1. Introduction

Breakfast NZ ("breakfast.co.nz", "the Site", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and your rights under the New Zealand Privacy Act 2020.

This policy applies to all features and services on the Site, including the homepage and recipe pages, the Breakfast DNA Quiz, the smoothie builder, the newsletter, shopping-list emails, comments, accounts, and any future paid subscription tiers.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Password (stored as a one-way hash — we never see your plain-text password)
• Name (if provided)
• Social login profile data (name, email, profile image) if you sign up via Google, Facebook, Apple, LinkedIn, or GitHub

2.2 Newsletter-Only Sign-Ups

You can subscribe to our newsletter without creating a full account. In that case we collect only:

• Your email address
• Your subscription preferences (whether you have confirmed and are still subscribed)
• Your assigned breakfast persona (if you took the Breakfast DNA Quiz before subscribing)
• The date and IP address at which you confirmed your subscription by clicking the link in the confirmation email, retained as proof of consent under the Unsolicited Electronic Messages Act 2007

2.3 Breakfast DNA Quiz

When you take the Breakfast DNA Quiz, we collect:

• Your answers to the ten quiz questions
• The persona assigned to you based on those answers
• Your email address (if you provide one to save or share your result)
• A randomly-generated share token used to publish your result page at a unique URL

If you took the quiz before signing in, your anonymous result may be claimed by your account when you later sign up.

2.4 Shopping-List Emails

When you request a recipe shopping list to be emailed to you, we use the email address you provide solely to send that one list. The address is not added to any marketing list unless you separately subscribe to the newsletter.

2.5 Comments and Recipe Ratings

If you post a comment or rate a recipe, we collect the content of the comment, the rating, your name (if you have provided one), and the timestamp.

2.6 Subscription and Payment Data (future)

We may introduce paid subscription tiers in future. When we do, payments will be processed by Stripe, our payment processor. We will not store your full credit card number or bank details. Stripe will provide us with limited payment information (such as the last four digits of your card and your billing address) for record-keeping purposes. Please refer to Stripe's privacy policy for details on how they handle your payment data.

2.7 Automatically Collected Information

When you visit the Site, we automatically collect:

• IP address (used for security, rate limiting, and approximate geolocation)
• Browser type and version
• Pages visited and time spent
• Referring website

We use Google Analytics 4 (GA4) to understand Site usage patterns. Google Analytics may set cookies on your browser. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

2.8 Cookies

We use cookies for:

• Session management (keeping you signed in)
• Security (CSRF protection)
• Analytics (understanding how the Site is used, via Google Analytics)
• Advertising (Google AdSense and its advertising partners may set cookies to serve relevant ads)
• Rate limiting (preventing abuse)

You can control cookie settings through your browser. Disabling cookies may affect your ability to use certain features.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Site and its features
• Score and store your Breakfast DNA Quiz result and recommend recipes that suit it
• Send you the newsletter, persona welcome emails, and other marketing communications you have consented to
• Send transactional emails (account confirmation, password reset, shopping lists, comment notifications)
• Display and moderate comments and recipe ratings
• Process subscription payments when paid tiers are introduced
• Prevent abuse, spam, scraping, and fraud, and to maintain security
• Analyse usage patterns and serve advertising
• Comply with legal obligations

4. Data Sharing

We do not sell your personal information. We share data with the following third parties only as needed to operate the Site:

• Amazon Web Services (AWS) — we host the Site, our database, and our outbound email on AWS infrastructure in the Sydney (ap-southeast-2) region. Stored data, including account records, quiz responses, and email logs, lives on AWS infrastructure. Outbound email is sent through Amazon Simple Email Service (SES).
• Google Analytics 4 — aggregated usage analytics. See Google's privacy policy.
• Google AdSense — advertising network. Google and its advertising partners may use cookies and similar technologies to serve ads based on your visits to this and other sites. See the advertising section below.
• Social login providers (Google, Facebook, Apple, LinkedIn, GitHub) — only the authentication data exchanged during login.
• Stripe — payment processor, used only when paid subscription tiers are introduced.

