Privacy Policy

1.1 Finlayconn Ventures Limited (trading as "Unicorn Factory") is the agency responsible for the personal information described in this Privacy Policy. Our marketplace is focused on New Zealand clients and freelancers, although people may visit our websites from other countries.

1.2 This policy explains how we collect, use, disclose, hold, and protect personal information across our public website, client and freelancer portals, support services, payments, and marketplace operations.

1.3 This policy should be read with our Terms of Service. We handle personal information in accordance with the Privacy Act 2020 and its information privacy principles.

2.1 Information you provide directly may include:

• Contact details, including your name, email address, phone number, and location
• Account, authentication, portal-role, and communication preferences
• Freelancer profile information, including skills, experience, rates, availability, portfolio items, and business descriptions
• Client and company information, including business details, contacts, and hiring requirements
• Applications, job briefs, introductions, inquiry messages, support requests, feedback, and other content you submit
• Billing and transaction information for paid services; full card details are collected and processed by Stripe rather than Unicorn Factory
• Marketing consent and unsubscribe preferences

2.2 Information collected automatically may include your IP address, browser and device information, approximate location derived from your IP address, pages viewed, feature interactions, referral information, cookies, security events, and application or error logs.

2.3 Information received from service providers may include Stripe payment status, MailerSend delivery and engagement events, security-verification results, and analytics or error-diagnostic information.

2.4 During our platform migration, we may receive legacy account, profile, marketplace, or operational records from our Airtable system. Where Information Privacy Principle 3A applies, we will take reasonable steps to notify affected people about that indirect collection unless an exception under the Privacy Act applies.

2.5 Please do not submit health information, government identifiers, financial credentials, or other highly sensitive information unless we specifically request it through an approved secure process.

3.1 Approved freelancer profiles are public. Selected profile and portfolio information may be viewed by anyone and indexed or cached by search engines. Private account details, authentication information, internal notes, and payment information are not part of the public profile.

3.2 We share relevant information between clients and freelancers where needed to publish opportunities, process applications, arrange introductions, support marketplace conversations, and deliver the service requested by each party.

3.3 Our authorised staff and contractors may access information where necessary for support, verification, moderation, payments, security, legal compliance, and marketplace administration.

4.1 We use personal information to:

• Create and secure accounts and provide client and freelancer portal access
• Review profiles and applications, publish marketplace content, and facilitate hiring and introductions
• Process purchases, credits, subscriptions, refunds, and billing support
• Send account, application, marketplace, support, security, and policy communications
• Respond to support requests and resolve disputes
• Prevent spam, fraud, misuse, and security incidents
• Measure service performance and improve our websites, portals, workflows, and user experience
• Send marketing communications where separate express consent has been recorded
• Meet tax, accounting, legal, regulatory, and record-keeping obligations

4.2 We will not use personal information for a new purpose that is unrelated to the purpose for which it was collected unless you authorise that use or the Privacy Act otherwise permits it.

5.1 We disclose only the information reasonably needed for trusted providers to deliver services for us. Current providers include:

• Supabase: authentication, database services, and application storage
• Vercel: application hosting, content delivery, and website usage analytics
• Stripe: payment processing, billing, transaction records, and payment-related fraud prevention
• MailerSend: transactional email, expressly opted-in marketing email, and delivery-status processing
• Google Analytics: website and product-usage measurement
• Cloudflare Turnstile: bot, spam, and abuse prevention on selected forms and sign-in flows
• OpenAI: optional job-drafting assistance and support-ticket classification
• Slack: internal operational notifications containing selected account, marketplace, support, or workflow details
• Sentry: application error and performance diagnostics, with default personal-information capture disabled
• Airtable: limited legacy-data migration and operational record mirroring while our platform transition is completed

5.2 We may also disclose personal information where you authorise us to do so, where required or permitted by law, to protect a person or our services from harm, or as part of a proposed sale, merger, restructuring, or transfer of the business subject to appropriate confidentiality protections.

6.1 If you choose to use an AI-assisted job-creation feature, relevant answers and job content are sent to OpenAI to generate questions, suggestions, or draft listing content.

6.2 Support-ticket content may be sent to OpenAI to help classify the request and assist our support team. Please avoid including highly sensitive information in job briefs, messages, or support requests.

6.3 AI may assist with drafting, classification, or recommendations, but we do not rely on AI alone to make final consequential decisions about applications, moderation, matching, or support outcomes. Those decisions are reviewed by a person or determined by established platform rules.

7.1 We use cookies, local storage, and similar technologies to operate and secure the platform, maintain sessions, remember preferences, prevent abuse, and understand how our services are used.

7.2 Where configured, Google Analytics and Vercel Analytics load when you use our websites and collect technical and usage information. Google Analytics user-level event data is retained for 14 months. We do not use this policy to promise that analytics will wait for cookie consent before loading.

7.3 You can block or delete cookies using your browser or device settings. Blocking essential cookies may prevent sign-in or other platform features from working correctly. Browser privacy controls and content-blocking tools may also limit analytics collection.

