Privacy
We collect the least we can: your email if you join a waitlist, and your name, address, email and phone if you order. We never sell or rent it. This page sets out who else handles it, which of them are overseas, and how to ask for a copy or have it deleted, under the Privacy Act 2020.
Last updated 15 September 2026.
Who we are
NZ Candles is a trading name of Kauri Ridge Holdings Limited, NZBN 9429050000017. Level 1, 12 Kōwhai Lane, Grey Lynn, Auckland 1021. Privacy questions go to hello@nz-candles.co.nz.
What we collect, and why
- Waitlist and newsletter: your email, optionally your first name, and what you said you were interested in. We use it to email you when the shop or the club opens, and for nothing else.
- Club preferences: the scent families you choose and anything you ask us never to send. We use it to choose your candle.
- Orders:your name, email, phone, delivery address and, for gifts, the recipient's name and address and the message you asked us to print. We use it to pack and send the order and to talk to you about it.
- Contact and maker forms: whatever you put in them.
- Card details:we never see them. Payment happens on Stripe's own hosted checkout, and all we get back is a confirmation, the last four digits and the amount.
- Technical information:when you submit a form we record the request's IP address, browser, referring page and approximate location from your network, which helps us spot spam and understand where enquiries come from.
- Analytics: anonymous page views and clicks through PostHog, to see which guides are read and which links are used.
Gift recipients
If you send a gift, you're giving us someone else's name and address. We use it to deliver the parcel and then keep it only as part of your order record. We don't email them, add them to any list, or tell them what it cost.
Who else handles it
- Stripe — payments, subscriptions and the customer portal. United States and Ireland.
- Notion — where orders, club memberships and form submissions are recorded. United States.
- Resend — the service that sends our emails. United States.
- Vercel — hosting for this website. United States.
- PostHog — analytics. United States.
- A courier or NZ Post — the delivery address, so your parcel arrives.
Several of those are overseas, so your information is stored outside New Zealand. Principle 12 of the Privacy Act 2020 requires us to be satisfied that an overseas provider protects your information to a comparable standard, and we use established providers with published privacy terms on that basis. We don't sell, rent or trade your information to anyone, ever.
How long we keep it
- Order records: seven years, because tax law requires it.
- Waitlist and newsletter: until you unsubscribe or ask us to delete it.
- Contact messages: two years, so we have the history if you write again.
- Analytics: as long as PostHog holds it under our plan, and it isn't tied to your name.
Your rights
Under the Privacy Act 2020 you can ask for a copy of what we hold about you, ask us to correct it, and ask us to delete it where we don't have to keep it. Email us or use the contact pageand we'll respond within 20 working days, which is the statutory limit.
Every marketing email carries an unsubscribe link, and unsubscribing doesn't affect emails about an order you've placed.
Cookies
This site sets no advertising or tracking cookies. PostHog sets a first-party cookie to tell one visit from another, Stripe sets its own during checkout to keep your session secure, and your browser's local storage may remember what's in your bag. Blocking cookies will stop analytics working and may break checkout; the rest of the site is fine without them.
If something goes wrong
If a breach happens that could cause you serious harm, we'll tell you and notify the Office of the Privacy Commissioner, as the Act requires. If you're unhappy with how we've handled your information, tell us first, and you can complain to the Privacy Commissioner at privacy.org.nz.