Privacy Policy

Last updated: 7 July 2026

SpotCheck ("we", "us", "our") is operated by SPOTCHECK PROPERTY LIMITED, a company registered in New Zealand. We are committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020 and, where they apply to you, the EU General Data Protection Regulation (GDPR) and UK GDPR. This policy explains what information we collect, why we collect it, and how we use and protect it.

1. Who we are

SpotCheck is a property information service operated by SPOTCHECK PROPERTY LIMITED (New Zealand) at spotcheck.property and through the SpotCheck mobile app for iOS and Android, serving customers in the markets SpotCheck supports, across Australasia, Europe and the Americas. This policy covers both the website and the mobile app. You can contact us at [email protected]. For the purposes of the GDPR and UK GDPR, SPOTCHECK PROPERTY LIMITED is the data controller.

2. What information we collect

We collect the following personal information when you use SpotCheck:

• Account information: email address, name, phone number, and company name (name, phone, and company are optional).
• Property addresses: addresses you enter when generating reports.
• Payment information: billing details processed securely by Stripe on the website, or by the Apple App Store or Google Play for purchases made in the mobile app. We do not store your full card number; for in-app purchases we receive only a transaction record so we can credit your account.
• Device location (mobile app, optional): if you grant the app location permission, your device's position is used to centre the map on you. The GPS position itself stays on your device, what our servers see is the map area you are viewing and any addresses you search for. The app works normally if you decline location permission.
• Push notification token (mobile app, optional): if you enable notifications, we store a device token so we can send you the notifications you have asked for. The token is removed when you turn notifications off, sign out, or delete your account.
• Usage data: which report sections you view, when you log in, and how you use the service.
• Technical data: browser type and device information collected automatically. Your IP address is processed by our hosting and security providers (see section 4) and by Google Analytics; our own first-party analytics does not store it.
• Site analytics: we run our own analytics on our servers, which records the pages you visit, how long you spend on them, how far down them you scroll, and actions such as searching or starting an order, grouped into a visit. It stores no IP address and no full browser identifier: your browser and device are reduced to broad categories (for example “mobile / Safari / iOS”) and the rest discarded. A random identifier in your browser lets us tell a return visit from a new one; it is not linked to your name or email unless you are signed in, and it is deleted along with the rest when you ask us to erase your data. All of it is deleted automatically after 90 days.

3. How we use your information

• To create and manage your account.
• To generate and deliver property reports.
• To process payments and issue receipts.
• To send transactional emails (verification, receipts, service alerts).
• To send push notifications you have enabled in the mobile app (for example when your report is ready, or market alerts for properties you watch). You can turn these off at any time in the app or in your device settings.
• To improve our service and understand how reports are used.
• To comply with our legal obligations.

We do not sell your personal information to third parties. We do not use your information for unsolicited marketing without your consent.

4. Third-party services

We share data with the following trusted third parties only to the extent necessary to operate the service:

• Stripe (stripe.com), payment processing on the website. Stripe's privacy policy applies to card data.
• Apple (apple.com) and Google (play.google.com), in-app purchases in the mobile app are processed by the Apple App Store or Google Play under their own terms and privacy policies. Apple also provides the optional "Sign in with Apple" feature.
• Google Firebase Cloud Messaging and the Apple Push Notification service, delivery of mobile push notifications. These services process your device token in order to deliver notifications to your device.
• Anthropic (anthropic.com), AI processing. Report content, when you request a translation, is processed by Anthropic's Claude models to generate responses. Under Anthropic's commercial terms, this data is not used to train their models.
• Cloudflare (cloudflare.com), content delivery and security. Traffic to our site passes through Cloudflare's network, which processes IP addresses and request data to protect the service.
• Resend (resend.com), transactional email delivery.
• Google Analytics, anonymised usage statistics. See the Cookies section below for how to opt out.
• Microsoft Clarity (clarity.microsoft.com), heatmaps and session replay, which record how pages are used so we can find what is confusing or broken. We deliberately do not load it on the pages that show personal, paid or financial information: your account, your reports and the report viewer, checkout, sign-in and sign-up, and our own admin pages. On the public pages where it does run, text you type into forms is masked. If you are in the EU, EEA, UK or Switzerland it is not loaded at all unless you accept analytics cookies.
• Google, optional sign-in via Google OAuth on the website and in the mobile app. Google's privacy policy applies if you use this feature.

5. Data storage, security and international transfers

Your account data and report history are stored on servers located in New Zealand. Some of our service providers (including Stripe, Apple, Google, Anthropic, Cloudflare, and Resend) process data in the United States and other countries; where we disclose personal information overseas, we take reasonable steps to ensure it is protected by safeguards comparable to those of the Privacy Act 2020 and, where applicable, GDPR transfer requirements. New Zealand has been recognised by the European Commission and the United Kingdom as providing an adequate level of data protection.

We use industry-standard security measures including encrypted connections (HTTPS), access controls, and regular backups. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

6. Report links and sharing

Each report has a unique, hard-to-guess web address. Anyone who has that link can view the report, including the property address it covers: this is what makes reports easy to share with family, advisers, or clients, so only share a report link with people you are happy to see it. Reports produced through our agent badge programme are co-branded with the agent's details and are intended to be shared by the agent.

7. Data retention

We retain your account information and report history for as long as your account is active or as needed to provide the service. If you close your account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it for legal or accounting purposes.

8. Your rights

Under the Privacy Act 2020, you have the right to:

• Request access to the personal information we hold about you.
• Request correction of any inaccurate information.
• Ask us to delete your account and associated data.

If the GDPR or UK GDPR applies to you, you also have the right to receive a portable copy of your data, to restrict or object to certain processing, to withdraw consent where processing is based on consent, and to lodge a complaint with your local data-protection authority.

You can delete your account yourself at any time from your account page on the website or from the Account menu in the mobile app. To exercise any of these rights, you can also email us at [email protected]. We will respond within 20 working days.

9. Cookies

We use session cookies to keep you logged in, and analytics cookies (Google Analytics) to understand how our service is used. If you are visiting from the EU, EEA, United Kingdom, or Switzerland, analytics cookies are off by default and are only enabled if you accept them through the cookie banner; clearing the site's data in your browser will show the banner again if you change your mind. Anyone can also disable cookies in their browser settings or opt out of Google Analytics using Google's opt-out browser add-on. Disabling session cookies may affect your ability to use the service.

The mobile app does not use cookies. It keeps you signed in with a secure token stored on your device, which is removed when you sign out, and the app does not include analytics or advertising trackers.

10. Children

SpotCheck is not directed at children. You must be at least 18 years old to use the service, and we do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by displaying a notice on the site. Continued use of SpotCheck after changes take effect constitutes acceptance of the updated policy.

12. Complaints

If you have a concern about how we handle your personal information, please contact us first at [email protected]. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner (New Zealand) at privacy.org.nz. If you are in the United Kingdom you may also complain to the Information Commissioner's Office (ico.org.uk); in the European Union, to the data-protection authority in your country; and in Australia, to the Office of the Australian Information Commissioner (oaic.gov.au).