8.1 We use safeguards that are reasonable in the circumstances, including encrypted connections, provider security controls, authentication, role-based access controls, restricted service credentials, operational monitoring, and staff access limited to legitimate business purposes.

8.2 We minimise the personal information included in internal operational alerts. Our Sentry configuration disables default personal-information capture, although submitted content or identifiers may still appear in diagnostics where necessary to understand an error.

8.3 We assess privacy breaches promptly. If a breach has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, unless a lawful exception applies.

8.4 No online service can guarantee absolute security. Please contact our Privacy Officer promptly if you believe your account or personal information has been compromised.

9.1 We retain personal information only for as long as it remains necessary for its lawful purpose. Our usual retention periods are:

• Account and profile data: while the account is active, then two years after the user requests account closure
• Completed jobs, applications, introductions, and marketplace messages: three years after the relevant record or relationship closes
• Closed support tickets and replies: two years after closure
• Identifiable security, webhook, workflow, and error logs: 12 months after the event
• Google Analytics user-level event data: 14 months
• Invoices, payment references, and tax or accounting records: seven years, or longer where required by law
• Marketing consent and preference records: while subscribed; after opt-out, we retain only the minimum suppression record needed to prevent further marketing
• Encrypted backups: deleted information may remain in routine backups for up to 90 days before expiry

9.2 We may retain a relevant record for longer where reasonably necessary for an active legal claim, dispute, fraud investigation, security incident, regulatory requirement, or preservation notice. When the reason ends, the ordinary retention rule resumes.

9.3 When a retention period expires, we delete or anonymise the information. If a backup is restored, information already due for deletion remains subject to the same deletion requirement.

10.1 Under the Privacy Act 2020, you may ask whether we hold personal information about you, request access to information that can be readily retrieved, and ask us to correct information that is inaccurate, incomplete, out of date, or misleading.

10.2 You may also ask us to close your account or delete personal information. Deletion is not absolute: we may retain information needed for financial records, legal obligations, disputes, fraud prevention, security, suppression records, or other purposes permitted by law.

10.3 Send requests to our Privacy Officer at community@unicornfactory.nz. We may ask for information needed to verify your identity and protect your information from unauthorised disclosure.

10.4 We will respond as soon as reasonably practicable and make the decision on an access or correction request within 20 working days, unless the Privacy Act permits an extension. If we refuse or limit a request, we will explain the applicable reason and your right to complain.

11.1 We send newsletters and promotional electronic messages only where separate express consent has been recorded. Creating an account or accepting our Terms of Service is not, by itself, consent to receive marketing.

11.2 Commercial electronic messages identify Unicorn Factory, provide accurate contact information, and include a clear, free, and functional unsubscribe facility that remains available for at least 30 days after the message is sent.

11.3 We action unsubscribe requests within five working days. You may unsubscribe using the link in a marketing email or by contacting our Privacy Officer. We retain a minimal suppression record so that an opted-out address is not accidentally re-added to marketing lists.

11.4 Opting out of marketing does not prevent service messages needed to operate your account, complete a transaction, respond to a request, provide security information, or notify you about material service or policy changes.

12.1 Some providers listed in section 5 process information outside New Zealand, including in the United States, Europe, Australia, and other countries where they or their subprocessors operate.

12.2 Before disclosing personal information to an overseas person or organisation, we take the steps required by Information Privacy Principle 12. Depending on the circumstances, this includes assessing whether the recipient is subject to the New Zealand Privacy Act or comparable safeguards, using contractual protections, or obtaining your informed authorisation where required.

12.3 A provider storing or processing information on our behalf may not always be treated as an overseas disclosure under the Privacy Act, but we remain responsible for selecting providers and applying reasonable privacy and security controls.

13.1 The marketplace is intended for people aged 18 and over. We do not knowingly allow people under 18 to create marketplace accounts or profiles.

13.2 If you believe a person under 18 has provided personal information to us, contact community@unicornfactory.nz. We will investigate and delete the information where appropriate.

14.1 We may update this policy to reflect changes to our services, providers, legal obligations, or privacy practices. We will post the current version on this page and update the effective date.

14.2 Where a change materially affects how we use or disclose existing personal information, we will provide additional notice where reasonable or required by law.

14.3 This version of the policy is effective from July 13, 2026.

15.1 Privacy Officer:

• Email: community@unicornfactory.nz
• Address: Privacy Officer, Finlayconn Ventures Limited, 5/8 Auld Street, Torbay, Auckland 1025, New Zealand

15.2 Please contact our Privacy Officer first if you have a question or complaint. We will acknowledge privacy complaints within five business days and investigate them fairly.

15.3 If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner:

• Website: privacy.org.nz
• Phone: 0800 803 909
• Email: enquiries@privacy.org.nz

15.4 Finlayconn Ventures Limited is New Zealand company number 5969335 and trades as Unicorn Factory.