Privacy Policy
Last updated: 4 October 2026
This policy explains how Tripster Developers collects, uses, shares and protects personal information when you visit our website, ask us for a quote, hire us, buy hosting, domain or email services from us, or use our Miko apps. We have written it in plain English. If anything is unclear, email [email protected].
1. Who we are
Tripster Developers is the trading name of Tripster Developers Limited (NZBN 9429051238919), a New Zealand company based in Auckland, New Zealand. Miko Apps is our software brand.
We are responsible (the "agency" under the New Zealand Privacy Act 2020, and the "controller" under the GDPR and UK GDPR) for personal information we collect for our own purposes: website visitors, enquiries, clients, hosting customers, business contacts and merchants who install our apps.
When we handle personal information on behalf of a client, for example a Shopify merchant's customers while we build their store, the content of a website or mailbox we host, or shoppers' data inside a Miko app, the client is responsible for it and we act as their service provider (a "processor"). We use it only to provide the service they asked for.
Privacy officer: Pratham Jani, founder, [email protected]. Every New Zealand organisation must have a privacy officer; this is the person who handles requests and complaints.
2. What we collect and why
2.1 When you visit our website
| What | How | Why | Legal basis (GDPR) |
|---|---|---|---|
| Pages viewed, referrer, approximate location, device and browser details, and a random identifier stored in a cookie | Google Analytics 4 | To understand which pages help people and improve the site | Consent where required (see section 6), otherwise legitimate interests |
| Clicks, scrolling, mouse movement and session recordings of how you use pages, with text typed into form fields masked by Clarity | Microsoft Clarity | To find and fix confusing or broken pages | Consent where required, otherwise legitimate interests |
| Your IP address and request details | Cloudflare, which sits in front of our website for security and speed, and our web host's server logs | To deliver pages, block attacks and spam, and diagnose faults | Legitimate interests |
| Your IP address and basic browser signals, checked once when you send a form or run the store check | Cloudflare Turnstile | To tell people from spam bots, usually without a puzzle. It sets no advertising or tracking cookies | Legitimate interests |
| Your IP address, sent once to the ipwho.is lookup service, to work out your broad region (for example "New Zealand" or "Europe"). Only the region is stored, in a cookie on your device | Partner directory page only | To show partners relevant to your region | Legitimate interests |
| A session cookie | Pages with a form | To protect forms against forgery and limit spam | Strictly necessary |
We do not use advertising pixels (such as Meta or LinkedIn tracking), and we do not sell or share website data for advertising.
2.2 When you contact us or ask for a quote
Our contact, quote, theme support and partner application forms collect your name, email address, company or store URL, the service you are interested in, budget range, your message, and any file you choose to attach. For Odoo enquiries we also ask whether you already run Odoo and how many users you expect.
The form sends your enquiry to our business email inbox, which is hosted by Google (Google Workspace). We also keep a copy of each enquiry, together with the IP address it was sent from and a spam score, in a private log on our web server so that no enquiry is lost if email delivery fails. Enquiries that look like spam are marked, not deleted.
We use this to reply to you, prepare a quote and manage the project if you go ahead. We will not add you to a marketing list unless you ask to be added, or we have an existing business relationship with you and the law allows it (see section 2.6).
2.3 When you order hosting, domains, business email or a care plan
We collect the plan you chose, the domain name, your name, email, phone number (optional), notes, and the IP address the order came from. We email you a confirmation and keep a copy of the order in a private log on our web server.
When you check whether a domain is available, the domain name you type is sent to the registry for that extension (through the public RDAP or WHOIS lookup services) and cached for 10 minutes. We do not link the search to you.
If you go ahead:
- Domain registration. Registries require the registrant's name, organisation, address, email and phone. We pass these to our domain registrar partner and the relevant registry. Some of it may appear in public lookup services, following each registry's rules; many registries now redact personal details by default.
- Hosting and email. We store your website files, databases and mailboxes on servers run by our hosting partner, a specialist web host we resell under our own name, in the data centre region you choose (United States, Canada, Europe or Singapore). For this content we act as your service provider. We access it only to set up, support, secure, back up and restore the service, or where the law requires.
- Billing. We send you a payment link. Card payments are processed by a third-party payment provider; we do not see or store full card numbers.
2.4 When you are our agency client
To deliver a project we may need access to your Shopify admin, theme, apps, ERP (for example Odoo) and marketplace accounts (for example eBay). That access can include your products, orders and your customers' personal information. We use it only for the work you asked for, look at customer data only where the work needs it, and remove our access when the project ends.
Where a project includes a marketplace application we operate for you, such as our eBay listing tool, that tool touches listing data only (item IDs, titles, variation attributes and image URLs). It does not collect eBay buyers' personal information. We acknowledge eBay's account deletion notifications as eBay requires.
Credentials you give us are kept private, never committed to code and never written to logs.
We keep business records about you (contacts, proposals, invoices and correspondence).
2.5 When you install a Miko app
Merchants install our apps from the Shopify App Store. Shopify gives us your store details and the app's permissions let it read the store data it needs. Several apps process personal information about your customers. The full, app-by-app description, including every service provider each app uses, is in the Miko Apps Privacy Policy at miko.co.nz/privacy.
Our Odoo modules run inside your own Odoo database and do not send data to us.
2.6 Business contacts and marketing
We contact businesses that may benefit from our services. We collect business contact details (name, role, company, business email) from public sources such as company websites and professional directories, and from business data providers such as Apollo, and keep them in our own sales system. We use them to send a small number of relevant business emails. Every email tells you who we are and includes a working way to opt out, and we honour opt-outs immediately and permanently. We only send commercial email where the Unsolicited Electronic Messages Act 2007 and the laws of the recipient's country allow it.
