Legal

Privacy statement

This statement explains how WeBloom collects, holds, uses, and shares personal information.

It is written for the Privacy Act 2020 and the information privacy principles (IPPs). It is not a European “legal bases” notice.

We do not sell your personal information.

1. Who holds your information (the agency)

The agency is Guillaume Chabbert trading as WeBloom.

WeBloom is a trading name, not a registered company on this statement.

Privacy officer: Guillaume Chabbert (the same person — this is a one-person studio). You do not need a reference number. Email is enough.

There is no general small-business registration with the Privacy Commissioner. We do not have a “privacy licence number”.

2. What we collect

We collect personal information you give us, and a small amount the site sets itself.

The guided brief (`/start`)

When you complete a brief we collect, as you type it:

  • your name and email
  • business name, what you do, and where you operate
  • goals, audience, services, pages, features, and preferred plan
  • visual direction, colours, and sites you like
  • ideal launch date and any extra notes
  • a structured prompt built from those answers, which an agent may use to draft concepts

Providing a brief is voluntary. If you do not provide it, we cannot quote or build from this flow.

The contact form (`/contact`)

The form asks for name, email, business name, and a message.

If you submit the contact form once it is working, we will use those details to reply. Providing them is voluntary. If you prefer, email hello@webloom.co.nz instead.

Until the form actually sends, nothing from it is stored by us. The on-screen fields are still a collection *request*, so we describe them here.

Email

If you email us, we hold the address and the content of the conversation, as any inbox does.

Cookies

See Cookies. Today that is a hosting session cookie called `GAESA`. We do not currently run analytics.

Payment and invoices (when we take money)

If you pay us, we will hold the details needed to invoice and keep tax records (name, email, what you bought, amount, date). We do not want full payment-card numbers in email or in the brief.

What we do not need

Please do not send health information, information about children, passwords, or payment-card numbers in a brief. A typical small-business website does not require them.

3. Why we collect it (purpose)

We collect personal information to:

  • reply to enquiries
  • understand what website you want
  • produce concepts and build a site if you buy a plan
  • arrange managed hosting and a domain if we host the site for you
  • invoice you and keep records we are required to keep
  • fix problems and handle complaints, access, or correction requests
  • run and secure the website (including the hosting cookie)

We do not collect a brief in order to add you to a marketing newsletter. A submitted brief or contact message lets us reply about that enquiry. It is not consent to unrelated promotional email. If we ever start a newsletter, we will ask separately and include an unsubscribe.

We do not use personal information to sell to other businesses.

4. Who we share it with

We do not sell lists.

We may share personal information with people and tools that help us do the job, for example:

  • Hosting / the live site — the site is hosted on Replit and served through Google Frontend. Briefs submitted on `/start` are posted to that application.
  • Email — the inbox for hello@webloom.co.nz and any email provider that carries the message.
  • AI processors — brief contents (and the generated prompt) may be sent to AI tools so we can draft website concepts. We treat this as part of producing the service, not as a product we resell.
  • Domain registrar and host — if we register a domain or host a site for you, the registrar/host needs registrant details.
  • Payment providers and banks — if you pay us.
  • Professional advisers — a lawyer, accountant, or insurer, if needed, under a duty of confidence.
  • The law — if we are required to disclose by New Zealand law, or to report a notifiable privacy breach to the Privacy Commissioner.

We do not publish your brief. We may show a finished site in a portfolio unless you ask us not to (see the terms). We will not invent a testimonial.

Staff: there is currently one person (Guillaume). If that changes, access will be limited to people who need it for the purpose above.

5. Overseas processing (IPP 12)

Your information is likely to be stored or processed outside New Zealand, including in the United States.

That is because:

  • webloom.co.nz is hosted on Replit / Google Frontend
  • email and AI tools we may use are often provided by overseas companies
  • briefs may be processed in that stack

The United States is not treated as automatically “the same as New Zealand privacy law”.

Please read this before you submit a brief. Some overseas tools may not give comparable privacy safeguards to the Privacy Act 2020. By submitting a brief or a working contact form, you authorise us to send the information you provide to overseas hosting, email, and AI processors as described here.

