GGenerosity.co.nz

Privacy Policy

Generosity.co.nz ("we", "us", "our")

Version: 3.0 · Effective date: 25 August 2026

3.0 changes: clarified that we are not a financial service provider; expanded what we collect (Stripe metadata, communications, logs, images, location approximations, fraud signals); added lawful bases, the direct-charge model, business fulfilment sharing, fraud and AI processing, breach notification, and data portability.

1. Who we are

We operate Generosity.co.nz, a New Zealand fundraising platform that connects fundraisers, donors, buyers and businesses. We are an "agency" under the Privacy Act 2020.

We are not a financial service provider and do not provide banking, payment, lending, remittance or other regulated financial services. We are not a trustee or fiduciary for any user, and we do not hold, control or route funds.

2. What we collect

We collect information you give us, information generated by your use, and information from third parties:

  • Account information: name, email, password (hashed), profile details, phone, address, and business details for wholesale accounts.
  • Verification information: identity, business and charity registration details where required for onboarding or verification.
  • Transaction information: donations, orders, refunds, payouts, disputes and related records. We do not store full card numbers — card details are handled by Stripe. We may receive metadata from Stripe such as verification status, risk scores and fraud signals. Where a business pays a fundraiser's commission, Stripe's secure card-cloning feature shares a card reference with the fundraiser's Stripe account so the commission can be collected automatically.
  • Content: stories, listings, reviews, messages, updates, and images you upload to campaigns or listings.
  • Communications: support tickets, emails and messages you send us.
  • Technical information: IP address and approximate location derived from it (such as region), device and browser, pages visited, and security and access logs.
  • Fraud and misuse information: information we collect or receive about suspected fraud, suspicious activity or breaches of our Terms.
  • Publicly available information: for example, charity registers, where relevant to verification.
  • AI processing: content you ask our AI tools to generate.

3. How we use information

We use information to:

  • operate the Platform (accounts, campaigns, listings, payments, payouts);
  • process and verify transactions, refunds and disputes;
  • prevent fraud and abuse, including risk scoring and screening of campaigns, orders and accounts;
  • moderate content and enforce our Terms of Service;
  • comply with our legal obligations, including gambling (raffle) rules administered by the Department of Internal Affairs;
  • provide AI-assisted content generation;
  • send service messages, receipts and (with consent) marketing updates;
  • improve, secure and maintain the Platform, including training our internal moderation tools (not third-party AI models);
  • comply with requests from courts, regulators or law enforcement.

4. Lawful bases and information privacy principles

We rely on consent, contract necessity and legitimate interests as lawful bases for processing personal information. We collect personal information only for purposes that a reasonable person would consider directly related to the activities above, and not in a way that is unfair or intrusive.

5. Payments and Stripe

Payments are processed directly between users via Stripe Connect. The Platform does not receive, hold or control donation, sale or commission funds, and does not have access to full card numbers or bank account details.

Stripe may require additional information to verify your identity or comply with financial regulations. If verification is not completed, Stripe may delay payouts or restrict account functionality — this is outside our control.

6. Who we share information with

  • Stripe (payment processing, Connect accounts, fraud prevention);
  • Businesses supplying wholesale items — where you buy through a fundraiser, your details (such as name, email and delivery information) may be shared with the supplying business so it can fulfil your order;
  • Service providers such as hosting, cloud infrastructure, email, analytics, identity-verification and moderation or fraud-detection providers;
  • OpenAI (or similar) when you use AI content tools — content you submit is processed to generate drafts;
  • Other users where necessary to a transaction (e.g. seller to buyer);
  • Authorities or courts where required by law or to protect rights.

We don't sell your personal information. We do not share donor or buyer details with fundraisers unless necessary for fulfilment, a transaction, or legal compliance.

7. Overseas disclosure

Some providers (including Stripe and OpenAI) store or process data overseas, and may do so in multiple jurisdictions. By using the Platform you consent to these disclosures. We take reasonable steps to ensure overseas providers apply safeguards comparable to New Zealand privacy law.

8. Security

We use appropriate technical and organisational measures, including encryption in transit, hashed passwords, access controls, and two-factor authentication where offered. We review our security practices regularly. No system is perfectly secure.

If a privacy breach occurs that poses a risk of harm, we will notify affected individuals and the Office of the Privacy Commissioner as required by law.

9. Retention

We keep personal information only as long as needed for the purposes above, including financial and audit records required by law, moderation logs and fraud investigation records. Some information may be retained longer where required for fraud prevention or legal compliance. When no longer needed, we delete or de-identify it. Stripe also retains its own records independently under its own terms.

10. Your rights

Under the Privacy Act 2020 you may:

  • ask what personal information we hold about you;
  • ask for access to it;
  • ask for it to be corrected;
  • request deletion where lawful (financial records may need to be retained);
  • request a copy of your personal information in a portable format where feasible;
  • complain to us or to the Privacy Commissioner.

Requests may require identity verification to protect your information. Contact: privacy@generosity.co.nz

11. Cookies and analytics

We use essential cookies for authentication and may use third-party analytics tools to understand usage. Non-essential cookies (such as marketing cookies) are only used with your consent, where offered. You can control cookies in your browser.

12. Children

The Platform is not directed at children under 13, and we do not knowingly collect their personal information without a parent or guardian's consent. Parents or guardians may request access to, or deletion of, a child's information where lawful.

13. AI tools and automated processing

We may use automated systems and manual review to detect fraud, suspicious activity or breaches of our Terms. This may include analysing transaction patterns, device information and behavioural signals. Content generated by AI may be reviewed or moderated. We do not use your personal information to train AI models.

14. Changes

We may update this policy and will publish changes here. For significant changes we will notify users reasonably in advance where practicable.

15. Complaints

If you're unhappy with how we handle your information, contact us first. You can also complain to the Office of the Privacy Commissioner (privacy.org.nz).