Privacy statement

Cruizy is operated by MacG TechnoloG in New Zealand. We follow the Privacy Act 2020 and its Information Privacy Principles.

What we collect

• Account: your email, display name and mobile number (stored encrypted; used to verify you and, if you choose, shown to buyers).
• Listings: vehicle details, photos (we remove location data from photos), your answers and description, and your town or suburb.
• Plate and VIN: stored encrypted and never shown publicly or included in search-engine data.
• Messages between buyers and sellers, which we scan automatically for scam patterns.
• Payments: handled by our payment provider; we don’t see or store card numbers.
• Technical: IP address and device information for security, rate limiting and fraud prevention.

Telling you when we collect (IPP 3)

When we ask for information we say why, whether it’s optional, and who will see it: for example on the sell form, the ID check, and every consent screen. Anything marked optional stays off unless you choose it.

Information we collect from others (IPP 3A)

When you enter a plate, we look it up with a vehicle-data provider to fill in official vehicle details (make, model, WOF and rego expiry, odometer history, number of owners). We don’t request or collect owner names or addresses. If you choose a PPSR check or ID verification, we tell you at the time which provider we use and what we receive.

If you ask a partner (finance, insurance, inspection or reports) for a quote through Cruizy, the partner may tell us what happened to that request (for example, qualified or settled) so we can be paid our flat referral fee. We don’t receive your loan, policy or credit details.

ID verification and biometrics

ID verification is optional. It’s done by our provider, who compares your ID with a live selfie. We receive only the result; we don’t store ID images or face templates. We follow the Biometric Processing Privacy Code 2025 and offer a manual alternative on request.

How we use it

To run the marketplace, verify accounts, prevent fraud and scams, show official vehicle details, process payments, provide support, and improve Cruizy.

Marketing messages

We send marketing emails or texts only if you’ve said yes to that kind of message (news and offers, ads in your saved-search alerts, WoF and rego reminders, partner offers, or marketing texts). Each choice starts unticked. We keep a record of what you agreed to, the wording you saw, where and when, and when you withdrew. Every marketing email says who it’s from and has a one-click unsubscribe that works straight away; for texts, reply STOP. Messages about your listings, enquiries and account aren’t marketing and still come. Manage everything in Account → Privacy & data.

If you tick “OK to feature my listing in Cruizy videos and social media posts”, we may show your car (photos, details and price, never your plate, name or contact details) in our videos and posts. You can withdraw that at any time.

Analytics and advertising

If they’re turned on, we use Google Analytics 4 to understand how Cruizy is used, and the Meta Pixel and Google Ads to measure our own advertising. Ads on Cruizy may be served through Google Ad Manager, and on guide pages Google AdSense. These tools use cookies and device information and are run by Google and Meta under their own privacy policies. We never send them your plate, VIN, name, email, phone number or exact location, and we don’t upload hashed email addresses or phone numbers for ad matching. You can turn off ad personalisation and analytics at Ad choices; when you do, those tags don’t load for you.

We also use Cloudflare Web Analytics, which loads a small script from static.cloudflareinsights.com on every page to count visits and measure how fast pages load. It doesn’t set cookies or build a profile of you; Cloudflare sees your IP address and browser details in order to produce totals for us, and we only ever see the totals. It isn’t used for advertising, so it stays on when you turn off analytics at Ad choices.

Who we share it with (IPP 11)

Buyers and sellers you contact; service providers who process data for us (hosting, email, SMS, payments, vehicle data, ID verification, AI writing help, analytics); and authorities where the law requires. We send your details to a partner only when you ask for a quote and agree on a screen that lists exactly what goes; a plain link to a partner passes nothing about you. We don’t sell personal information.

Sending information overseas (IPP 12)

Some of our service providers store or process information outside New Zealand, including Google and Meta (analytics and advertising), Cloudflare (hosting security and Web Analytics) and providers of email, SMS, payments and AI writing help, mainly in Australia, the United States and the European Union. We only use providers that are subject to privacy laws or contract terms that give comparable protection to the Privacy Act, and we send them only what they need.

How long we keep it

• Messages: 24 months after the last activity.
• Raw vehicle-lookup data: 90 days.
• Booking and payment records: 7 years (tax law).
• Everything else: while your account is open, then deleted or anonymised unless the law requires otherwise.

Your rights

You can ask for a copy of your information, ask us to correct it, or ask us to delete your account. Most of this is self-service in Account → Privacy & data, including a download of your data. We respond to requests within 20 working days. If you’re not happy, you can complain to the Office of the Privacy Commissioner.

Security and breaches

We encrypt sensitive fields, limit staff access and log administrative actions. If a privacy breach is likely to cause serious harm, we’ll notify the Privacy Commissioner and affected people as the law requires.