Privacy Policy

Last updated: 7 May 2026 · Version: 2.1

Operator:Kapsule Group Limited (“Kapsule”, “we”, “us”, “our”)

Kapsule Group Limited (trading as Kapsule) is committed to protecting your privacy and handling your personal information responsibly in accordance with the Privacy Act 2020 and applicable privacy principles.

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use the Kapsule marketplace platform and services.

1. Information We Collect

We collect various types of information to provide, maintain, and improve our services:

Information You Provide Directly

1.1 When you create an account, make a purchase, sell products, or contact us, you may provide:

Account information: Name, email address, phone number, date of birth, password
Seller information: Business name, business registration number, GST number, IRD number, bank account details for payouts
Buyer information: Shipping addresses, billing addresses, payment card details
Profile information: Profile photo, bio, preferences, saved items, wishlists
Communications: Messages sent through our platform, emails to customer support, reviews and ratings, survey responses, feedback
Identity verification: Government-issued ID, proof of address, business certificates (when required for certain activities or compliance)

Information Collected Automatically

1.2 When you access or use Kapsule, we automatically collect:

Device information: Device type, operating system, browser type and version, device identifiers, mobile network information
Usage information: Pages viewed, search queries, products browsed, time spent on pages, click patterns, referral sources
Location information: IP address, approximate geographic location (city/region level), precise location if you give permission on mobile devices
Cookies and tracking: Data from cookies, pixels, web beacons, and similar technologies to recognise your browser and remember your preferences
Transaction information: Purchase history, browsing history, saved items, cart abandonment data, seller performance metrics

Information from Third Parties

1.3 We may receive information about you from:

Payment processors: Transaction status, payment verification, fraud detection data from Stripe, PayPal, and other payment providers
Social media: If you choose to connect social accounts or use social login features, we receive basic profile information
Delivery partners: Courier and shipping companies provide tracking and delivery information
Analytics providers: Aggregated traffic and usage data from Google Analytics and similar services
Verification services: Identity verification, fraud prevention, and risk assessment services
Public sources: Business registers, public records for verification of business Sellers

2. How We Use Your Information

We use the information we collect for the following purposes:

Providing and Improving Services

2.1 To operate the Kapsule marketplace and provide our services:

Create and manage your account
Process and fulfil orders and transactions
Facilitate communication between Buyers and Sellers
Process payments and issue refunds
Provide customer support and respond to enquiries
Verify identities and authenticate users
Enable seller tools, dashboards, and analytics
Manage returns, disputes, and the Buyer Guarantee programme

Personalising Your Experience

2.2 To customise and improve your experience:

Show you relevant product recommendations
Remember your preferences, saved items, and search history
Provide personalised search results and listings
Display relevant content and features based on your interests
Pre-fill forms and information for faster checkout

Communication and Marketing

2.3 To communicate with you:

Send transactional emails (order confirmations, shipping notifications, account updates)
Provide customer support and respond to your requests
Send service announcements and important policy changes
Deliver promotional emails and marketing communications (with your consent, and you can opt out at any time)
Send push notifications if you have enabled them in app settings
Conduct surveys and request feedback to improve services

Safety and Security

2.4 To maintain safety, security, and integrity:

Detect, prevent, and investigate fraud, abuse, and illegal activity
Verify identities and authenticate accounts
Protect against spam, harassment, and policy violations
Monitor compliance with our policies and terms
Enforce our agreements and legal rights
Secure our systems and prevent unauthorised access
Respond to legal requests and prevent harm

Analytics and Research

2.5 To analyse and improve our platform:

Understand how users interact with Kapsule
Analyse trends, usage patterns, and marketplace performance
Conduct research and develop new features
Test and optimise user experience
Create aggregated, anonymised statistics
Measure effectiveness of marketing campaigns

Legal and Compliance

2.6 To comply with legal obligations:

Meet tax reporting and record-keeping requirements
Comply with court orders, legal processes, and government requests
Respond to law enforcement requests where legally required
Enforce our agreements and protect rights
Maintain records for regulatory compliance

We share your personal information only as described below. We do not sell your personal information to third parties.

