Privacy Policy — Start-up Navigator™

1. Who we are

Start-up Navigator™ is a product of Bossit Limited, a New Zealand company. We are committed to protecting your personal information in accordance with the Privacy Act 2020 (NZ).

Privacy enquiries: hello@bossit.nz

2. What information we collect

We collect only what is necessary to provide the course and manage your account.

Account & profile

Your name, email address, account creation date, and access status (e.g. paid or admin-granted). If you purchased access, we also store a Stripe customer ID and session ID — not your card details.

Authentication

Your email and a securely hashed password (we never see your actual password), login timestamps, and session tokens. If you sign in with Google, we store your Google account identifier.

Course progress

Which of the 13 course sections you have completed or are working through, the notes and rich-text content you type into each section, and any images you upload into your notes.

Generated documents

PDF exports of your Business Start-Up Chart, stored privately and accessible only to you.

Email records

A log of transactional emails we have sent you (welcome emails, payment receipts, admin invitations) including the recipient address, template used, and delivery status. Unsubscribe tokens and suppressed addresses are also stored.

3. What we do not collect

We do not collect: analytics or tracking cookies · third-party advertising pixels · financial account numbers or IRD numbers (unless you type one into your own notes) · your credit card or payment details — these are handled entirely by Stripe and never reach our systems.

AI-generated suggestions are produced via the Lovable AI gateway in real time. These prompts and responses are not stored unless you explicitly save content into your course notes.

Your information is never used to train AI models. We block external crawlers from accessing any user-entered content.

4. Payments

All payments are processed securely by Stripe, a PCI DSS-compliant payment provider. Bossit does not store, see, or have access to your credit card number, expiry date, or CVV. We only retain a Stripe customer ID and session ID for account management purposes. Stripe's own privacy policy applies to payment data: stripe.com/nz/privacy

5. How we use your information

• To create and manage your account and course access
• To save and display your course progress and notes
• To generate and store your Business Start-Up Chart PDF
• To send you transactional emails (receipts, welcome, important account notices)
• To respond to support enquiries
• To comply with our legal obligations under New Zealand law

We do not sell, share, or use your information for marketing purposes beyond this product.

6. Third-party services

Stripe

Payment processing — stripe.com/nz/privacy

Supabase

Secure database and file storage (hosted on AWS infrastructure) — supabase.com/privacy

Lovable / AI gateway

AI-generated course suggestions (not stored unless you save them) — lovable.dev/privacy

Cloudflare

Domain security, DDoS protection, and content delivery — cloudflare.com/privacypolicy

Each provider's own privacy policy applies to data they process on our behalf.

7. Where your data is stored

Your data is stored on secure cloud infrastructure provided by Supabase, which runs on AWS servers. Supabase maintains industry-standard security practices including encryption at rest and in transit.

Your uploaded images and generated PDF documents are stored in private, access-controlled storage buckets — they are not publicly accessible.

8. How long we keep your data

We retain your account information and course content for as long as your account is active. If you close your account or request deletion, we will remove your personal data within 30 days, except where we are required to retain certain records by law (e.g. financial transaction records).

Email delivery logs are retained for 6 months for troubleshooting and compliance purposes.

9. Your rights under the Privacy Act 2020

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Correct any information that is inaccurate or out of date
• Request deletion of your personal information (subject to legal retention requirements)
• Ask how your information is being used

To exercise any of these rights, contact us at hello@bossit.nz. We will respond within 20 working days as required by the Act.

10. Data breaches

In the event of a privacy breach that is likely to cause serious harm, we will notify affected users and the Office of the Privacy Commissioner (OPC) as required under the Privacy Act 2020.

11. AI-generated content disclaimer

Content generated by AI within this course is intended as a general starting point only and should not be taken as professional legal, financial, or tax advice. Always verify information with a qualified professional or the relevant New Zealand government agency before making business decisions.

12. Contact & complaints

If you have a privacy concern or complaint, please contact us first at hello@bossit.nz. If we are unable to resolve your concern, you may contact the Office of the Privacy Commissioner at privacy.org.nz.