We send these messages from our own business email and email-sending services.
2.7 When you use our free Shopify store check
When you use the free store check on our website, we keep the store address you enter, the check results and the date. We may contact the store about the findings. We do not store your IP address: the daily limit of 10 checks uses a one-way, salted code made from it, which cannot be turned back into the address. The check sends no email and asks for no personal details.
3. Who we share information with
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
We share it only with service providers who help us run the business, under contracts that require them to protect it and use it only for our instructions:
| Provider | What they do for us | Where |
|---|---|---|
| Cloudflare | Website security, caching and delivery | Global network |
| Namecheap | Web hosting for tripsterdevelopers.com and miko.co.nz, server logs, form logs, outgoing form email | Overseas |
| Google (Workspace, Analytics 4) | Business email, documents, website analytics | United States and global |
| Microsoft (Clarity) | Website usage analytics and session recordings | United States |
| ipwho.is | IP to region lookup on the partner directory page | Overseas |
| Our hosting and domain partners | Domains, hosting and email we resell | Region you choose |
| Our payment provider | Payment links for hosting and agency invoices | Overseas |
| Our accounting software provider | Invoices and accounting records | Overseas |
| Business data providers such as Apollo | Business contact details for outreach | United States |
| Shoffi | Tracks referrals and pays commission in our affiliate program | Overseas |
| Railway, Anthropic, Google Gemini, Resend, Sentry and others | Running the Miko apps (full list at miko.co.nz/privacy) | United States |
We may also disclose information if the law requires it, to protect our rights or someone's safety, or to a buyer if our business is sold (they would have to honour this policy).
4. Sending information overseas
We are based in New Zealand but most of our service providers store data in the United States and other countries. Before we send personal information overseas we take reasonable steps to make sure it will be protected in a way that is comparable to the New Zealand Privacy Act (IPP 12), for example by using providers bound by contracts with privacy protections. For personal information about people in the European Economic Area, the United Kingdom or Switzerland, we rely on the adequacy decision the European Commission has made for New Zealand where it applies, and on the Standard Contractual Clauses (and the UK Addendum) or the EU-US Data Privacy Framework for transfers onward to the United States.
5. How long we keep it
| Information | How long |
|---|---|
| Enquiries that do not become projects, including the form log | 24 months from the last contact, then deleted |
| Client and hosting customer records, invoices and contracts | For the relationship, then 7 years, because New Zealand tax law requires us to keep business records for 7 years |
| Project working copies of your code and files | Up to 30 days after sign-off, except code you have asked us to keep maintaining |
| Hosting and email content | While the service is active, then 30 days after it ends so you can take a copy, then deleted. Backups roll off on a short rolling schedule |
| Business contact records for outreach | Until you opt out (we then keep only your email address on a suppression list so we never contact you again), or 24 months without a response |
| Website analytics | Google Analytics: no longer than 14 months. Microsoft Clarity: recordings 30 days, aggregated data up to 13 months |
| Server and security logs | A limited period set by our web host and Cloudflare |
| Miko app data | See miko.co.nz/privacy |
Enquiry and order log files older than 24 months are deleted automatically.
6. Cookies and similar technologies
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| PHPSESSID | Us | Form security (anti-forgery token) and spam rate limit | Until you close your browser |
| td_region | Us | Remembers your broad region on the partner directory | 30 days |
| ga, _ga* | Google Analytics | Distinguishes visitors for analytics | Up to 2 years |
| _clck, _clsk, CLID and related | Microsoft Clarity | Links page views into a session for analytics and recordings | Up to 1 year |
| __cf_bm and similar | Cloudflare | Bot protection, when triggered | Up to 30 minutes |
Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for consent before analytics cookies are set. Everyone can change their choice at any time using the "Cookie settings" link in the footer, or block cookies in their browser settings.
7. How we protect it
- Our websites use HTTPS and sit behind Cloudflare's security network.
- We review and change access credentials after any security incident.
- Form logs are kept outside the public web folder with owner-only permissions.
- Credentials are kept out of our code and logs, with access limited to the people who need them.
- Only the people who need access to deliver a service have it.
- We keep backups of our websites.
No system is completely secure. If a privacy breach happens that has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act 2020 requires, and meet the notification rules of other countries where they apply (for example the GDPR's 72-hour rule to the relevant supervisory authority). Where we are a client's service provider, we will tell the client without undue delay so they can meet their own obligations.
8. Your rights
Wherever you live, you can ask us:
- whether we hold personal information about you, and for a copy of it;
- to correct it;
- to delete it;
- to stop sending you marketing email.
If you are in the EEA, the UK or Switzerland you also have the rights to object to processing based on legitimate interests, to restrict processing, to data portability, and to withdraw consent at any time.
If you are a California resident, you have the right to know what personal information we collect, use and disclose, to delete and correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined under California law. We will not treat you differently for exercising your rights.
To make a request, email [email protected]. We may need to confirm your identity first. We will respond within 20 working days, as the Privacy Act 2020 requires, and within one month for GDPR requests. There is no charge.
If your information is held by one of our clients (for example you are a customer of a Shopify store that uses a Miko app), please contact that business first. We will help them respond.
9. Complaints
If you are unhappy with how we have handled your information, please tell us first so we can put it right. If you are still not satisfied, you can complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz. If you are in the EEA or UK, you can also complain to your local data protection authority (in the UK, the Information Commissioner's Office).
10. Children
Our services are for businesses. We do not knowingly collect personal information from children under 16.
11. Changes to this policy
We will update this policy when our practices change. The date at the top shows the latest version. If we make a significant change, we will let clients and app merchants know by email or in the app.
12. Contact
Tripster Developers Limited (NZBN 9429051238919), trading as Tripster Developers, Auckland, New Zealand. Email [email protected].