Sharing with Vendors

3.1 When you place an order, we share the information necessary for the vendor to fulfil your order. This includes your name, phone number, shipping address, and order details. We do not share your email address with vendors.

Vendors may receive this information through:

their vendor dashboard;
email or push notifications;
the Kapsule Vendor API (programmatic access used by vendors who integrate Kapsule with their own systems);
webhooks (real-time notifications sent to vendor servers when orders are placed or updated).

Vendors are contractually required under their seller agreement to use this information only for fulfilling your order, and not for marketing, resale, or any other purpose. Vendors must comply with the Privacy Act 2020 and are responsible for the security of any customer information they store on their own systems.

With Buyers

3.1aBuyers receive the Seller's business name, store location (city/region), and contact methods through our messaging system. All communications between Buyers and Sellers are conducted through Kapsule's messaging system.

With Service Providers

3.2 We share information with trusted service providers who assist us in operating the platform:

Payment processors: Stripe, PayPal, and other payment providers process payments on our behalf
Cloud hosting and storage: Hetzner, Cloudflare, and similar providers host our infrastructure, servers, and media files
Email services: Resend for sending transactional and marketing emails
AI and automation: We use AI services (including Anthropic Claude) to assist with content moderation, product description formatting, and customer support. These tools may process content you submit, but do not make automated decisions about individual users without human oversight
Analytics: Google Analytics, Mixpanel, or similar for usage analytics (often anonymised)
Fraud prevention: Services that help detect and prevent fraudulent activity
Delivery partners: Courier and shipping companies for order fulfilment
Crash reporting (Sentry):We use Sentry (sentry.io) to collect crash reports and error logs from our mobile app. This helps us identify and fix technical issues. Sentry receives device type, operating system version, app version, and error stack traces. We have configured Sentry to strip personally identifiable information (name, email address) before transmission. Sentry's privacy policy is available at sentry.io/privacy.
Social login (Facebook):If you choose to sign in with Facebook, we use the Facebook Login SDK which may collect device identifiers for authentication purposes. Please review Facebook's Data Policy at facebook.com/policy for details on their data practices.
Push notifications (Firebase): We use Google Firebase Cloud Messaging to send push notifications to your device. This requires a device token (FCM token) which is stored on our servers and shared with Google. You can disable push notifications at any time in your device settings or within the app.

Biometric Authentication

3.3If you choose to enable biometric login (fingerprint or face recognition), this authentication is processed entirely on your device using your device's secure enclave. We do not collect, store, or transmit your biometric data to our servers or any third party. Biometric data never leaves your device.

3.3 These service providers are contractually obligated to protect your information and may only use it for the specific services they provide to us.

For Legal Reasons

3.4 We may disclose your information if required by law or if we believe it is necessary to:

Comply with legal obligations, court orders, or government requests
Enforce our terms, policies, and agreements
Detect, prevent, or address fraud, security issues, or illegal activity
Protect our rights, property, and safety, or the rights and safety of our users or the public
Respond to claims that content violates third-party rights

Business Transfers

3.5 If Kapsule is involved in a merger, acquisition, asset sale, or similar transaction, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our website before your information is transferred and becomes subject to a different privacy policy.

With Your Consent

3.6 We may share your information with third parties when you give us explicit consent to do so, such as when you authorise third-party integrations or apps.

Anonymised and Aggregated Data

3.7 We may share anonymised, aggregated, or de-identified data that cannot reasonably identify you with partners, researchers, or the public for analytics, research, or marketing purposes.

4. Cookies and Tracking Technologies

4.1 We use cookies, pixels, local storage, and similar technologies to:

Remember your preferences and settings
Keep you logged in
Provide personalised content and recommendations
Analyse site usage and performance
Deliver relevant advertising
Prevent fraud and enhance security

4.2 Types of cookies we use:

Essential cookies: Required for the website to function (cannot be disabled)
Functional cookies: Remember your preferences and choices
Analytics cookies: Help us understand how visitors use Kapsule
Advertising cookies: Used to deliver relevant ads and measure campaign effectiveness

4.3 You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, disabling certain cookies may affect your ability to use some features of Kapsule.

