Privacy policy

21ST AURA is an online marketplace for advertising vehicles in New Zealand. The agency responsible for your personal information is [PLACEHOLDER — registered legal entity name] (NZBN [PLACEHOLDER — NZBN]), trading as 21ST AURA, of [PLACEHOLDER — registered street address, New Zealand]. These are placeholders and must be replaced with real registered details before public launch.

This policy covers the 21ST AURA website and the accounts, listings, messaging and moderation features within it.

Information you give us:

• Account details — email address, password (stored only as a secure hash), display name.
• Seller profile — whether you are a private seller or a trader, and your region.
• Listing content — vehicle details, photos, description, disclosures about damage and finance, and Consumer Information Notice details for traders.
• Activity — favourites, offers, deal records, and messages you send to other users.
• Support and moderation content — reports you file and privacy requests you make.

Information collected automatically: basic technical data needed to run and secure the service, such as request logs and timestamps of account and moderation activity.

We do not ask for identity documents, driver licences, bank details or payment card details, and we do not process payments.

• To create and secure your account and let you sign in.
• To publish the listings you choose to publish, and to show buyers who is selling (private or trader).
• To let buyers and sellers message each other without exposing personal contact details.
• To record favourites, offers and the shared deal record you choose to keep.
• To investigate reports, prevent fraud and misuse, and enforce our terms and selling rules.
• To respond to your support and privacy requests.
• To meet legal obligations and keep records of moderation decisions.

We do not sell personal information, and we do not use your messages for advertising.

A published listing shows the vehicle details and photos, the seller's display name, the seller type badge, and the city and region of the vehicle. Phone numbers, email addresses and home addresses are never published.

Draft and archived listings, and the photos attached to them, are not visible to other users.

• Other users — only the limited listing information described above, and the messages you send them.
• Our service providers — hosting, database and storage providers who process information on our instructions under confidentiality obligations.
• Authorised moderation staff — where needed to investigate a report; that access is recorded in an audit log.
• Law enforcement or regulators — where we are legally required to disclose, or where disclosure is permitted under the Privacy Act, for example to prevent a serious threat or investigate suspected offending.

Some of our service providers may store data outside New Zealand. Where that happens we take reasonable steps to ensure comparable safeguards apply, as required by information privacy principle 12.

Access is least-privilege and enforced in the database, not just in the interface: you can only reach your own profile, listings, drafts, favourites, offers and conversations. Vehicle photos are held in private storage and are only readable by the owner, by authorised staff, or when they belong to a published or sold listing.

Passwords are never stored in readable form. No user can grant themselves moderator or administrator access, and administrative actions are recorded with who acted and when.

No online service is perfectly secure. If a privacy breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

Account, listing and message information is kept while your account is active so you have a record of your buying and selling. You can archive listings at any time.

When you ask us to delete your account information we remove it, except where we must keep a limited record — for example moderation and audit records, or a message that forms part of another person's conversation history. We do not keep personal information for longer than we need it.

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Signed-in users can submit a request from their account; otherwise contact our privacy officer.

We will respond as soon as reasonably practicable and within 20 working days. If we refuse a request we will explain why and how to complain.

Privacy officer: [PLACEHOLDER — privacy officer name], [PLACEHOLDER — privacy officer email address]. General support: [PLACEHOLDER — support email address]. All placeholders, to be replaced before launch.

If you are not satisfied with our response you can complain to the Office of the Privacy Commissioner, which can investigate privacy complaints in New Zealand.

We use only the storage needed to keep you signed in and to run the site. We do not run third-party advertising trackers.

21ST AURA is for people aged 18 and over. We do not knowingly collect information from children.

We may update this policy as the service develops. The current version is always on this page with the date it was last reviewed. This page is general information, not legal advice.