Privacy and permanent infrastructure records

The information we collect depends on how you use the service and what your organisation chooses to record.

We collect information directly from account holders and organisation users, through records and files they submit, through authorised workflow actions, and from Stripe when billing events occur. We also receive limited technical information through the infrastructure used to deliver the service.

We use this information to authenticate users, provide organisation and property access, maintain connected infrastructure histories, support inspection and maintenance workflows, produce requested records and reports, administer subscriptions, prevent misuse, investigate faults and meet legal obligations.

Organisations and their users are responsible for having an appropriate basis to enter personal information about owners, contractors or other people into an infrastructure record, and for limiting that information to what is relevant.

Information is available to authenticated users according to their organisation membership, property access and assigned permissions. Organisation owners and administrators may manage team access. Property access may also be granted to another responsible organisation, such as a maintenance contractor.

A user’s access may end without deleting the legitimate property or infrastructure history that the user helped create. Share and handover links may make selected records available to their intended recipients for a limited purpose or period. Customers should treat those links as sensitive.

Stormwater Passport can associate a hashed resolver token with a physical QR or NFC-capable tag. The original token is not stored in the database in readable form.

Anyone who possesses a valid active tag can see the deliberately limited public asset identity shown by the resolver, such as the property display name, asset code, asset type, system, location and lifecycle status. Detailed history, documents and operational actions require appropriate authenticated access. Replacing a tag revokes the previous active token, but customers remain responsible for appropriate tag placement and physical control.

We use Supabase for authentication, database and private file-storage services, Vercel to host and deliver the application, Stripe for subscription and payment services, and Resend to deliver operational email notifications. These providers process information only as needed to provide their services to us and may process or store information outside New Zealand.

We may also disclose information where required by law, to protect the security or rights of users and the service, or as part of a properly managed transfer of the service. We do not sell personal information.

Stormwater Passport uses essential browser cookies for Supabase authentication sessions and to remember the organisation currently selected in the authenticated application. These are required for sign-in, access control and core application operation.

We do not currently use advertising cookies, analytics pixels or session-replay tracking. If that changes, we will update this policy and introduce consent controls where required.

We use access controls, private file storage, row-level database security, restricted server credentials and audit records to reduce the risk of unauthorised access or alteration. Some infrastructure actions preserve history through append-only or versioned records.

No internet service can guarantee absolute security or uninterrupted availability. Customers should use strong, unique credentials, protect share and tag links, and tell us promptly about suspected unauthorised access.

We retain information for as long as reasonably needed to provide the service, preserve legitimate infrastructure continuity, meet legal and security obligations, resolve disputes and maintain reliable audit history. The product does not currently apply one automatic deletion period to every category of record.

If a subscription expires or is cancelled, existing organisation records remain available on a read-only basis rather than being deleted solely because billing stopped. Decommissioning an asset, replacing a tag, changing property responsibility or ending a user’s membership also preserves the associated historical record.

A request to delete personal account information will be assessed separately from property and infrastructure history. We may correct, restrict, de-identify or retain information where deletion would compromise another party’s legitimate records, an audit trail or a legal obligation. We will explain any applicable limitation when responding to a request.

You may ask for access to personal information we hold about you and ask us to correct it. Because Stormwater Passport preserves infrastructure history, a correction may be recorded as a traceable update rather than silently overwriting or removing an earlier operational record.

For an organisation-managed record, your organisation administrator may be the quickest first contact. For an operator-level privacy request, complaint, account-data request or suspected privacy breach, email admin@stormwaterpassport.co.nz.

We may update this policy as the service, providers or legal requirements change. We will publish the updated version here, show its last-updated date and provide additional notice where a change is material.