4.4 We may also use web beacons (tiny graphics embedded in emails or web pages) to track whether emails are opened and links are clicked.

5. Your Privacy Rights and Choices

Under the Privacy Act 2020, you have important rights regarding your personal information:

Right to Access

5.1 You have the right to request access to the personal information we hold about you. You can:

View and download most of your information through your account settings
Request a copy of your information by emailing [email protected]
We will provide your information within 20 working days (or notify you if we need more time)

Right to Correction

5.2 You have the right to request correction of inaccurate or incomplete information:

Update most information directly in your account settings
Contact us at [email protected] to request corrections. We will investigate and correct any inaccuracies

Right to Deletion

5.3 You may request deletion of your account and personal information, subject to certain exceptions:

We may retain information required for legal, tax, or regulatory compliance (typically 7 years for transaction records)
Information needed for pending disputes, claims, or investigations
Anonymised or aggregated data that no longer identifies you
To request deletion, email [email protected]

Right to Data Portability

You have the right to request an export of your personal data in a structured, commonly used, machine-readable format (such as JSON or CSV). This includes your account information, order history, transaction records, communications, and preferences.

To request a data export, email [email protected]with the subject line “Data Export Request”. We will provide the export within 20 working days of verifying your identity.

Marketing Communications

5.4 You can opt out of marketing emails at any time by:

Clicking the “unsubscribe” link in any marketing email
Adjusting email preferences in your account settings
Contacting us at [email protected]

5.5 Note that you cannot opt out of essential transactional emails (order confirmations, account notifications, policy changes) as these are necessary for the service.

Push Notifications

5.6 You can disable push notifications through your device settings or app settings at any time.

Cookie Preferences

5.7 Manage cookie preferences through your browser settings or our cookie consent tool (if applicable).

6. Data Security and Protection

6.1 We implement appropriate technical and organisational security measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction, including:

Encryption of data in transit (HTTPS/TLS) and at rest
Secure password hashing and authentication
Regular security audits and vulnerability assessments
Access controls and employee training
Secure data centres with physical security measures
Monitoring for suspicious activity and unauthorised access
Incident response procedures and breach notification protocols

6.2 While we take security seriously and use industry-standard practices, no system is completely secure. We cannot guarantee absolute security of your information.

6.3 You are responsible for maintaining the confidentiality of your password and account credentials. Choose a strong password and do not share it with others.

6.4 Data breach notification: In the event of a data breach that is likely to cause serious harm to affected individuals, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with the Privacy Act 2020. Notification will be provided by email to your registered address and, where required, to the Office of the Privacy Commissioner. The notification will include the nature of the breach, the types of information affected, and the steps we are taking to address it.

6A. AI and Automated Processing

6A.1Kapsule uses artificial intelligence and automated processing tools, including our AI assistant “Aro”, to assist with:

Customer support and service enquiries
Dispute resolution: initial assessment and recommended outcomes
Fraud detection and prevention: analysing transaction patterns for suspicious activity
Content moderation: reviewing listings and user-generated content for policy compliance
Personalisation: tailoring search results, recommendations, and communications

6A.2 In performing these functions, Aro may process your personal information including account data, transaction history, message content, and behavioural data. This processing is conducted under the same privacy protections described in this Policy.

6A.3 Right to human review: You have the right to request that any decision significantly affecting you that was made or significantly influenced by automated processing (including AI) is reviewed by a human member of our team. To exercise this right, contact us at [email protected]with the subject line “Request Human Review”. We will acknowledge your request within 2 business days and complete the human review within 10 business days. If you wish to make a broader formal complaint about how Aro handled your matter, you may also use our Complaints Procedure.

6A.4 We do not make fully automated decisions that produce significant legal effects without human oversight. AI tools assist and inform human decision-making; they do not replace it for consequential matters such as account termination or dispute outcomes.

7. Data Retention

7.1 We retain your personal information for as long as necessary to provide our services and fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law.

