Privacy Policy — Hanahub

This document is provided in English. The English version is the legally binding version.

Hanahub Limited ("we", "us", "our"), trading as Hana, operates this platform for the Asian community in Aotearoa New Zealand. We respect your privacy and handle your personal information in accordance with the New Zealand Privacy Act 2020. This policy explains what we collect, why, and the choices you have.

We collect personal information in two ways: directly from you (for example, when you register or post content), and indirectly from other sources (for example, from Google when you choose to sign in with your Google account). Both are described below.

Information we collect directly from you

Account information you provide when you register, such as your email address, username, password (stored hashed), and any profile details you choose to add.
Content you post across the platform, including community posts, comments, event RSVPs, marketplace and job listings, flatmate listings, and lesson reviews, ratings and any photos you attach to them.
Usage informationcollected automatically when you visit, such as approximate page views and aggregate visitor counts. We use Vercel Analytics, which collects anonymised, aggregated usage data and does not use cookies. We also use the Meta Pixel to measure our advertising. It sets cookies, can recognise your browser across other sites and apps, and can read what you type into a form on the pages where it runs. See “Advertising and measurement” below.

Information we collect from other sources

Some information is collected indirectly, meaning from a source other than you. New Zealand's Information Privacy Principle 3A (in force from 1 May 2026) requires us to make you aware when we do this. The indirect sources we use are:

Google sign-in (Google LLC). If you choose to sign in with Google, we receive your name, email address, whether Google has verified that email, and your profile photo, along with the authentication tokens Google issues. We use this only to create and authenticate your account, to mark your email as verified so you can skip a separate verification step, and to pre-fill your profile. This information is stored in our own database and is not shared with anyone else. You can avoid this indirect collection by registering with an email and password instead.
Vercel Analytics (Vercel Inc.). On our live site we receive anonymised, aggregated usage statistics, such as which pages are viewed and overall visitor counts. We use this only to understand general traffic patterns and improve the platform. It is processed by Vercel as our analytics provider and is not used to identify you individually.
Meta Pixel (Meta Platforms, Inc.).On our live site, the Meta Pixel tells Meta the full address of each page you view, and if you complete a lesson booking, the amount paid, its currency, and an order reference, alongside the identifiers Meta's own cookies already hold about your browser. Because the page address is included, Meta can see which lessons and listings you looked at. Meta's own code can also read what you type into a form and send it to Meta as a scrambled (hashed) code, so we do not load the Pixel at all on the pages where you would enter contact details. That includes signing in, registering, and the forms for creating or editing a marketplace, job, or flatmate listing. Meta may match all of this to a Facebook or Instagram account it associates with your browser, which is how we can tell that an advert led to a booking. See “Advertising and measurement” below, including how to stop it.

Because this information is collected indirectly rather than from you, we make you aware of it through this Privacy Policy, which is linked in the footer of every page and is available to you when you create an account or sign in. This notification applies to indirect collection occurring on or after 1 May 2026.

How we use your information

To create and manage your account and authenticate you.
To display the content you choose to publish to other members.
To automatically translate content into the platform's supported languages (English, Korean, Japanese, and Chinese), so members can read it in their preferred language (see “Automated translation” below).
To operate, maintain, and improve the platform.
To communicate with you about your account, including email verification and security notices.
To respond to your enquiries and support requests.
To measure and improve our advertising, including working out which adverts lead to lesson bookings (see “Advertising and measurement” below).

Service providers

We do not sell your personal information. We use third-party service providers to operate Hanahub, including:

Neon — database hosting and storage of your account and content data.
Resend — email delivery for account verification, security alerts, and other transactional emails.
Authentication providers— credential-based login and Google sign-in (see “Information we collect from other sources” above).
Hosting and infrastructure providers — to operate and serve the application (including Vercel).
OpenAI (OpenAI, L.L.C.)— automated translation of user-generated content into the platform's supported languages. Content you post may be sent to OpenAI to generate these translations. OpenAI processes it only to return the translation and not for its own purposes, including training its models.
Meta Platforms, Inc. — advertising measurement and optimisation through the Meta Pixel on our live site.

