This Privacy Policy explains how The Design Company ("we", "us", "our") collects, uses, and protects personal information in connection with extensions.thedesigncompany.co.nz. We are committed to complying with the New Zealand Privacy Act 2020.
1. What Information We Collect
Account information
When you register, we collect your name and email address. This is used to manage your account, authenticate downloads, and send transactional emails (purchase confirmations, renewal reminders, support replies).
Payment information
Payments are processed by Stripe. We do not see or store your card number, expiry date, or CVV. We receive from Stripe a customer ID, subscription ID, and the amount paid, which we store to manage your subscription.
Stripe's privacy policy is available at stripe.com/privacy.
Download logs
When you download an extension, we log your user ID, the extension and release downloaded, the date and time, and your IP address. This is used to provide download statistics and detect abuse.
Licence keys
We store a cryptographic hash of your licence key (not the key itself). The plain-text key is shown once at purchase and emailed to you; we do not retain it after that.
Newsletter (optional)
If you opt in to our newsletter, your name and email address are shared with Klaviyo to manage email marketing. You can unsubscribe at any time from any newsletter email or via your account page. Klaviyo's privacy policy is available at klaviyo.com/legal/privacy-notice.
Support tickets
When you submit a support request, we collect your name, email address, and the content of your message. This is used solely to respond to your enquiry.
Usage data
We may collect standard server logs including IP addresses, browser type, and pages visited. This data is used for security and to understand how the site is used. It is not linked to individual accounts for marketing purposes.
2. How We Use Your Information
- To provide and manage your account and subscriptions.
- To process payments and issue licence keys.
- To send transactional emails (purchase confirmations, renewal reminders, password resets).
- To send newsletter emails, if you have opted in.
- To respond to support requests.
- To detect and prevent fraud or abuse.
- To improve the Site and extensions.
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
3. Who We Share Data With
We share personal information only with the following third-party services, strictly as necessary to deliver our service:
- Stripe — payment processing. Data shared: name, email, payment information.
- Klaviyo — email marketing (only if you opt in). Data shared: name, email.
We may disclose personal information if required to do so by law or to protect our legal rights.
4. Data Retention
We retain your account and subscription data for as long as your account is active and for a reasonable period afterwards for legal and accounting purposes. Download logs are retained for up to 3 years. You may request deletion of your account at any time (see Section 6).
5. Cookies
The Site uses session cookies necessary for login and form security (CSRF tokens). No third-party advertising or tracking cookies are set. If you have opted into the newsletter, Klaviyo may set cookies on newsletter emails you open; see Klaviyo's privacy policy for details.
6. Your Rights
Under the New Zealand Privacy Act 2020, you have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate information.
- Request deletion of your account and associated personal data, subject to any legal retention obligations.
To exercise any of these rights, contact us at
GDPR (European users)
If you are located in the European Economic Area, you also have rights under the General Data Protection Regulation (GDPR), including the right to data portability and the right to lodge a complaint with a supervisory authority. Our legal basis for processing your data is contractual necessity (account and subscription management) and legitimate interest (security, fraud prevention). Newsletter emails are sent on the basis of your consent.
7. Security
We take reasonable technical and organisational measures to protect your personal information, including HTTPS encryption, hashed licence keys, and access controls. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.
8. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered users. The date at the top of this page indicates when the policy was last updated.
9. Contact
For any privacy-related queries or requests, contact us at