Where we can, we will use tools under contract and will not put a brief into a public consumer chatbot as training-by-default entertainment. We still cannot promise that every overseas processor is equivalent to a New Zealand agency.

Ordinary hosting (storing the site and the brief so the service runs) is intended as processing on our behalf. AI tools are called out separately because their own-use terms vary. If we change this stack in a way that materially affects you, we will update this statement.

6. Collecting from other people (IPP 3A)

We usually collect personal information from you.

Information privacy principle 3A (in force from 1 May 2026) applies if we collect personal information about someone from a third party. In that case we must take reasonable steps to tell that person, unless an exception in the Act applies.

We do not currently run a Scout-style prospecting tool on webloom.co.nz. We do not currently collect personal information about you from other people in order to market WeBloom from this site.

If that ever changes (for example using a public business directory to find a trading name and email), we will update this statement first and take reasonable steps to notify the person as IPP 3A requires.

If you include other people’s personal information in your brief (staff names, customer stories, testimonials), you must have a right to give it to us. We will use it only to build the site you asked for.

7. How long we keep it

We do not keep personal information longer than we need it for the purpose we collected it, unless the law says we must keep it.

As a working rule:

  • Contact enquiries — while we deal with the enquiry, then up to about 12 months after last contact unless a project follows
  • Briefs and project files — for the project and any hosting relationship, then a short period in case of disputes
  • Invoices and tax records — at least 7 years (Inland Revenue record-keeping)
  • Hosting / platform logs — whatever our host reasonably retains; we do not fully control Replit’s logs

You can ask us to delete information we no longer need. We may still keep what the law requires (for example an invoice). Backups may take a short time to cycle out.

8. Access and correction

You can ask us what personal information we hold about you, and ask us to correct it.

Email hello@webloom.co.nz with the subject “Privacy request”. Say whether you want access, correction, or deletion.

We will respond as the Privacy Act requires. We may need to check we are talking to the right person.

If you are not satisfied, you can complain to us first, then to the Office of the Privacy Commissioner.

9. Cookies

New Zealand does not currently require a European-style cookie consent banner for a strictly necessary hosting cookie.

What we set today

When you visit webloom.co.nz, the hosting platform may set a first-party cookie named `GAESA`. That is a Google App Engine / Replit session cookie used to serve the site. It is not an advertising cookie. We do not use it as our own analytics product.

What we do not set today

We do not currently run Google Analytics, Google Tag Manager, Meta Pixel, Plausible, PostHog, Hotjar, or similar. There is no analytics cookie of ours on this site today.

If we later add analytics, we will update this section and the cookies note in `/workspace/legal/drafts/cookies-section.md` before those tools go live. A consent banner is not for publish now.

More detail, including unused banner copy for later, is in our internal cookies draft. Only this section is intended for the public privacy page.

10. Security

We take reasonable steps to protect personal information against loss, misuse, and unauthorised access. That includes limiting who can see briefs, not putting client briefs in public repositories, and using HTTPS on the site.

No internet transmission is perfectly secure. Replit, Google Frontend, email, and AI tools have their own security. If we become aware of a problem that affects you, we will deal with it as below.

11. Notifiable privacy breaches

If a privacy breach has caused, or is likely to cause, serious harm, we will notify the Privacy Commissioner and affected people as soon as practicable, as the Privacy Act requires.

The Privacy Commissioner’s guidance is to treat “as soon as practicable” as promptly — often discussed as within 72 hours of becoming aware, where that is practicable. We will not wait for a quiet news cycle.

Email hello@webloom.co.nz if you think there has been a breach.

12. Children

WeBloom’s site is aimed at small businesses, not at children. We do not knowingly collect personal information from children for the purpose of selling them a website package. If you believe we have, email us and we will delete it unless we must keep it.

13. New Zealand law

This statement is meant to comply with New Zealand’s Privacy Act 2020.

If you are overseas, the same Auckland agency still holds the information. We do not pretend to appoint an EU representative or to apply GDPR as if it were NZ law.

Our terms of service cover the paid website packages. This statement covers personal information.

14. Changes

We may update this statement. The current version will be on this page. If we start analytics, overseas tools change in a material way, or we begin collecting from third parties, we will update this statement before that collection becomes the new normal.