Legal

Privacy Policy

Last updated: 12 October 2026

Stravia Marketing is run by Owen as a sole trader based in New Zealand. In this policy "I", "me" and "my" mean Owen trading as Stravia Marketing. This policy explains what personal information I collect through this website and the client portal, how I use it, where it is stored, and the rights you have under the New Zealand Privacy Act 2020.

The short version: I only collect what I need to reply to you and to build, host and support your website. I do not sell personal information, and I do not use it for advertising.

What I collect and why

Contact form

When you send an enquiry through the contact form, I collect your name, your company name (optional), your email address, your message, and the hosting plan you selected if you arrived from the pricing section (optional). When the form is submitted, the server also records the IP address it was sent from and the date and time.

Each enquiry is saved to a file on my server and emailed to me so I can reply, and you get an automatic email confirming it arrived. The IP address and timestamp are recorded so I can spot spam and abuse. The contact form and the portal sign-in page are rate limited by IP address, which means the server temporarily blocks an address that sends too many requests in a short time.

Client portal

If you become a client, I create an account for you in the client portal. For that I hold your name, email address and a password, which is stored as a one-way hash (I cannot see your password). I also keep a client record covering your company name, contact person, phone number, billing contact and billing email, postal address, hosting plan, your website address, invoices, support tickets and the messages and files in them, and notes about your project so I can look after it properly. Files you attach in the portal are stored privately on my server, not on the public website, and only you, your colleagues on the same account and I can download them. When I reply to one of your support tickets, my reply is also emailed to your portal account, or to your contact email address if you do not have a portal account. Ask me and I will switch those emails off for you. If you ask for a password reset on the sign-in page, a one-time link is emailed to the address on your account, and you get an email whenever your password is changed, so you would know if it was not you.

Requesting access to the client portal

If you ask for access to the client portal from its sign-in page, I collect your name, your email address, your company name, whether you are a client or someone else, and your message. It is handled the same way as a contact form enquiry: saved on my server, emailed to me so I can reply, with the IP address and time it was sent recorded to spot spam.

Businesses I contact

If I get in touch with your business about a website, I keep a record of it so I can follow up: the business name, the name of the person I am talking to, their work email address and phone number, the town or city the business is in, and notes of what we discussed. These come from you or from what the business publishes about itself, such as its website or listing. If you ask me not to contact you again, I won't, and if you ask me to delete your details, I will.

Website content

Images, text and other material that you or I add to your website are stored on my server so the site can be built, published and updated.

Server and security logs

Like most web servers, the server behind this site keeps standard access logs: IP address, browser type, pages requested and the time of each request. I use these only for security, rate limiting and troubleshooting, and they are kept for a limited time before being overwritten.

Analytics

I use Google Analytics on the public marketing pages of this site to understand which pages people visit, how they found the site and roughly where in the world they are, so I can make the site better. Details are in the cookies section below. Analytics is not used on the client portal.

Cookies

This site uses these kinds of cookies.

Strictly necessary: when you sign in to the client portal, a session cookie called stravia.sid keeps you signed in. It is marked httpOnly (scripts in the page cannot read it), it is sent only over HTTPS, and it expires after 7 days, or when you close your browser if you untick “Keep me signed in” on the sign-in page. The matching session record is stored in the database on my server and is deleted when it expires or when you sign out. Changing your password ends every other session your account holds, and resetting a forgotten one ends all of them. This cookie is only set when you sign in; ordinary visitors to the marketing pages do not receive it.
Strictly necessary: if your account uses a sign-in code and you tick “trust this browser”, a cookie called stravia.trusted lets that browser skip the code for 30 days. It holds a random token (the database keeps only a scrambled copy of it), is marked httpOnly and is sent only over HTTPS. Changing your password, turning sign-in codes off, or choosing to forget your other browsers in your account ends it early.
Analytics: on the public marketing pages, Google Analytics 4 sets cookies named _ga and _ga_ followed by an identifier. These give your browser a random ID so Google can tell repeat visits from new ones. They typically last up to two years. Usage data (pages viewed, approximate location, device and browser type, how you reached the site) is sent to Google LLC in the United States. Google Analytics 4 does not log or store full IP addresses; they are used briefly to work out a rough location and then discarded. I do not use analytics data for advertising, and I have not turned on Google's advertising features.
Spam protection: the contact form, the Request access form and the Forgot password form use Google reCAPTCHA v3 to tell people from automated spam. When you use one of those forms, Google receives information about your visit (such as your IP address, browser and how you moved around the page) and may set its own cookies. It is used only to check the form was sent by a person. Google's Privacy Policy and Terms of Service apply.

