Privacy policy

Who we are

Hello Handshakes is made by SaaSy Cookies Limited, a New Zealand company (“we”). We follow the Privacy Act 2020. If you have a question about your information, email privacy@saasycookies.com.

What we collect

• Your account: your email address and name. You sign in with a code we email you; we don't store passwords.
• Your business card: what you put on it, such as business name, pitch, services, industry, location, logo, website, social links, phone, email and address, and who can find it.
• About you: your gender and ethnicity (or “prefer not to say”), asked once. Groups see these only as totals of 3 or more, never against your name.
• Groups and meetings: the groups you join, your role, check-ins, bookings, membership forms you send a group, payments a group records against you, introductions and asks.
• Contacts you save: cards you scan or add, with where and when you met, your notes, tags and reminders. These are yours: other members can't see them, and our staff don't look at their contents.
• Card photos: when you scan a paper card, the photo is stored in your private folder and read automatically to fill in the details.
• How you use the app: actions such as signing up, checking in, saving a contact, marking that you connected, sharing or opening a card, running a search and seeing an upgrade prompt; when you were last active; and how you arrived (the waitlist, an invite link, a group's QR code or someone's shared card). We don't record the content of your notes, reminders, contacts' details, messages or what you search for.
• Search appearances and card views: when a card shows up in your search results, and when you open someone's card while signed in (once a day per card).
• Feedback you send: your message, an optional screenshot, the screen you were on, the app version and your device type.
• Notifications: if you turn on alerts, the push address your browser gives us.
• Groups near you: the places you choose to watch (up to 10 towns or regions), and the new-group notices you've dismissed. Where you saw a group before booking a visit (sign-up, Find a group, a notification or an invite) is kept with the booking.
• Your time zone: your browser tells us its time zone, and we save it so meeting times and the weekly new-group notice follow your clock. Until then we guess it from the country and region on your card.
• Email counts: we keep a count of the emails we send (the time and the kind of email, such as a support reply or a weekly new-group email), with no address and no content, so we stay within our email provider's limits.
• New-group send log: a record of which weekly new-group notices (push or email) we have sent you and for which week, kept so you never get the same one twice. It holds no message content, except when our email provider can't confirm an email went out: then, for up to 23 hours, it keeps the groups listed in that email and your first name so exactly the same email can be retried, and clears them as soon as it is done.
• Payments: if you subscribe, your plan, billing country, invoices and payment status. Card details go straight to Stripe; we never see or store them.

Why we use it

• To run the app: your card, your contacts and reminders, groups, check-ins, search and introductions.
• To support you, fix problems and keep the service safe, including handling reports about misuse.
• To understand which features help and improve them, using the activity described above.
• To bill subscriptions and keep the records the law requires.
• To email you about your account (for example sign-in codes). Marketing emails only if you ask for them (below).

Who can see what

• Other members see your business card according to the “who can find this card” setting you choose, and the groups you're in. People whose card you saved can find your card if your setting allows it. If someone saved your details before you joined, we may offer to connect them to your profile when you sign up, and you can decline. Your phone, email and address are never shown in search; you decide who gets them.
• Visitors to a group can see its meetings and the organisation that runs it, but not its member list.
• Introduction invitations: if a member saved your email and wants to introduce someone to you before you've joined, we may email you once for that introduction. The email names the member and their business and nothing about the person they're introducing. You see the introduction only after you sign in with a code sent to that address, and you choose whether to accept it. The member is told only if you accept; if you say no thanks, nobody is told. Every invitation email has a link to stop them, and we then keep your address only to make sure no more are sent.
• Pro members can see how often their card appeared in search and was opened, and which signed-in business owners opened it (your business name, your name and when). Turn on “Browse privately” in Settings to keep your name off those lists; your visit is still counted, without your name.
• Group organisers see what they need to run their group: their members and visitors, check-ins, forms you send them and payments they record.
• Our staff (platform admins) see account details, activity and payment status to support you and run the service. Every time staff open someone's details, export data or change anything, it's logged.
• Where we recruit groups: so we know where new networking groups are needed, staff see counts of people who aren't in a group and have none near them, by region. They can open a region to see those people's names, businesses and towns (never an email address or phone number). Opening a region or exporting the list is logged the same way. Staff also see how many visit bookings came from each source, per organisation, as counts.
• Blocking is private: the person you block isn't told.

Services we use (some outside New Zealand)

We use these companies to run Hello Handshakes. They process information only for us, under their own security and privacy commitments:

• Supabase: our database, sign-in and file storage (hosted in Australia).
• Netlify: hosts the app (servers in Australia, with its content network in several countries, including the United States).
• Resend: sends our emails (United States).
• Stripe: takes subscription payments.
• Anthropic: reads card photos to fill in the details (United States). Photos aren't used to train its models.
• Your browser's push service (such as Apple, Google or Mozilla) delivers notifications you turn on.

We choose services that protect information in ways comparable to New Zealand law. We don't sell your information, and there's no advertising or third-party tracking in the app.

Our public website pages (the home page for people who aren't signed in, and the pricing page) use the Meta Pixel, so we can see whether our Facebook and Instagram ads bring people to Hello Handshakes. On those pages Meta (United States) receives the page address and your browser details. It never receives your email, your card, your contacts or anything inside the app. Meta may link this to your Facebook or Instagram account under its own privacy policy; you can control ad tracking in your Meta ad settings or by blocking third-party cookies in your browser.

Groups near you and new-group notices

• We use where your business is, and any places you watch, to show networking groups that meet near you and to tell you when a new one lists nearby. The notices show the group, its town, how far away it is and its next meeting. They never include anything about its members.
• Push notification: a weekly notice on Monday morning your time. It's on automatically while you're not yet a member or organiser of a group and haven't checked in to one in the last 90 days, and off automatically otherwise, so we don't advertise other groups to people who already belong to one. It only reaches a device where you've allowed notifications. You can switch it on or off yourself in Settings, then Notifications, and that choice always wins.
• Email: off unless you turn it on in Settings, then Notifications. It's a separate choice from marketing email and doesn't depend on it. If you turn it on we email you once a week, only when new groups have listed near you, and every email has an unsubscribe link.
• Group organisers are never emailed or notified about other groups, and aren't told when you watch an area.

Marketing email

We only send news, tips and offers if you tick the box at sign-up or turn it on in Settings, and you can turn it off there at any time. Account emails, like sign-in codes, still arrive either way. Joining the waitlist only covered news about early access and the launch.

Cookies

Inside the app we use only the cookies needed to keep you signed in. Our public website pages also set Meta Pixel cookies (see Services we use). The app also stores a few files on your device so scanning works without signal; signing out clears them.

How long we keep it

• Your account, card and contacts: while you have an account. Ask us and we'll delete them.
• Introduction invitations: the details of the person being introduced are kept until the introduction is accepted, declined or withdrawn, or 30 days pass, whichever comes first, and then deleted (once accepted they're part of the introduction). The invited address and name are kept with the invitation so it can't be sent again too soon.
• Activity records: 24 months, after which only totals with no names are kept.
• Payment records: 7 years, as New Zealand tax law requires.

Your rights

You can ask for a copy of the information we hold about you, ask us to correct it, or ask us to delete your account. Email privacy@saasycookies.com and we'll reply within 20 working days. You can update most of your details yourself in the app. If you're not happy with how we've handled your information, you can complain to the Office of the Privacy Commissioner.

Changes

If we change this policy in a way that matters, we'll tell you in the app before it takes effect. See also our terms of use.