Privacy Policy

How we collect, use, share and protect personal information, consistent with the New Zealand Privacy Act 2020 and written to be GDPR-aware.

Last updated 1 October 2026

Template notice. This document is complete and reflects the commercial terms at launch, but it is pending review by a New Zealand-qualified legal practitioner. It is not legal advice.

This Privacy Policy explains how DataRiver New Zealand Limited, NZBN 9429050155972, trading as OvernightOps ("we", "us"), handles personal information when you use overnightops.app or purchase a work order. It should be read alongside our Terms of Service and Statement of Work.

1. Information we collect

Contact and order details: your corporate email address, the deliverable selected, turnaround tier, and the operational metadata needed to fulfil the order.
Technical intake: the repository URL, the encrypted read-only access token, written specifications, target environments and acceptance criteria you provide.
Payment information: handled directly by Stripe. We receive only limited transaction metadata (amount, currency, status and a payment reference) and never your full card number.
Usage and attribution: advertising parameters (such as UTM tags and click identifiers) and, where analytics is enabled and consented, aggregate usage data.

2. How we use information

to validate eligibility for overnight SLA intake and prevent fraud and abuse;
to create, schedule and deliver the work order;
to issue receipts and respond to support enquiries;
to measure and improve the performance of our marketing;
to meet our legal, tax and accounting obligations.

3. Legal bases (GDPR-aware)

Where the EU or UK GDPR applies, we rely on: performance of a contract (to deliver the work order); legitimate interests (to secure our service and improve it); consent (for non-essential analytics and advertising cookies, where required); and legal obligation (for tax and accounting records).

4. Cookies, analytics and Consent Mode

We use Google Analytics 4 with Consent Mode v2. Consent defaults to denied, and non-essential storage is only activated where a visitor has consented or where no consent is required in their jurisdiction. Our current launch markets do not include the UK or EU, and a consent banner is provided as a safety net for visitors from those regions.

5. How we share information

We share personal information only as needed to run the service, with:

Stripe — payment processing and fraud prevention;
Cloudflare — website hosting and edge security;
email delivery and monitoring providers — transactional email and service reliability;
professional advisers — where necessary, under confidentiality obligations.

We do not sell personal information.

6. International transfers

We are based in New Zealand and use providers that may process data in other countries, including the United States. Where required, we take steps to ensure appropriate safeguards apply to those transfers.

7. Data retention and source code

Order and billing records are retained as required for accounting and legal purposes. Repository access tokens are encrypted and used only for the duration of the engagement; the decryption key is held on our delivery machine. Workspaces are ephemeral and wiped after delivery and verification, and we do not retain copies of client source code.

8. Security

We apply least-privilege access, client-side encryption of deploy tokens, isolated ephemeral workspaces, encrypted transport, and access controls aligned with NZISM-informed practice. No method of transmission or storage is completely secure, but we work to protect your information appropriately.

9. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal information, object to or restrict certain processing, and withdraw consent where consent is the basis. To exercise these rights, contact [email protected]. New Zealand individuals may also contact the Office of the Privacy Commissioner.

10. Children

Our services are intended for businesses and are not directed to children. We do not knowingly collect information from children.

11. Changes to this policy

We may update this policy from time to time. The current version is always published here, and material changes will be indicated by the "last updated" date.

12. Contact

Questions about this policy or your personal information can be sent to [email protected]. DataRiver New Zealand Limited, NZBN 9429050155972, https://datariver.co.nz/.