.
• If you join the waitlist: your email address and the page you signed up from.

What we do not collect. Stripe handles payment-card entry and True Value does not receive or store your complete card number or security code. We do not collect precise GPS location or derive your city or region from your IP address. Customer document upload is currently switched off in the live product; if we re-enable it, we will update this statement first.

• Directly from you — when you create an account, sign in, provide an email address or mobile number, verify your account, enter a display name or region, search an address, save a property, make a purchase, contact support or submit feedback.
• Generated by your use — search history, reports, PDFs, comparison activity, analytics events and technical logs are created automatically as the service runs.
• From authentication, payment and technical providers — Google supplies basic profile information when you use Google sign-in; our database, authentication and email delivery providers generate account, verification and delivery records; Stripe supplies the status and identifiers for a payment, refund or dispute.
• From public sources — property, hazard, valuation, school and market information is retrieved from public agencies and data providers using the address you search. This is information about a property, not about you.

• Creating, securing and administering your account.
• Signing you in, including Google sign-in, and verifying your email address or mobile number.
• Generating property reports and saving them to your history.
• Remembering your searches and saved properties so you can return to them.
• Producing and storing PDF exports of your reports.
• Providing free online reports during the beta and checking PDF purchase access.
• Creating and fulfilling additional PDF orders, sending receipts, reconciling payments and handling refunds or disputes.
• Answering support requests and acting on feedback.
• Detecting and preventing abuse, and diagnosing technical faults.
• Product analytics — understanding which parts of the service are used and where they fail, so we can improve them.
• Sending product update emails only if you have switched that on in Account settings. We are not running marketing campaigns at present.
• Meeting legal obligations and responding to lawful requests.

We do not sell personal information, and we do not use it for advertising or profiling by third parties.

You can read the home page, pricing and other public pages without giving us anything. To create an account you must sign in with Google, provide an email address and password. Without one of those methods we cannot create or secure an account for you.

To generate a report you must enter a property address; without an address we have nothing to look up. Display name, region, notes on saved properties and feedback are all optional, and leaving them blank does not restrict the service.

We use a small number of processors to run the service. They act on our instructions and may only use the information to provide their service to us.

• Database, authentication and file storage — Supabase (provided through the Lovable platform), which holds accounts, profiles, search history, saved properties, reports, PDFs and logs.
• Application hosting and delivery — Lovable and Cloudflare, which serve the website and run our server-side code.
• Payment processing — Stripe, which hosts Checkout, processes payment details and sends payment and refund status to True Value. Stripe may send purchase receipts using the email address supplied at Checkout.
• Google — Google sign-in, and Google Maps Platform for address autocomplete and geocoding. The address text you type is sent to Google to return suggestions.
• Email delivery — the Lovable email service, used for account emails such as confirmation and password reset.
• AI extraction is retired for this release. Previously accepted document facts remain in saved reports; new documents and listing links are not sent to an AI gateway.
• Property and public-record data providers — LINZ, Koordinates, territorial authorities and councils, Stats NZ, the Ministry of Education, the Education Review Office and Tenancy Services. We send them a property address or location, not your identity.
• Professional advisers, insurers or authorities, where disclosure is required or permitted by law.

Product analytics are recorded in our own database rather than a third-party analytics product. There is no Google Analytics, Meta pixel or similar advertising tracker on this site.

Some of your personal information is stored and processed outside New Zealand. Our database, authentication service and PDF storage run in Amazon Web Services’ Asia Pacific (Tokyo) region in Japan. Hosting, email delivery, Google sign-in, Google Maps, payment processing, AI processing and web retrieval are provided by global services that may process information in other countries, including the United States.

We rely on these providers’ contractual terms and their own security programmes to protect information they hold for us. We cannot guarantee that overseas privacy law is identical to New Zealand law; by using True Value you accept that your information may be processed overseas as described here.