With the exception of Meta, these providers only receive information necessary to perform their services, and we do not permit them to use it for their own purposes. Meta also uses what it receives for its own advertising purposes, under its own privacy policy — see “Advertising and measurement” below. We may also share personal information where required by law.

Public content visibility

Some information you provide or publish on Hanahub may be visible to other users or the public. This includes profile information, listings, posts, and other content you choose to share. Please avoid sharing personal information you do not want to be publicly visible.

Lesson reviews, including any photos you attach, are shown publicly on the lesson's page with your username shortened to its first letter. Before a review photo is stored we remove its location and camera data (EXIF), and we reject any photo that still contains it. Photos can show other people: only include people who are happy to be shown. You can remove your own photos at any time by editing your review. If a photo shows you and you would like it taken down, contact us at hello@hanahub.co.nz and we will review the request.

If you send us your review and photos and ask us to post them for you, we post them as your review of a lesson you completed. We record which of our team posted it and how you asked us to (for example by KakaoTalk or email), and we email your account address to tell you it is up. You can edit it or remove its photos at any time, as with any review you write yourself.

Advertising and measurement

We advertise Hanahub on Facebook and Instagram. To see whether those adverts actually bring people to the platform, our live site loads the Meta Pixel, a small piece of code provided by Meta Platforms, Inc.

The Pixel records the full web address of every page you viewon our live site. That address often says what you were looking at, such as a particular lesson or listing, and we cannot strip it out, because Meta's code reads it directly from your browser. When you complete a lesson booking, the Pixel also records the amount you paid, the currency, and an order reference so the booking is not counted twice. It works by setting cookies, including cookies Meta can read on other websites and apps that use its tools, so it can recognise the same browser across sites.

The Pixel also uses a Meta feature called automatic advanced matching. When you fill in a form on a page where the Pixel is running, Meta's code reads whatever looks to it like a contact detail, converts it into a scrambled code (a hash) inside your browser, and sends that code to Meta. Meta compares it against its own records to work out whether your browser belongs to someone with a Facebook or Instagram account, which is what makes our advertising measurement accurate enough to run campaigns on.

Meta's code decides for itself which fields look like contact details, so we control this by controlling where the Pixel runs at all. Every page on which you would type an email address or a phone number is in the list below, which means advanced matching cannot reach any of them. On the pages where the Pixel does run, it may still pick up a field it reads as personal, such as a name or a suburb.

Hashing means Meta does not receive that information in readable form. It is still information about a person, and we treat it as personal information under the Privacy Act rather than as anonymous data.

So we simply do not load the Pixel on two kinds of page: those whose address could expose something sensitive, and those where you would type contact details into a form. That covers signing in, registering, verifying your email, resetting or changing your password, every administration page, and the forms for creating or editing a marketplace, job, or flatmate listing. On those pages the Pixel is absent entirely, so it records neither the address nor anything you type. The listings themselves, and every page for browsing them, are unaffected.

Meta handles this information under its own Privacy Policy, and unlike our other service providers it also uses it for its own advertising purposes. You can limit how it is used in your Meta ad preferences, or block the Pixel outright using your browser's tracking protection or an ad blocker. Blocking it does not affect your ability to use Hanahub or to book a lesson.

Automated translation

To make content accessible across our community, content you post may be automatically translatedinto the platform's other supported languages (English, Korean, Japanese, and Chinese) using a third-party AI provider (OpenAI). To do this, the content is sent to that provider, which returns the translated text; it is not used by the provider for any other purpose. Translated content is shown in the language you have selected, and the original-language version remains available by changing that setting. Because these translations are machine-generated, they may contain inaccuracies, and the original version prevails. Please avoid including personal information you do not want translated and stored in content you post.

Overseas data storage

Some of our service providers may store or process personal information outside New Zealand. Where this occurs, we take reasonable steps to ensure your information is protected in a way that is consistent with New Zealand privacy law.

