Privacy Policy

This policy explains how Lazi handles personal information under the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). It applies to the Lazi platform and website.

• Account & company: name, email, phone, role, company name, NZBN, IRD number, addresses.
• Fleet & operations: vehicles, equipment, registrations, and (when a truck is active) GPS location.
• Driver records: licence numbers/expiry, medical certificates, emergency contacts (where you add them).
• Jobs: posts, bids, matches, messages, load tickets and photos, ratings.
• Payments: we store only display fragments (card brand, last 4; bank/branch). Full card and bank details are held by Stripe, not by Lazi.
• Usage: device/browser info and error diagnostics to keep the service running.

To operate the matching network, process payments and payouts, generate tickets and invoices, send relevant notifications, maintain safety and trust (e.g. cancellation review), provide support, and improve the product. We don’t sell your data.

Sharing happens on your terms. Other organisations only see what your post visibility allows (direct, network, or public). We use a small set of trusted sub-processors to run the service:

• Supabase: database, auth, storage (hosted in the APAC region).
• Stripe: payments, payouts, and identity/bank verification.
• Google Maps: mapping and geocoding.
• Resend: transactional email.
• Sentry / Vercel: error monitoring and hosting.

We don’t share your data with insurers or marketers. Some providers may process data outside New Zealand; we take reasonable steps to ensure comparable protection.

Data is held in an NZ/APAC-region database with row-level security on every table, so organisations can’t read each other’s data. Driver-licence photos sit in a private store accessed only via short-lived signed links. Payment credentials never touch our servers; Stripe handles them under PCI scope.

A vehicle’s live location is visible only to your own organisation and, for a selected post, the partner you chose, for the duration of that match. It defaults to private and is never broadcast to the wider network.

Under the Privacy Act 2020 you can:

• Access the personal information we hold about you.
• Ask us to correct it if it’s wrong.
• Request deletion: we permanently delete your organisation and records within 30 days of a verified request (except where we must keep records by law, e.g. tax/payment records).
• Request an export of your data.

We keep information for as long as your account is active and as needed to provide the service, then delete or anonymise it, except records we’re legally required to retain (such as financial and GST records).

We use essential cookies for sign-in and security, and limited diagnostics to keep the platform healthy. We don’t use advertising trackers.

Lazi is a business tool and isn’t intended for anyone under 18.

We may update this policy; the “last updated” date will change and material changes will be notified. To exercise your rights or make a privacy complaint, contact us through the in-app “?” help button. If you’re not satisfied, you can contact the Office of the Privacy Commissioner (privacy.org.nz).