Legal

Privacy Policy

Last updated 28 October 2026

The short version: we collect what we need to reply to you and do the work, we keep it in the tools we run the business on, we never sell it, and you can ask what we hold about you at any time.

Who we are

The Caper Web Solutions Limited (NZBN 9429042325246), trading as The Caper, based in Orewa, New Zealand. This policy covers thecaper.co.nz and the work we do for clients. Doris (getdoris.ai) and Cadence Engine (getcadence.co) are separate products with their own privacy statements. [CONFIRM]

What we collect, and when

  • When you fill in a form on this site: your name, email, phone if you give it, business name, what you want to fix and which kind of client you are.
  • When you book a call: your name, email, phone, the time you chose and any note you add.
  • When you order an AI Visibility Report: your business name, website address, name, email, phone and the search terms you tell us about.
  • When you use the chat widget: your name, contact details and what you type.
  • When you become a client: the details of the work, our communications, invoices and payment records, and any logins or access you give us to your website, Google Business Profile, CRM or other systems.
  • When you visit the site: the usual technical data (IP address, browser, pages viewed, how you got here) through cookies and analytics tools.

We collect only what we need for the purpose in front of us, and we collect it from you, not from anyone else, unless you have asked us to (for example, pulling in your Google reviews).

What we use it for

To reply to you, to run the call you booked, to deliver the work you have paid for, to invoice you, to keep the records the law requires us to keep, and to understand how the website is used so we can improve it. We send marketing email or texts only if you have agreed to receive them. Every message has an unsubscribe link, and we honour it the same day. This is how the Unsolicited Electronic Messages Act 2007 works and we are glad of it.

Who we share it with

We do not sell, rent or trade personal information. We share it only with the services that run our business, and only as much as each one needs:

  • GoHighLevel (LeadConnector): our CRM, forms, booking, email and SMS. Hosted in the United States.
  • Google: email, calendar, documents and analytics.
  • Cloudflare: website security and DNS.
  • Xero: invoicing and accounts.
  • Stripe: card payments. [CONFIRM]
  • Meta: the Facebook pixel on this site, if you have not blocked it. [CONFIRM]
  • AI tools such as Claude and ChatGPT, used in the work we do. See the next section.
  • Specialist subcontractors on specific jobs, for example a designer, under confidentiality.

We will also disclose information where the law requires us to.

AI tools and your information

We use AI tools in our work; it is the work. Before anything about your business goes into an AI tool, we agree with you what can and cannot go in, and which tools we use. For Discovery clients that agreement is written into the ground rules you receive. We use business versions of these tools whose terms say your information is not used to train their models, and we do not use your information to train anything ourselves.

Where it is stored

Most of the services above hold data outside New Zealand, mainly in the United States and Australia, under their own privacy and security commitments. By giving us your information you agree to it being held that way. If that is a problem for you, tell us through the contact form before you send anything else and we will talk about what is possible.

How we protect it

Access to our systems is limited to the people who need it, protected by passwords and two-factor authentication, and removed when it is no longer needed. No system is perfect. If a privacy breach happens that we believe is likely to cause you serious harm, we will tell you and the Office of the Privacy Commissioner, as the Privacy Act 2020 requires.

How long we keep it

  • Client records, including invoices and the work we did: seven years, because tax law requires it.
  • Enquiries that do not become work: two years, then deleted. [CONFIRM]
  • Website analytics: as long as the analytics tool keeps it, which for Google Analytics is 26 months by default.

Your rights

You can ask to see the personal information we hold about you, and ask us to correct it. Use the contact form on this site. We will respond within 20 working days, as the Privacy Act requires, and usually much sooner. If you are not happy with how we have handled your information, tell us first and we will try to put it right. If we cannot, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Cookies

This site uses cookies for analytics and so the booking and form widgets work. You can block cookies in your browser; if you do, the forms and booking may not work.

Changes to this policy

We update this page when our practices change. The date at the top is the version you are reading.

Contact

The contact form on this site, or the Call button on the contact page.