Privacy Policy

1. Who we are

The data controller is S & Q DEVELOPMENT LIMITED (NZ company number 8180636, NZBN 9429049255676), 120 Taylor Street, Blockhouse Bay, Auckland 0600, New Zealand. For privacy matters, contact support@developmentsnz.com.

2. What data we collect

• Account data — name, email, password hash and basic profile details.
• Usage data — pages viewed, features used, device and log data.
• City-preference inputs — the lifestyle preferences and parameters you enter to generate matches and reports.
• Payment data — handled by our payment provider (Stripe or PayPal) or, where applicable, a merchant of record such as Creem. We receive limited billing metadata; we never see or store your full card number.
• Cookies — see our Cookie Policy.

3. How and why we use your data

We use your data to operate Cityfit, generate your matches and reports, process payments, support you, improve the service and meet legal obligations. Under the GDPR our legal bases are:

• Contract — to provide the service and process your subscription.
• Consent — for optional analytics, marketing emails and non-essential cookies (you can withdraw at any time).
• Legitimate interest — to secure, debug and improve the service, where not overridden by your rights.

4. Sharing & processors

We do not sell your personal data. We share it only with service providers who act as processors on our instructions:

• Stripe / PayPal — payment processing.
• Creem — merchant of record for some purchases (billing, tax and receipts).
• Supabase — hosting, database and authentication.
• Resend — transactional and notification email.
• Analytics — aggregate usage measurement, loaded only with your consent.

We may also disclose data where required by law.

5. International transfers

We are based in New Zealand and our processors may handle data in the EU and the United States. Where data moves between New Zealand, the EU and the US, we rely on adequacy decisions and Standard Contractual Clauses (SCCs) as appropriate to protect it.

6. Data retention

We keep account and preference data while your account is active and for as long as needed to provide the service, meet legal, tax and accounting requirements, and resolve disputes. When no longer needed, data is deleted or anonymised.

7. Your rights

GDPR (EU / UK)

You have the right to access, correct, delete, port, restrict and object to processing of your personal data, and to withdraw consent. We respond within 30 days.

CCPA (California)

You have the right to know what we collect, to request deletion, to opt out of any "sale" of personal information (we do not sell data), and to non-discrimination for exercising your rights. We respond within 45 days.

New Zealand Privacy Act 2020

Under the Information Privacy Principles you may request access to and correction of your personal information held by us.

8. Children

Cityfit is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

9. Security

We use encryption in transit, access controls and reputable infrastructure providers to protect your data. No method of transmission or storage is completely secure, but we take reasonable steps to safeguard it.

10. Cookies

We use cookies as described in our Cookie Policy, including how to manage and withdraw consent.

11. Changes

We may update this policy from time to time and will post the new effective date. Material changes will be notified to you.

12. How to contact us / exercise your rights

To exercise any right or ask a privacy question, email support@developmentsnz.com. We may need to verify your identity before acting on a request.