We may also disclose information if required by law, to enforce our Terms of Use, or to protect the rights, safety, or property of Breakfast NZ, our users, or the public.

5. Advertising and Personalisation

We display advertisements on the Site through Google AdSense. Google and its advertising partners may use cookies, web beacons, and similar technologies to serve ads based on your prior visits to this and other websites. This is called interest-based or personalised advertising.

You can opt out of personalised advertising by Google by visiting Google's Ads Settings. You can also opt out of third-party advertising cookies more broadly at aboutads.info/choices (US) or youronlinechoices.com (EU/UK).

If you are an EEA, UK, or Swiss visitor and have not consented to personalised advertising, we instruct Google to serve non-personalised ads to you.

6. Data Retention

We keep your personal information only for as long as we need it to provide the service or to comply with our legal obligations. Specifically:

• Account data: Retained for the life of your account. You may request deletion of your account at any time by contacting us.
• Newsletter subscribers: Email address and any breakfast persona we hold are retained while you are subscribed. If you unsubscribe, we keep your email address on a suppression list so we do not accidentally send you marketing email again. You may request full deletion of your subscriber record by contacting us.
• Quiz responses: Saved against your account if you are signed in, or against a randomly-generated share token if you are not, so that the share link continues to work and we can recommend recipes that suit your persona.
• Shopping-list emails: The email address you provide is used solely to send the requested shopping list. We do not retain a separate database of shopping-list email addresses.
• Comments and recipe ratings: Retained while your account is active. Records of removed comments may be kept in an internal moderation log.
• Server logs: Application and access logs are kept for a limited period set by our hosting infrastructure and then automatically discarded.
• Legal acceptance records: Retained as long as your account or subscription exists, plus a reasonable period afterwards, as proof of consent.

If you would like a copy of, or the deletion of, the personal information we hold about you, please contact us through the contact form.

7. Data Security

We implement reasonable technical and organisational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS) for all pages and form submissions
• Hashed password storage (bcrypt) so we never store plain-text passwords
• Rate limiting and bot protection
• Regular security updates to our software stack
• Restricted internal access to personal data

However, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security of your data.

8. Your Rights Under the Privacy Act 2020

Under the New Zealand Privacy Act 2020 you have the right to:

• Access the personal information we hold about you
• Correct any inaccurate personal information we hold about you
• Request deletion of your account, your newsletter subscription, your quiz results, or other personal data
• Withdraw consent for marketing communications at any time, by clicking the unsubscribe link in any newsletter email or by emailing us
• Lodge a complaint with the New Zealand Office of the Privacy Commissioner

To exercise any of these rights, please contact us through the contact form on the Site or reply to any newsletter email. We will respond within 20 working days as required by the Privacy Act.

9. Marketing Emails — Your Choices

You will only receive marketing emails (such as the newsletter) if you have opted in by subscribing through one of our sign-up forms and confirmed your subscription. Every marketing email we send includes:

• A clear identification of Breakfast NZ as the sender
• A one-click unsubscribe link
• A link to manage your email preferences

Transactional emails (such as account confirmations, password resets, and shopping-list sends) are sent in response to your direct request and are not subject to opt-out, although we will only send them when there is a real reason to.

10. Children's Privacy

The Site is not directed at children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. International Data Transfers

Your data may be processed in countries outside New Zealand, including:

• Australia — where our servers, primary database, and outbound email infrastructure (Amazon SES) are hosted (AWS Sydney)
• United States — where some of our service providers, including Google and Stripe, are based

These transfers are necessary to provide our services. We require our service providers to maintain appropriate data protection safeguards.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and newsletter subscribers, and the updated policy will be posted on the Site with a new effective date. Continued use of the Site or continued newsletter subscription after changes take effect constitutes acceptance of the updated policy.

13. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact us through the contact form on the Site.

You may also contact the New Zealand Office of the Privacy Commissioner at privacy.org.nz if you have concerns about how we handle your information.