7.2 Specific retention periods:

Account information: Retained while your account is active, plus 90 days after account closure (unless needed for longer for compliance)
Transaction records: Minimum 7 years from transaction date (for tax and legal compliance)
Communications and support tickets: Typically 3 years
Marketing lists: Until you unsubscribe, then removed within 30 days
Dispute and legal matters: Duration of the dispute/matter plus applicable statute of limitations period
Analytics data: Google Analytics 4 and similar analytics data is retained for 26 months from the date of collection, in line with GA4 default settings. Aggregated, anonymised reporting data may be retained indefinitely.

7.3 We periodically review and delete information that is no longer needed, in accordance with our data retention schedule.

8. Children's Privacy

8.1 Kapsule is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18.

8.2 If you are under 18, you may only use Kapsule with the involvement and supervision of a parent or legal guardian.

8.3 If we become aware that we have inadvertently collected personal information from a child under 18 without parental consent, we will take steps to delete that information as soon as possible.

8.4 If you believe we have collected information from a child under 18, please contact us immediately at [email protected].

8A. Information for International Visitors

8A.1 Kapsule is operated by Kapsule Group Limited, a New Zealand company. The platform is primarily intended for use within New Zealand.

8A.2 If you access Kapsule from outside New Zealand, please be aware that your personal information will be transferred to, stored in, and processed in New Zealand. By using Kapsule, you consent to this transfer and processing.

8A.3The collection, use, and handling of your personal information is governed by New Zealand’s Privacy Act 2020 and the information privacy principles contained therein. We comply with this Act regardless of your location when you use our services.

8A.4 New Zealand has been recognised as providing adequate privacy protections for international data transfers by several jurisdictions. However, the privacy laws in your home country may differ from New Zealand law. By using Kapsule, you acknowledge and accept that your information is processed under New Zealand law.

9. International Data Transfers

9.1 Your information may be transferred to, stored in, and processed in countries outside New Zealand, including locations where our service providers and hosting infrastructure are located (such as Australia, United States, or European Union).

9.2 When we transfer information internationally, we ensure appropriate safeguards are in place through:

Contractual commitments requiring service providers to protect your information
Selecting providers in jurisdictions with adequate privacy protections
Using standard contractual clauses or other approved transfer mechanisms

9.3 By using Kapsule, you consent to the transfer of your information outside New Zealand in accordance with this policy.

10. Third-Party Links and Services

10.1 Kapsule may contain links to third-party websites, services, or applications that are not controlled or operated by us.

10.2 This Privacy Policy does not apply to third-party websites or services. We are not responsible for the privacy practices of third parties.

10.3 We encourage you to review the privacy policies of any third-party services before providing them with your information.

10.4 Individual Sellers on Kapsule are independent third parties responsible for their own privacy practices. While we require Sellers to comply with privacy laws, we cannot control how they handle information you provide directly to them.

11. Changes to This Privacy Policy

11.1 We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or for other operational reasons.

11.2 When we make material changes, we will notify you by:

Updating the “Last updated” date at the top of this policy
Sending an email notification to your registered email address
Posting a prominent notice on the website or in your account
Providing an in-app notification

11.3 We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

11.4 Your continued use of Kapsule after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us and Complaints

Privacy Questions and Requests

12.1 If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Email: [email protected]

Postal Address:
Privacy Officer
Kapsule Group Limited (Kapsule)
Suite 13063, Level 1
6 Johnsonville Road
Johnsonville, Wellington, 6037
New Zealand

Privacy Complaints

12.2 If you believe we have breached your privacy rights or not handled your information in accordance with this policy:

Contact us at [email protected] with details of your complaint
We will acknowledge your complaint within 5 business days
We will investigate and respond within 20 working days (or notify you if we need more time)
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner

Office of the Privacy Commissioner

12.3You have the right to lodge a complaint with New Zealand's Privacy Commissioner:

Website: privacy.org.nz
Phone: 0800 803 909
Email: [email protected]
Address: Level 8, 109-111 Featherston Street, Wellington 6011

13.1 By using Kapsule, creating an account, or providing us with your personal information, you consent to the collection, use, disclosure, and storage of your information as described in this Privacy Policy.

13.2 Where we process your information for purposes requiring your consent (such as marketing communications), we will obtain your express consent before processing.

13.3 You may withdraw your consent at any time by contacting us, but this will not affect the lawfulness of processing before withdrawal.