Loading
Last updated 15 October 2026
This explains what we collect, why, and what you can do about it. It is written to meet the Privacy Act 2020, and written to be read.
Short version: we collect what a visit actually requires and nothing else, we store it in Australia, and you can ask for a copy or ask us to delete it at any time.
Kelburn Critter Care is a small pet feeding and house sitting business based in Kelburn, Wellington. We are the agency responsible for the personal information described here.
Privacy contact: the business owner, at kelburncrittercare@gmail.com. We reply within 20 working days, which is the statutory limit.
Most bookings are paid by bank transfer, so we see the name and account your payment came from, the amount and the reference, as on any bank statement. When card payments are offered, they are handled entirely by Stripe: we never see, receive or store your card number, and we receive only a confirmation that the payment succeeded, the amount and a receipt link.
A session cookie, if you sign in. It is httpOnly, so JavaScript on the page cannot read it. Google Ads and the Meta Pixel measure which of our ads lead to bookings. There is no Google Analytics. See Cookies, below, including how to turn ad measurement off.
Alarm codes, key locations and gate codes, unless you choose to send them. Access is usually arranged in person at the meet & greet, and we never ask for a code on the way to paying.
If it is easier to send a code, you can add it in the optional access section of the booking form, or from your own booking page later, never by text or email. Either way, what you send is encrypted with a key that is not stored in the database. Only the owner, team members with admin access, and the feeder assigned to your booking can open it, and the feeder only from the day before your booking starts until the day after it ends. Every opening is recorded, and it is destroyed automatically seven days after your booking ends. We cannot show it back to you, which is deliberate.
Four kinds, and they are not the same thing.
Keeping you signed in. When you sign in we store a session cookie. Without it there is no way to show you your own bookings rather than somebody else's, so it is not optional and we do not ask permission for it. It is removed when you sign out. It cannot be read by JavaScript, and it is only ever sent back to this site.
Counting visits. If analytics is switched on, Google Analytics stores cookies to work out how many people read a page. This one is optional, we ask before loading it, and refusing is one click. If you have not answered, or you said no, the analytics code is never sent to your browser at all. We also turn off ad personalisation and have your IP address shortened before Google stores it.
Where you came from. If you arrive through one of our links, a flyer's QR code or an ad, we keep that link's tags (its source and campaign, nothing about you) in a cookie for 30 days, and save them with a booking you make in that time. Only this site reads it. To clear it, clear this site's cookies in your browser.
Measuring our ads. We advertise on Google and on Facebook and Instagram, and use the Google Ads tag and the Meta Pixel to learn which ads lead to bookings. They set cookies from Google and Meta, and when you make a booking they are told that a booking was made, its reference and its total, nothing else: not your name, your address or your animals. Google and Meta may also use these cookies to show you our ads elsewhere. They are on unless you turn them off below. You can also limit this in your Google ad settings and Meta ad preferences.
An unfinished booking. This one isn't a cookie. If you start a booking without signing in, we keep what you've typed in this browser for up to 24 hours, so it isn't lost while you confirm your email. It never includes access details such as a key tag, a lockbox code or an alarm code, and nothing you typed is saved on our side until your email is confirmed. It is deleted as soon as you book, when you press Start again, or when you sign out. To clear it sooner, clear this site's data in your browser.
We never sell your information or share it with anyone for their own marketing.
Our database and file storage are hosted by Supabase in Sydney, Australia. Our website runs on Vercel, which serves it from data centres in several countries.
This means your information is stored outside New Zealand. Australia has privacy laws comparable to ours, and we are required to tell you this rather than let you assume otherwise. If you pay by card, the payment data is held by Stripe (United States and Ireland). Email is sent through Resend.
When you ask us to delete your account, we strip your name, phone, address, emergency contacts, vet details, care notes, and pet profiles, and delete your home notes and any access notes immediately. What survives is the minimum financial record IRD requires: dates and amounts, with no identifying detail attached.
If Kelburn Critter Care is sold or passed to someone else, your account, your animals' details and your booking history go with it, so the new owner can keep caring for your animals. They must keep to this policy. We will email you before it happens, and you can ask us to delete your account first.
Under the Privacy Act 2020 you can:
Email kelburncrittercare@gmail.com and say what you want. You do not need to use any particular wording.
Tell us first. Most things are a misunderstanding and we would rather fix it. If that does not resolve it, you can complain to the Office of the Privacy Commissioner:
Their service is free and you do not need a lawyer.
Every table in our database has row-level access rules, so one customer cannot read another's booking even if something else goes wrong. Photos live in a private store and are served through links that expire. The site is served over HTTPS only.
No system is perfect. If something does go wrong and it is likely to cause you serious harm, we will tell you and notify the Privacy Commissioner, as the Act requires.
If we change this policy in a way that affects you, we will email you before it takes effect rather than quietly changing the date at the top.