• Sign-in state is kept in your browser’s local storage (not a cookie) by our authentication provider. It is essential — clearing it signs you out.
• A random device identifier is stored in your browser so anonymous analytics events can be grouped into a single visit. It contains no name, email address, mobile number or location.
• Recent searches shown on the home page are stored on your own device until you clear them.
• Analytics events are sent to our own database. There are no advertising cookies, third-party trackers or cross-site tracking on this site, so we do not display a cookie consent banner.
• You can clear this data at any time by clearing site data in your browser, and you can clear your saved search history from your account. Blocking browser storage entirely will prevent sign-in from working.

Protections we can confirm are in place:

• Accounts use email and password or Google sign-in through a managed authentication provider. We never see or store your password. Existing account records and sessions are retained when SMS sign-in is retired.
• Database row-level security is enabled, so your profile, searches, saved properties, reports, PDF records and preferences can only be read or changed by your own signed-in account.
• Report PDFs are held in a private file store and are served through short-lived links to the account that owns them.
• Server-side code checks your identity on every request that touches your data; administrative functions are restricted to specific staff roles.
• Traffic to the site is served over HTTPS, and our providers encrypt data in transit and at rest on their platforms.
• Administrative actions such as an account deletion request are written to an audit log.

No online service can be completely secure. We do not claim that every staff view of data is individually logged, and we do not claim that information stays in New Zealand. If you believe your account has been compromised, email support@truevalueproperty.co.nz.

We keep personal information only as long as we need it for the purposes above, or as long as the law requires. In practice:

• Account, profile, search history, saved properties, report and PDF records are kept while your account is open.
• A verified mobile number and related verification metadata are kept while your account is open. SMS providers may retain operational delivery and security logs under their own retention policies.
• You can delete individual saved properties and clear your search history yourself at any time.
• We have set target retention periods for operational records: analytics events 365 days, report version snapshots 365 days, provider call logs 180 days, resolved system error logs 180 days.
• Backups held by our database provider are retained on that provider’s own cycle and are outside our direct control.

Known limitation, stated honestly. Those retention periods are configured but are not yet automatically enforced by a scheduled deletion job, so older operational records may still be held beyond the target period. Account deletion is currently a request: choosing “Delete account” records your request and we action it manually. We are building automated deletion, and we will update this statement when it is live.

Under the Privacy Act 2020 you can ask us to:

• Give you access to the personal information we hold about you.
• Correct information that is wrong or out of date — you can edit your display name and region in Account settings, and ask us to correct or update other account information.
• Delete your account and associated personal information, by using “Delete account” in Account settings or emailing us.
• Stop sending you product update emails — switch them off in Account settings, or ask us.

There is no automatic “download all my data” button yet. If you want a copy of your information, email privacy@truevalueproperty.co.nz and we will provide it. We may need to confirm your identity first, and we will respond within 20 working days.

If you are concerned about how we have handled your information, contact privacy@truevalueproperty.co.nz. We will acknowledge your complaint and tell you how we intend to deal with it.

If you are not satisfied with our response, you can complain to the New Zealand Office of the Privacy Commissioner: privacy.org.nz/your-rights/making-a-complaint/.

If we suspect a privacy breach we will assess it promptly, contain it, and decide whether it is likely to cause serious harm. Where the Privacy Act 2020 requires it, we will notify the affected people and the Office of the Privacy Commissioner as soon as practicable after becoming aware of the breach.

True Value is designed for people buying or researching property in New Zealand, and is not aimed at children. Our current terms of use do not set an 18-and-over restriction. If you believe a child has given us personal information, email privacy@truevalueproperty.co.nz and we will remove it.

We update this statement as the product changes. The effective date at the top shows the current version. For material changes we will show a notice in the app and, where the change significantly affects how we use your information, ask you to accept the updated statement when you next sign in.

• Privacy requests, access, correction, deletion and complaints: privacy@truevalueproperty.co.nz
• Help with your account or a report: support@truevalueproperty.co.nz
• General and business enquiries: hello@truevalueproperty.co.nz