Your information is used to arrange the job you asked for.

Who is responsible for your information

Serproz is a New Zealand marketplace that connects customers with trade and service professionals. In the language of the Privacy Act 2020, the operator of this site is the agency responsible for the personal information described below.

The registered company details for the operator of Serproz are not published on this site yet. When the registered name, New Zealand Business Number and registered address are published they will appear here and on the contact page, and the operator named there is the agency responsible under the Privacy Act 2020. Until then the support page is the channel of record for every privacy request.

A named privacy officer address is not published yet. Until it is, send privacy requests through the support page and mark them as a privacy request. They are routed to the person performing that role, and the statutory response times below still apply.

What we collect at booking

These are the clauses shown at the point of booking. They are reproduced word for word because the notice recorded against your booking refers to this page.

What else we collect, and when

Beyond the booking clauses above, the marketplace collects only what a specific feature needs.

• Account and sign-in: Your email address, a hashed password, your role, and — if you sign in with Google — the account identifier Google returns. Serproz never receives your Google password.

• Provider verification: Business, identity and occupational-licence evidence supplied by a provider when claiming or verifying a profile, plus the result of any register check that applies to that occupation.

• Jobs and messages: Job descriptions, photos you upload, quotes, scope documents, change orders, milestone evidence, in-platform messages and dispute submissions.

• Payments: Amounts, fee snapshots, payment state and the payment processor references for a job. Serproz does not receive or store your full card number.

• Security and audit: Sign-in events, session activity and an append-only audit record of state changes, which is what makes a payment or a dispute reviewable afterwards.

• Directory information from public sources: Some provider profiles begin as unclaimed listings built from publicly available business information rather than from the business itself. Those listings carry the listed and unclaimed status label until a business claims them.

Where information about a business is collected from a source other than that business, the profile says so through its public status label. A business can claim its profile, ask for a correction, or ask for the listing to be removed through the support page.

AI assistance, voice messages and call notes

Serproz uses Google/Gemini for optional AI assistance. Information sent for AI processing leaves Serproz and is processed by Google; it does not stay solely in your browser or in the Serproz database.

• Text and document assistance: When you request an AI draft, search, explanation or document analysis, the feature can send your message, recent conversation context, relevant job or account details, and any document or image selected for that analysis to Google. Include only information needed for the task, and avoid passwords, card details and unrelated private information.

• Optional voice messages: The assistant asks for your agreement before you record a microphone message for Google transcription. Each recording lasts up to one minute. You can edit the returned transcript before sending it as an assistant message. Read-aloud controls send the response text to Google to generate speech; that voice is AI-generated. The assistant does not listen continuously in the background.

• Both people decide about live-call transcription: AI call notes start only when both original participants agree to the notice naming Google/Gemini. Short segments from each participant's unmuted microphone are sent for transcription. You can join without agreeing, or withdraw during the call or from its ended-call page. Withdrawal stops further processing through Serproz, but cannot recall material already sent to Google. Earlier notes remain until they expire.

• Private, imperfect call notes: Within Serproz, only the two original participants can view the call transcript. Notes may miss words, contain errors or have gaps caused by muting, connectivity, consent changes or provider failures. They are not a complete or authoritative record of what was agreed. Transcript text expires after 30 days; the retention details below distinguish it from other call records.

• A job draft is a separate choice: After a call, the customer can ask for a separate draft based on their own transcribed job details. The other provider's transcript is excluded from that input. The customer must review and edit the draft, remove anything private, and complete the normal Post a Job submission before the job is shared. Serproz does not attach the call transcript or automatically send it to other providers. Quotes, payments and outreach are not approved by the assistant.

Google’s Gemini API terms distinguish paid API processing from unpaid services. For paid services, Google says prompts and responses are not used to improve its products, but may be retained for safety, security and legal purposes. Google may process or temporarily store them outside New Zealand. Serproz’s 30-day expiry for private call notes does not set Google’s retention period. See Google’s abuse-monitoring information for its processing practices. AI availability depends on the service being available; a failed request does not mean a transcript or draft was created.

How your information is used

Personal information is used for the purpose it was collected for, and for directly related purposes you would reasonably expect.

• Creating and securing your account, and keeping you signed in.

• Matching a job to eligible providers, arranging the work, and sending the essential updates that keep the job moving.

• Taking payment, holding milestone funds, releasing or refunding them, and producing the records that back those movements.

• Investigating a dispute, a report about a listing, a review, or a suspected misuse of the marketplace.

• Detecting and preventing fraud, abuse and security incidents, and meeting legal, tax and regulatory obligations.

• Measuring how the product performs, using first-party analytics that record journey stages and identifiers rather than the content you typed.

• Responding to the AI assistance you request, transcribing a voice message you agree to send, or creating private call notes when both participants consent. You review generated wording before using it in a job or other action.

Who your information is shared with

Serproz does not sell personal information, and does not share it for unrelated third-party marketing.

• The other party to your job: A customer's contact details go to the provider who accepts the booking, and a provider's business details are visible to the customer, because a job cannot be arranged otherwise.

• Service providers: Payment processing, email delivery, file storage, error reporting, and Google/Gemini for the AI requests, selected documents, voice messages and consented call transcription described above. Each service receives the information needed for its function.

• Verification sources: Where a check runs against an official register or business dataset, the identifiers needed for that lookup are sent to the operator of that register for the sole purpose of confirming the claimed evidence.

• Legal and regulatory recipients: Where disclosure is required or authorised by law, or is necessary to prevent a serious threat to health or safety.

• A successor operator: If the business or part of it is transferred, personal information may transfer with it, subject to this policy continuing to apply.

Sending information outside New Zealand

Some of the service providers Serproz relies on operate, or store data, outside New Zealand. Information Privacy Principle 12 applies whenever that happens.

