Privacy policy

Privacy Policy

Last updated: 15 September 2026

Mahara NZ Limited, trading as Mahara (“Mahara”, “we”, “us” or “our”), is a small New Zealand business based on Waiheke Island. We create custom photo magnets, sell products through our online store and at markets, and provide live magnet-making services at events.

We respect your privacy and take care with the personal information and photographs entrusted to us. This Privacy Policy explains what we collect, why we collect it, how we use and share it, how long we keep it, and the choices available to you.

Our online store is powered by Shopify. By using our website, placing an order, submitting photographs, communicating with us or otherwise interacting with Mahara, you acknowledge the practices described in this policy.

1. Personal information we collect

The information we collect depends on how you interact with Mahara.

Website and online orders

When you browse our website or place an online order, we or Shopify may collect:

● your name;

● email address and phone number;

● billing and delivery addresses;

● products viewed, added to your cart or purchased;

● order, payment-confirmation, fulfilment, delivery, return and refund information;

● account information, if you choose to use a Shopify customer account;

● messages, enquiries, reviews and other communications you send us; and

● technical and usage information such as your IP address, browser, device, cookie identifiers and how you use our website.

Payments made through the online store are processed through Shopify and its enabled payment providers. Mahara does not receive or store your complete payment-card number.

Custom photographs and ReadyPix orders

To make personalised magnets, we collect the photographs you choose to provide. Photographs may be submitted through ReadyPix, by email, through AirDrop at a market or event, or by another process agreed with you.

ReadyPix may collect your name, email address, optional phone number, uploaded photographs and order information. It generates an order number, which customers are asked to show when collecting their magnets. ReadyPix does not currently process payments for Mahara. Market and live-event purchases are paid separately by cash or bank transfer.

Markets and live events

At a market or live event, we may collect your name, contact details, selected photographs, order number, payment status and collection information as needed to make and distribute your magnets.

Where an event host requests Mahara’s optional photography backdrop, Chloe or a Mahara team member may take photographs for guests. These photographs are treated as customer order photographs unless separate permission is obtained for another use.

Reviews

If you submit a review through Judge.me, we may collect your first name, rating, written comments, photographs and videos. If published, your first name, rating, review and approved media may be visible publicly. We check submitted photographs and videos before publication to protect privacy and remove spam or inappropriate material. Genuine positive and negative reviews are both welcome.

2. How we collect information

We collect personal information:

● directly from you when you order, upload photographs, contact us, subscribe, submit a review or interact with us at a market or event;

● automatically through Shopify, cookies and standard Shopify analytics when you use our website;

● from service providers that help us operate the business, such as Shopify, ReadyPix, Judge.me, payment providers and delivery providers; and

● from another person, such as an event host or gift purchaser, where they provide information needed for an order or service.

3. How we use personal information

We use personal information where reasonably necessary to:

● create, process, personalise and fulfil orders;

● identify uploaded photographs and match them with the correct customer or order;

● contact you about payment, production, collection, delivery, support, returns or refunds;

● process payments and maintain financial and business records;

● provide live magnet-making and event services;

● operate, secure, troubleshoot and improve our website and services;

● detect or prevent fraud, misuse, security incidents and unlawful activity;

● enable reviews and respond to customer feedback;

● send marketing where you have chosen to receive it;

● comply with New Zealand law and lawful requests; and

● establish, exercise or defend legal rights.

We do not sell your personal information.

4. How we handle customer photographs

Customer photographs are used only to create and fulfil the requested order unless separate, express permission is provided for marketing use.

Photographs received by email, AirDrop or download are stored temporarily in the Downloads folder of Mahara’s password-protected laptop. This folder is not synced with iCloud. Emailed photographs may also remain temporarily in Mahara’s Gmail account while the order is being completed.

Mahara deletes its ordinary working copies promptly after the magnets have been fulfilled and delivered, collected or distributed. This includes deleting downloaded files and customer-image emails, including from email Trash. ReadyPix states that uploaded photographs and image files are automatically deleted from its systems no later than 30 days after upload, subject to the exceptions in its own privacy policy. Mahara will also delete photographs from its available ReadyPix workspace as soon as they are no longer needed for fulfilment.

Limited AI-assisted photograph editing

Occasionally a photograph may need a specific edit to make it suitable for a square magnet, such as repositioning a person who would otherwise be cropped out. Mahara will use an external AI-assisted image-editing service for a customer photograph only with the customer’s specific permission.

Where such permission is given, Mahara will limit the information shared to what is necessary for the edit, avoid including names or order details, use available privacy controls, and delete the working conversation or files from Mahara’s account after the edited magnet has been completed. The service provider may process information outside New Zealand under its own privacy terms.

5. Photographs used for Mahara marketing

Permission to create a magnet does not give Mahara permission to use the photograph in advertising, social media or other marketing.

Marketing permission must be separately and expressly given, for example through an optional unticked ReadyPix checkbox or a clearly recorded verbal agreement when a photograph is AirDropped or taken at an event. If a photograph clearly identifies several adults, permission should be obtained from each identifiable adult before marketing use. A parent or guardian must provide permission before a recognisable photograph of a child is used for marketing.

Unless that permission has been obtained, Mahara assumes marketing permission has not been granted.

Approved marketing photographs may be kept in a dedicated marketing folder on Mahara’s password-protected laptop and Mahara’s Google Drive. They may be shared with tools such as Canva or carefully selected AI-assisted services, including ChatGPT, Claude or Manus, where reasonably needed to prepare the approved marketing content.