Opting out of analytics. You can block or delete cookies in your browser settings, use a content or tracker blocker, or install Google's Analytics opt-out browser add-on. The site works normally without analytics cookies.

There are no other tracking or advertising cookies on this site.

How I use your information

To reply to your enquiry and talk through your project.
To design, build, host, maintain and support your website.
To send invoices, receipts and service messages such as maintenance or outage notices.
To keep the site and portal secure, including detecting spam and blocking abusive traffic.
To understand how the public site is used so I can improve it.

I do not sell or rent personal information, and I do not share it with anyone except the service providers listed below, or where the law requires me to.

Where your information is stored and who else handles it

The website, the client portal and its database run on an Amazon Web Services (AWS) server in the Asia-Pacific region, which is outside New Zealand. The following providers also handle some of your information on my behalf:

Amazon Web Services (hosting, cloud storage for backups, and email delivery through Amazon SQS and Amazon SES). When you send an enquiry, I reply to a support ticket, or you reset your password, the email, including names, email addresses and the message itself, passes through those services on its way to the recipient. AWS is a US company operating data centres around the world.
Google (Google Analytics, US-based), for the public marketing pages only, as described in the cookies section.
Google (reCAPTCHA, US-based), to keep spam out of the forms, as described in the cookies section.

Backups. A copy of the portal database and the enquiry file is backed up automatically every day. Backups are kept for 14 days and then deleted. They may also be copied to AWS cloud storage so they survive a server failure.

Sending information overseas. Under information privacy principle 12 of the Privacy Act 2020, I may only send your personal information overseas if I am satisfied it will be protected to a standard comparable to New Zealand law, or if you agree to it after being told that the overseas laws may not offer that protection. AWS and Google are each bound by contract and by their own published privacy commitments to keep the information they handle for me secure and to use it only to provide their service. I do not send personal information to any other country or organisation.

How I keep it secure

The site is served over HTTPS. Portal passwords are hashed and never stored in plain text. Sign-in and contact attempts are rate limited, the portal session cookie cannot be read by scripts, and the server sends standard browser security headers. Software on the server is kept up to date. No system is perfectly secure, but I take reasonable steps to protect your information and will tell you if there is a breach that is likely to cause you serious harm, as the Privacy Act requires.

How long I keep it

Enquiries: kept while they are relevant to a possible or current project, then deleted. You can ask me to delete an enquiry at any time.
Client records and invoices: kept while you are a client, and afterwards for as long as New Zealand tax law requires business records to be kept (currently seven years).
Portal sessions: deleted after 7 days (one day for a sign-in that ends with the browser) or when you sign out.
Backups: 14 days.
Analytics: Google Analytics keeps individual visit data for no more than 14 months; aggregated reports may be kept longer.

Your rights under the Privacy Act 2020

You have the right to:

ask whether I hold any personal information about you;
ask for a copy of the personal information I hold about you;
ask me to correct anything that is wrong or out of date;
ask me to delete your information, which I will do unless I need to keep it for a legal reason such as tax record-keeping.

To exercise any of these rights, email owen@straviamarketing.com. I will respond within 20 working days, and there is no charge.

Complaints

If you think I have handled your information in a way that breaches the Privacy Act 2020, please email me first so I can put it right. You can also contact the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.

Changes to this policy

I may update this policy from time to time, for example if I change a service provider or add a new feature to the site. The "Last updated" date at the top of the page shows when it last changed. If a change materially affects how I use clients' information, I will email current clients before it takes effect.

Contact

Questions about this policy? Email owen@straviamarketing.com.

← Stravia Marketing · Terms of service