Privacy Policy
1. Introduction
- 1.1 YOLK SOFTWARE LIMITED (Chur, we, us) provides review-invitation software to New Zealand businesses. This notice explains how we handle personal information under the Privacy Act 2020. It is not a guarantee of any overseas privacy regime.
- 1.2 This notice distinguishes website visitors, Client users (the subscribing business and its operators), and Recipients (that business's customers, clients, or patients). Plan prices and SMS rates are disclosed at purchase, not in this notice.
2. Collection
- 2.1 Website visitors: we collect information needed to operate the site and sign-in, including necessary cookies, and limited technical data such as IP address and device or log data used for security and rate limiting.
- 2.2 Client users: we collect business name, sign-in email, password (encrypted and held by our auth provider), optional billing plan selection, agreement records, owner name collected in onboarding, feedback email, branding, campaign templates, support messages, and billing and usage identifiers.
- 2.3 Recipients: we collect names and contact details you provide or import, source information (manual entry, spreadsheet, Xero, or Quick Send), message content, delivery and status events, review-gate interactions, private feedback free text, and opt-out records. We collect this from you, not usually from the Recipient directly. We also collect limited technical data from Recipients who open a review link, including IP address used for rate limiting, and delivery or interaction events.
- 2.4 We do not receive full card numbers. Stripe collects payment-method details on its hosted checkout and billing surfaces and tells us whether payment succeeded.
- 2.5 Analytics: We use PostHog to understand visitor sources, signup and onboarding drop-off, and app usage. This includes page views, campaign tags, browser and device information, performance measurements, interactions and account lifecycle events. Signed-in activity is associated with the user's account ID and business account.
- 2.6 Session recordings: We record journeys on marketing, signup, onboarding and owner app pages to investigate usability problems. Password fields are masked. Other visible content and non-password inputs—including customer information displayed in the app—may appear in recordings. Chur's recorder does not run on Stripe's hosted payment pages.
- 2.7 Recipient Pages: PostHog collects only anonymous page views and performance measurements. No session recordings, form-input capture or account identification. Chur's operational delivery, feedback and opt-out records remain separate.
3. How information is used
- 3.1 Where we hold Recipient information solely on a Client's behalf, Privacy Act section 11 may treat us as holding it for that Client. Labels in a contract do not decide that test. We also use information for our own account, billing, service operation, security, suppression, support, and lawful compliance.
- 3.2 Recipient information is used to send invitations and reminders you instruct, collect private feedback for the relevant business, operate suppression, prevent accidental recontact, provide support, and meet legal duties. The relevant business can see delivery and status events, the Review Gate response, and private feedback. Private feedback is not automatically published as a public review.
- 3.3 We do not use Recipient information for Chur's unrelated marketing, research, AI training, or sale. We do not operate an own-marketing Recipient database.
- 3.4 A policy page does not create Recipient consent or prove that you delivered collection notices. You remain responsible for applicable notices to Recipients, including indirect-collection transparency.
4. Storage, security and retention
- 4.1 Application data is stored in our hosted database and object storage. We use tenant isolation, authenticated access controls, and service-role limits as implemented in the product.
- 4.2 While an account is active we keep information needed to provide the Services. That is not a claim that indefinite retention of every field is necessary. If a subscription is cancelled but the account is not deleted, we keep the information until a verified deletion is completed or we no longer need it for billing, suppression, security, or legal duties.
- 4.3 We retain billing and accounting records as required. We retain the minimum suppression evidence needed to prevent accidental recontact. Backups and providers may hold copies for a limited time after deletion. We do not call linkable phone or email hashes anonymous.
5. Disclosure, providers and overseas processing
- 5.1 We share information with providers only as needed to operate the Services, or where required by law. Source-backed providers and roles are: Stripe (payments); Xero (optional accounting import); SMSGate (SMS); Resend (email); Supabase (auth, database, storage); Inngest (workflow orchestration); Google Places (review-destination lookup); Sentry (error reporting); Upstash Redis (rate limiting, including Recipient IP keys); Vercel (application hosting); and PostHog (website and product analytics, performance measurements and session recordings). Operational review-activity tracking is handled by Chur separately from PostHog analytics.
- 5.2 Overseas disclosure is assessed under the Privacy Act, including principle 12. Unverified countries and contract terms are not replaced with a false assurance in this notice.
- 5.3 Overseas processing: Our PostHog project is hosted in the European Union, outside New Zealand. PostHog and its subprocessors may process information elsewhere for service operation and support. We assess applicable overseas-processing safeguards under the Privacy Act. See PostHog's privacy notice at https://posthog.com/privacy.
6. Payment information
- 6.1 Stripe hosts checkout and billing. Stripe collects the payment method you enter. We receive customer, subscription, invoice, and payment-status identifiers, not full card numbers. See Stripe's privacy notice for its practices.
7. Cookies
- 7.1 Cookies and storage: PostHog uses cookies and local storage on marketing and owner-facing pages to recognise visits, retain attribution and connect signed-in journeys. Recipient Page analytics use a temporary in-memory identifier only. Browser settings can control cookies and storage; blocking necessary cookies may prevent sign-in. We do not use PostHog for advertising targeting.
8. Health information
- 8.1 Health and disability providers may use the Services. We do not operate a separate health product or health data schedule. Contact details linked to a clinic can be health information. Free-text feedback may include sensitive material. We do not claim that no health information is processed, and we do not filter message content automatically.
- 8.2 Clients remain responsible for the Health Information Privacy Code, professional advertising and testimonial rules, and actual patient permission. Do not submit treatment or clinical details in Chur fields or messages.
9. Privacy breaches
- 9.1 If we have reasonable grounds to believe a privacy breach has caused or is likely to cause serious harm, we will notify the Privacy Commissioner and affected individuals as soon as practicable, as required by the Privacy Act.
10. Rights, complaints and contact
- 10.1 You may request access to or correction of personal information we hold. We aim to respond within 3–5 working days. For privacy concerns, contact team@churreviews.co.nz.
- 10.2 Recipients may also ask the relevant Client, or us, about information we hold. Opt-out of SMS by replying STOP to a customer message, and of email through the unsubscribe link. Suppression is applied immediately for future sends we control. A Recipient SMS opt-out stops further SMS from that Client to that phone and cannot be overridden by the Client. It does not automatically stop email or other Chur businesses.
- 10.3 We may update this notice by publishing a new version. The “Last updated” date on this page shows the current version.