Privacy Policy

1. Privacy officer and business identity

The agency collecting your information is Native Grain Co.. Our privacy officer, contactable at nativegrainco2@gmail.com for any privacy question or request.

2. Scope

This policy applies when you:

• browse this website;
• purchase a product;
• contact us with an enquiry;
• join our mailing list;
• request customisation or restoration work;
• offer furniture for sale or trade;
• submit a review or testimonial; or
• interact with us through social media or Trade Me.

We don't currently offer customer accounts, workshop visits by appointment and delivery are arranged directly by email once you've placed an order.

3. Personal information we collect

Depending on how you interact with us, we may collect:

• your name, email address, and phone number;
• billing and delivery addresses;
• order history and transaction identifiers (from Stripe, not your card details);
• enquiry, customisation, and sell/trade information you send us;
• delivery instructions and access information;
• photographs you send us of furniture (for sell/trade enquiries) or your piece in its new home;
• marketing preferences;
• website usage data, IP address, device and browser information, and cookie identifiers (only with your consent for analytics/advertising cookies, see below); and
• records of your communications with us.

Payment card information is entered directly into Stripe's own secure checkout, we never receive or store your full card number.

4. How we collect information

We collect information directly from you, through:

• our checkout, contact, enquiry, newsletter, and sell/trade forms;
• email, phone, and social media;
• Trade Me messages, where relevant;
• cookies and analytics tools, only once you've given consent (see Cookies); and
• our delivery and payment providers, who pass back information needed to fulfil your order.

5. Purpose of collection

We collect and use personal information to:

• process and deliver your order;
• take payment and prevent fraud;
• communicate order and delivery updates;
• respond to enquiries and provide customisation, restoration, or valuation services;
• manage warranty claims;
• keep transaction records for accounting and tax purposes;
• understand and improve site performance;
• personalise and measure advertising, where you've consented to it;
• send marketing where you've opted in, or another lawful basis applies; and
• protect our legal rights and maintain site/customer security.

We don't use your information for any purpose beyond these.

6. Required and optional information

To process an order, we need your name, contact details, and delivery address, Stripe separately collects your payment details. If you don't provide this, we can't complete your order. Everything else, including marketing sign-up, is optional, and marketing consent is never required to purchase from us.

7. Cookies and similar technologies

We use a small number of cookies and local/session storage technologies, grouped into these categories:

We ask for your choice through a cookie banner shown on your first visit, analytics and advertising cookies stay off until you actively accept them, browsing the site alone is not treated as consent. You can change your choice at any time using the Cookie Preferences link in our website footer. You can also control or delete cookies through your browser settings, disabling strictly necessary storage may affect your cart and checkout.

8. Analytics and advertising

When you've consented to advertising cookies, we use Meta's Pixel and Conversions API to measure how our website visits and purchases relate to our Meta (Facebook/Instagram) ads. This can include your website activity, and, for completed purchases, a cryptographically hashed version of your email address and your IP address, sent to Meta so it can match your purchase to an ad you may have seen, this isn't anonymous, hashing makes it harder to read directly, but Meta may still be able to link it to your account. Meta processes this information under its own privacy terms as well as ours.

When you've consented to analytics cookies, we use Google Analytics 4 to understand website usage (pages viewed, general location, device type). We also use Vercel Analytics and Speed Insights, our hosting provider's own cookieless, first-party tools that measure page performance and aggregate usage without setting a tracking cookie, these run regardless of your cookie choice since they don't use cookies or identify you individually.

You can withdraw analytics/advertising consent at any time via Cookie Preferences in the footer.

9. Marketing communications

We only send marketing emails (for example, about newly restored pieces) where you've opted in, either through our newsletter sign-up or the “email me early access” checkbox at checkout, which is never pre-ticked. Every marketing email clearly identifies Native Grain as the sender and includes a working unsubscribe link, processed promptly. We keep a record of your marketing consent so we can honour it.

Unsubscribing from marketing doesn't affect transactional messages, order confirmations, delivery updates, warranty, and service communications, which we'll still send you as needed to fulfil your order.

10. Disclosure to service providers

We share only the information reasonably needed to provide our service with:

• Stripe — Payment processing (card details are collected and stored by Stripe, never by Native Grain).
• Vercel — Website hosting and first-party, cookieless page-performance analytics (Vercel Analytics / Speed Insights).
• Upstash — Database (tracks which one-of-a-kind pieces have sold; no customer personal information is stored here).
• Resend — Sending enquiry, contact, sell/trade, and order-notification emails.
• MailerLite — Newsletter/early-access email list management.
• Meta (Facebook/Instagram) — Advertising Pixel and Conversions API — website activity and, for completed purchases, a hashed email address and IP address, used to measure and improve ad performance.
• Google — Google Analytics 4 — website usage analytics.