• What may go offshore: Payment processing, transactional email delivery, uploaded-file storage, live Google Places requests, and Google/Gemini processing of AI text, selected documents or images, optional voice messages and consented call-audio segments.

• The condition Serproz applies: A foreign provider is used only where Serproz is satisfied that the provider is required to protect the information with safeguards comparable to those in the Privacy Act 2020, ordinarily through the contract with that provider.

• What this means for you: Information held overseas may be subject to the laws of that country, including lawful access by its authorities. That risk cannot be contracted away, so it is disclosed here rather than buried.

Google processes the live Google Places request for Google Maps content under its Privacy Policy. Serproz does not store the displayed Google rating, review text, reviewer details or photo content.

How long we keep it

Information Privacy Principle 9 prohibits keeping personal information for longer than it is needed for a lawful purpose. Retention depends on the feature and the kind of record.

• While your account is open: Account, profile and job information is kept for as long as the account is in use, so you can see your own history.

• Money and dispute records: Records evidencing a payment, refund, release or dispute outcome are retained after a job ends, because they may be needed for tax and accounting and to answer a later query or claim. Those records are append-only by design and are not edited in place.

• Security and audit logs: Sign-in and state-change logs are retained so a security question can still be answered after the fact, and are then removed or de-identified.

• Assistant conversations and voice messages: The globe assistant keeps its displayed conversation in page memory rather than a saved account chat history. Recent messages are resent when needed to answer a follow-up. Transcription audio and generated speech are processed for the request and are not saved by that assistant as uploaded files. Google processing and retention are separate, as explained above.

• Drafts kept in your browser: When you choose to review an assistant job draft, its wording is held in this tab's session storage for transfer to the form, with a 30-minute review window. Applying or dismissing that suggestion clears the transfer. The normal Post a Job form can keep your editable draft in session storage through navigation and sign-in until you submit it or the browser clears the tab session.

• Private call transcripts and unposted call drafts: Each transcript segment and server-held call draft expires 30 days after it is created or, for a regenerated draft, updated. Expired content is immediately excluded from participant views and is deleted by the scheduled call cleanup. Publishing a reviewed draft creates an ordinary job record, whose retention follows the job and payment rules above.

• Separate call recordings and consent records: The new transcription path does not save raw microphone segments as Serproz files. A separate quality or dispute recording, where enabled and consented to, and the call's consent and audit records are different records. The 30-day transcript expiry does not promise deletion of those records or of copies retained by Google. Ask through the privacy contact below for information about a particular call record.

• Closing an account: When an account is closed, information no longer needed is deleted or de-identified. Information that must be kept for one of the reasons above is retained for that purpose only and is not used to contact you.

The specific assistant and call-note periods above apply to those features. Exact periods for every other class of record have not yet been published. You can ask what Serproz holds about you, why it is retained and which retention period applies through the privacy contact below.

Your right to see and correct your information

Principles 6 and 7 of the Privacy Act 2020 give you two rights, and in the ordinary case Serproz does not charge you for exercising either.

• Access: You can ask whether Serproz holds personal information about you and ask for a copy of it. Serproz must decide and respond as soon as reasonably practicable, and no later than 20 working days after receiving the request.

• Correction: You can ask for information about you to be corrected. If Serproz does not agree to make the correction, you can ask for a statement of the correction you sought to be attached to the information, and that request will be actioned.

• How to ask: Send the request through the support page, or to the privacy officer contact shown above once it is published. Say what you are looking for so the right records can be found.

• Identity: Serproz will confirm you are the person the information is about before releasing it. That check protects you; it is not a reason to refuse a genuine request.

• Refusals: The Act sets limited grounds for withholding information, such as where releasing it would disclose someone else's personal information. If a request is refused you will be told which ground applies and that you can complain to the Privacy Commissioner.

How your information is protected

• Passwords are stored only as a modern one-way hash. Nobody at Serproz can read your password.

• Session cookies are HttpOnly and are marked Secure outside local development, and the refresh cookie is restricted to the authentication endpoints so it is never sent to an ordinary page.

• Access to production data is limited to the people who need it to operate the marketplace, and privileged actions are written to the audit log.

• Uploaded files are stored in private buckets and served through access-checked links rather than public URLs.

• No system is perfectly secure. If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, Serproz will notify the Privacy Commissioner and the affected people as the Privacy Act 2020 requires.

Cookies, analytics and device identifiers

This site sets a small number of first-party cookies, including an analytics identifier named spz_anonymous_id. Every cookie is listed individually — with its purpose, class and lifetime — in the cookie policy.

• What analytics records: Journey stages and job identifiers tied to a random identifier. It does not record the text you typed into search, your job notes, your contact details, the page URL, your IP address or your user agent.

• No advertising trackers: Serproz does not set advertising or cross-site tracking cookies, and does not embed third-party advertising tags.

Complaints about privacy

If you think Serproz has interfered with your privacy, raise it with us first so it can be investigated and put right.

• Step 1 — tell Serproz: Use the support page, or the privacy officer contact above once it is published. Describe what happened, when, and the outcome you are seeking.

• Step 2 — the Privacy Commissioner: You do not need agreement from Serproz to escalate. You can complain to the Office of the Privacy Commissioner, which is independent, free to use, and can investigate a complaint about an interference with your privacy.

The Office of the Privacy Commissioner publishes its complaint process at privacy.org.nz. A complaint about something other than privacy — a listing, a review, a job, or how Serproz handled you — belongs on the complaints page instead.

Changes to this policy

This policy carries a visible version string so you can tell which text applied at a given time. When it changes materially the version and the last-updated date change with it, and the notice recorded against a booking continues to identify the disclosure that was actually shown then. The current version is privacy-policy-2026-09-07-v2.