You may withdraw marketing-image permission at any time by emailing us. We will stop future use and remove the photograph from channels and files under our control where reasonably practicable. Withdrawal cannot always remove printed materials already distributed or copies independently shared by others.

6. Email communications and marketing

We use an email address supplied with an order to communicate about that order, payment, collection, delivery or customer service. These necessary service messages are separate from marketing.

We send promotional emails only where you have chosen to subscribe. The same rule applies whether your email is collected through Shopify or ReadyPix. Marketing consent must be given separately through an optional, unticked choice. Supplying an email address to place or collect an order does not by itself subscribe you to marketing.

Mahara may use Shopify to send subscriber emails, including eligible abandoned-cart reminders. We do not currently use SMS marketing.

You may unsubscribe from promotional emails at any time using the unsubscribe link in the email or by contacting us. Unsubscribing from marketing does not prevent us from sending necessary messages about an order or responding to you.

Mahara may keep an internal Google spreadsheet recording sales amounts and the email addresses of customers who have expressly opted into marketing. Marketing contact information is kept until you unsubscribe, withdraw consent or ask us to remove it.

7. Cookies and website analytics

Shopify uses cookies and similar technologies to operate the store, remember cart contents, maintain security, understand store activity and provide standard Shopify analytics. You can control cookies through your browser and any cookie controls displayed on our website, although disabling some cookies may affect how the store works.

Mahara does not currently intentionally use Google Analytics, Meta Pixel or another separate advertising tracker. If we introduce additional analytics or advertising technologies, we will update this policy and any consent controls that apply.

8. Who we share information with

We share personal information only where reasonably necessary with providers that help us operate Mahara, including:

● Shopify, which hosts our store, processes orders, supports payments, analytics and email features;

● ReadyPix, which receives customer details and photographs for custom and live-event orders;

● Google services, including Gmail, Google Drive and Google Sheets, for business email, approved marketing storage and limited internal records;

● payment providers and banks, to process or confirm payments;

● Judge.me, to collect, manage and display customer reviews;

● Canva and approved AI-assisted editing tools, but only for the limited photograph uses and permissions described in this policy;

● couriers and delivery providers, when needed to deliver an order; and

● professional advisers, regulators, courts, law-enforcement agencies or other parties where required or permitted by law.

Each external provider handles information under its own privacy terms. We aim to share only the information needed for that provider’s task.

9. Overseas processing

Some of the service providers we use may store or process information outside New Zealand. When using overseas providers, Mahara takes reasonable steps to select reputable services and to limit the information disclosed. Overseas providers may also be subject to privacy laws in the countries where they operate.

10. Security

Mahara uses reasonable safeguards appropriate for a small business. These include a password-protected laptop, restricted access to Mahara accounts and files, separating temporary order photographs from permission-approved marketing photographs, and deleting customer photographs when they are no longer required for fulfilment.

No storage or transmission method is completely secure. Please do not send sensitive information that is unnecessary for your order. If we become aware of a privacy breach that has caused or is likely to cause serious harm, we will notify affected individuals and the New Zealand Privacy Commissioner where required by law.

11. How long we keep information

Retention depends on the type of information and why it is needed:

● ordinary customer photographs are deleted promptly after fulfilment and distribution, as described above;

● permission-approved marketing photographs may be retained until permission is withdrawn or they are no longer needed;

● marketing email details may be retained until you unsubscribe, withdraw consent or request removal;

● reviews may remain published and stored through Mahara and Judge.me until removed, subject to legal and platform requirements;

● customer-service communications are kept only as long as reasonably needed to resolve the matter; and

● order, payment, tax and accounting records may be retained for up to seven years, or longer where required by law, to meet Mahara’s legal and financial obligations.

When information is no longer required, we will delete it or anonymise it where reasonably practicable.

12. Children and customer photographs

Mahara’s products may be purchased for or by people of different ages. Customer photographs, including photographs of children, are used only to create and fulfil the order and are deleted promptly afterward unless separate, express permission has been provided for Mahara to retain a particular photograph for marketing purposes.

A parent or guardian must provide permission before Mahara knowingly uses an identifiable photograph of a child in marketing.

13. Your privacy rights

Under the New Zealand Privacy Act 2020, you may ask us to:

● confirm whether we hold personal information about you;

● provide access to personal information we hold about you; or

● correct personal information that is inaccurate or incomplete.

You may also ask us to delete information or stop using it for a particular purpose. These requests are not absolute, and we may need to retain certain information where legally required or reasonably necessary for an order, dispute or business record.

We may ask for enough information to confirm your identity before acting on a privacy request. To make a request, email hello@mahara.co.nz.

14. Third-party websites

Our website may link to websites or services operated by others. Their privacy practices are governed by their own policies, and Mahara is not responsible for websites or services we do not control.

15. Questions and complaints

Please contact us first if you have a question or concern about your privacy. We will try to resolve it promptly.

You may also make a complaint to the Office of the Privacy Commissioner New Zealand through privacy.org.nz.

16. Changes to this policy

We may update this Privacy Policy when our services, providers or legal obligations change. The updated version will be posted on our website with a revised “Last updated” date.

17. Contact Mahara

Mahara NZ Limited, trading as Mahara
Waiheke Island, Auckland, New Zealand
Email: hello@mahara.co.nz
Website: mahara.co.nz