Privacy policy

MegaDeal is operated by MegaDeal Limited (NZBN 9429052744594), a company registered in New Zealand ("MegaDeal", "we", "us"). This policy explains what personal information we collect, why we collect it, and the choices you have about it, in line with the Privacy Act 2020. By using MegaDeal, you agree to the practices described here. MegaDeal doesn't process customer payments, so we never see or store card or payment details — there simply aren't any to collect.

Information we collect

• Usage data — pages viewed, deals browsed, general device/browser information, and your IP address, used to keep the site working well and to improve which deals we feature. We also use IP addresses to stop repeated or automated sign-up, sign-in and contact-form attempts; for that they're kept only in scrambled (hashed) form, and only for a short time.
• Account and business details — if you sign up to list or manage a deal, we collect your email address and a password (stored securely by our identity provider, never in plain text), plus your business's trading name, its legal or registered name and NZBN, a contact person's name and phone number, address, and photos, so we can verify who we're dealing with and review and display your listing.
• Communications — anything you send us through the contact form or by email.
• Deal-alert email signups — if you sign up for deal emails, we collect your email address. We send a confirmation email to verify it's really yours before adding you to the list, and every email includes an unsubscribe link that removes you immediately.

How we use it

• Show relevant deals and keep the site working well
• Review and publish business listings
• Provide customer support and respond to enquiries
• Detect and prevent fraud, and keep the site secure
• Understand which deals and categories perform well, in aggregate

We don't sell your personal data to third parties.

What's shown publicly

What a business puts in the “Your listing” part of its listing page is shown publicly on its MegaDeal listing and deals, so customers can find and contact it, and search engines can show it too: its trading name, description, logo and photos, address, suburb and city, booking phone number, website, booking link and booking email, social media links, the areas it covers, opening hours, price range and features. A business can choose to hide its street address: then only its suburb and city are shown, with no directions, and its place on our map is approximate (to about a kilometre). Its account email, legal or registered business name, NZBN, and contact person's name and phone number are collected for our own verification and record-keeping and are never shown publicly.

Service providers and overseas disclosure

We use a small number of specialist providers to run the site, and some personal information is processed by them on our behalf. This includes our database and business-login provider (Supabase, which stores our data in Sydney, Australia), our email delivery provider (Resend), our website hosting, security and photo storage provider (Cloudflare, which also runs the bot check on our forms), Anthropic, whose AI gives every new deal and deal photo a first check before it goes live (it receives the deal's wording, its photo and the business's trading name, which are all shown publicly once the deal is approved, and processes them in the United States), Google's Places API for business-address autocomplete, Google Analytics for site traffic reporting, and Meta (Facebook/Instagram) for ad measurement — see "Cookies, analytics and advertising" below. Some of these providers store or process data on servers outside New Zealand. Where that happens, we only share the information needed for them to provide their service to us, and we choose providers who apply security and privacy standards comparable to those required under the Privacy Act 2020.

How we protect your information

We use reasonable technical and organisational measures to protect personal information from loss, misuse or unauthorised access — including encrypted transmission (HTTPS), access controls on our internal tools, and restricting business data access to the business's own listings. No online service can guarantee perfect security, but if we ever became aware of a privacy breach likely to cause serious harm, we'd notify the Office of the Privacy Commissioner and affected individuals as required by law.

Cookies, analytics and advertising

We use a small amount of cookie-based storage to keep a business signed in to the portal across visits — that part is functional, not advertising-driven.

We use Google Analytics to understand overall site traffic — how many people visit, roughly where from (country/region, not a precise location), and which pages or referring sites they came from. This is aggregate reporting to help us run the site, not used to individually identify you. You can opt out using Google's Analytics opt-out browser add-on.

When we're running ad campaigns, pages on this site may also load the Meta (Facebook/Instagram) Pixel, which lets us measure whether an ad led to a signup and show ads to people likely to be interested. It can set cookies and share information such as pages you viewed and whether you signed up with Meta. You can control this through your Facebook ad preferences. Standard browser tracking-protection or ad-blocking tools will generally block the Pixel.

Alongside the Pixel, we may also send Meta a small amount of signup information directly from our own servers when a business registers — known as Meta's Conversions API. Meta receives your email address and phone number only in hashed (non-readable) form, never as plain text. It also receives your IP address and browser type, Meta's own cookie IDs if your browser has them, and which ad campaign (if any) brought you to the site. Because this runs on our server rather than in your browser, it isn't affected by browser tracking-protection or ad-blocking tools the way the Pixel is — the Facebook ad preferences link above still gives you control over how Meta uses it.

Data retention

We keep business account and listing records for as long as needed to operate the site and meet legal requirements, and delete or anonymise other personal data when it's no longer needed for the purposes above.

Your rights

Under the Privacy Act 2020 you can, at any time:

• Unsubscribe from marketing emails using the link in any email
• Request a copy of the personal data we hold about you
• Ask us to correct or delete your personal data

To exercise any of these, reach out via our contact page. We'll normally respond within 20 working days, as required by the Privacy Act. If you're not satisfied with how we've handled a privacy request or complaint, you can contact the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

If we make material changes to how we handle your data, we'll update this page and, where appropriate, let you know directly.