We may also disclose information to our accountant, insurer, or professional advisers, to delivery/freight partners to complete a delivery, to government or regulatory authorities where legally required, and to a prospective business purchaser during a genuine sale process, subject to appropriate confidentiality safeguards. Using a third-party provider doesn't reduce our own responsibility for your information.

11. Overseas processing

Several of our service providers, including Stripe, Meta, Google, Vercel, Resend, and MailerLite, are based overseas (primarily the United States), and may process personal information outside New Zealand as part of providing their services to us. Where a provider processes information solely on our behalf (for example, Stripe processing a payment), we remain responsible for that information under New Zealand's Information Privacy Principle 12. Some providers, such as Meta and Google, also use information for their own purposes under their own privacy terms, we encourage you to review those where relevant. We haven't independently verified that every overseas provider offers privacy protections equivalent to New Zealand law, and we don't claim that they do.

12. Data security

We take reasonable steps to protect personal information, including access controls, restricted staff access, secure payment processing through Stripe, keeping software up to date, encryption where applicable, regular backups, choosing reputable providers, and having a process to respond to security incidents. While no online system can be guaranteed completely secure, we take reasonable steps to protect personal information from loss, unauthorised access, misuse, and disclosure.

13. Retention

We keep personal information only for as long as reasonably necessary for the purpose we collected it. As a general guide: order and transaction records are kept for our accounting and tax obligations, warranty-related information is kept for the warranty period plus a reasonable period after, enquiry records are kept while relevant to an ongoing conversation or dispute, and marketing consent records are kept until you unsubscribe plus a short period to honour that choice. Where we no longer need information, we delete or anonymise it, or securely dispose of it.

14. Access and correction rights

You can ask us to access or correct the personal information we hold about you by emailing nativegrainco2@gmail.com. We may ask you to verify your identity first. We don't charge a fee for a reasonable request. We'll respond as required by the Privacy Act 2020, though some requests may be subject to lawful exceptions, if we can't action a request in full, we'll explain why, and, where you disagree with a correction we've declined, you can ask us to attach a statement of correction to your record.

15. Marketing preference rights

You can unsubscribe from marketing emails using the link in any marketing email, or by emailing us. Please allow a short, reasonable period for this to take effect. Transactional messages about an order you've placed will still be sent. We keep a record that you've unsubscribed so we can respect that choice going forward.

16. Privacy complaints

1. Contact our privacy officer at nativegrainco2@gmail.com.
2. Explain your concern.
3. We'll investigate and respond.
4. If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner (privacy.org.nz).

17. Privacy breaches

We maintain a process to assess privacy breaches. Where a breach has caused, or is likely to cause, serious harm, we'll notify affected individuals and the Office of the Privacy Commissioner as soon as reasonably practicable, as required under the Privacy Act 2020.

18. Children's information

This website isn't specifically directed at children. We don't knowingly seek out information about anyone under 18 beyond what a parent or guardian provides as part of a normal order. If we become aware that personal information about a child was provided without appropriate authority in circumstances that raise a concern, please contact nativegrainco2@gmail.comand we'll look into it.

19. Social media and marketplaces

When you interact with us through Facebook, Instagram, Trade Me, or another marketplace, that platform's own privacy terms also apply. We may receive information from these platforms, such as a message you send us or public engagement with our posts, and use it to respond to you or understand how our content performs, we don't receive private account details from these platforms beyond what they choose to share with businesses.

20. Reviews, photos and testimonials

The reviews currently shown on our website are genuine feedback migrated from our previous trading name's Trade Me store, we display the reviewer's Trade Me username (not their real name, which we don't have) and don't invent or materially alter their content. If you send us a photo of your piece or a testimonial and we'd like to feature it, we'll only do so with your permission, and we'll ask how you'd like to be identified, if at all. You can ask us to remove submitted content at any time, and we'll do so where reasonably possible.

21. Policy updates

We may update this policy from time to time. The current version is always available on this page, with the “last updated” date shown above. Where a change is material, we'll take reasonable steps to let you know directly where appropriate. Your information is always handled under the version of this policy in effect at the time.