Storage and retention

We keep your information for as long as your account is active or as needed to provide the service and meet our legal obligations. You may request deletion of your account at any time. When you delete your account, we will remove or anonymise personal information where reasonably practicable. Some information may be retained where required for legal, security, fraud prevention, or operational purposes, including backups.

Review photos are deleted when you remove them from your review, and all of your review photos are deleted when you delete your account. Your ratings and review text stay on the lesson page without your name, shown as from a former member. Copies held in our image cache can take up to a day to expire after deletion.

Security

We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure, or alteration. This includes measures such as password hashing, secure authentication systems, and secure infrastructure provided by our service providers (including Neon and authentication providers). However, no system is completely secure.

Email and service communications

We may send you service-related emails using Resend, such as account verification, security alerts, and important service updates. These emails are necessary for operating your account and cannot be opted out of while you maintain an account.

Your rights

Under the Privacy Act 2020 you have the right to ask for a copy of the personal information we hold about you and to request correction of anything inaccurate. You can update much of your information directly in your profile, or delete your account at any time.

Policy updates

We may update this Privacy Policy from time to time. Any changes will be posted on this page. Continued use of Hanahub after updates means you accept the revised policy.

Contact

This platform is operated by Hanahub Limited. For privacy-related enquiries, or to exercise your right to access or correct your personal information, contact us at hello@hanahub.co.nz.

Version history

Version 3.6, effective 6 October 2026. Added reviews we post on your behalf at your request: that we record who posted it and how you asked, that we email you, and that you can edit it.

Version 3.5, effective 5 October 2026. Added lesson review photos: what is collected, that reviews and their photos are public, that location and camera data is removed before a photo is stored, how to remove your own photos or ask for a photo of you to be taken down, and that review photos are deleted with your account.

Version 3.4, effective 27 August 2026.Disclosed that the Meta Pixel uses automatic advanced matching: on a page where the Pixel is running, Meta's code reads what looks to it like a contact detail, hashes it in your browser, and sends it to Meta so it can match your browser to a Facebook or Instagram account. This corrects version 3.3, which said we do not send your name or your email address to Meta. That was true of the booking event we send ourselves, which still carries no contact details, but not of what Meta's own code can collect from a form, and the distinction should have been drawn when the Pixel was first disclosed. Alongside this correction we stopped loading the Pixel on the forms for creating and editing a marketplace, job, or flatmate listing, so the contact details entered there, which are often another person's, can no longer be reached by it. Also stated that a hashed contact detail is still treated as personal information under the Privacy Act.

Version 3.3, effective 14 August 2026.Disclosed the Meta Pixel, used on the live site to measure Facebook and Instagram advertising: added an Advertising and measurement section, listed Meta Platforms as both an indirect source and a service provider, and added a corresponding use under "How we use your information". States that the Pixel receives the full address of each page viewed, and that it is not loaded at all on sign-in, registration, email-verification, password and administration pages. Corrected two statements that this change made inaccurate: that Vercel Analytics was our only analytics provider and that no cookies are used to track you across sites, and that no provider uses your information for its own purposes.

Version 3.2, effective 28 July 2026. Updated the Automated translation section to match how translated content is now displayed: the per-post AI-translation label was removed from content pages, so translated content appears in the language you have selected and the original-language version is reached by changing that setting. No change to what data is sent to the translation provider.

Version 3.1, effective 28 June 2026.Disclosed that member content may be automatically translated using a third-party AI provider (OpenAI): added an Automated translation section, listed OpenAI as a service provider, and added a corresponding use under "How we use your information".

Version 3.0, effective 11 June 2026.This version adds sections on service providers, public content visibility, overseas data storage, security measures, email communications, and policy updates; and updates the contact address to hello@hanahub.co.nz. The previous version (2.0, effective 11 June 2026) added the "Information we collect from other sources" section to reflect New Zealand's Information Privacy Principle 3A. Version 1.0 was published on 9 June 2026.