Privacy Policy
Last updated 16 July 2026
This policy explains what personal information Upwind collects, how we use it, and your choices. We handle personal information in line with the New Zealand Privacy Act 2020.
Who we are
Upwind is operated from New Zealand. For any privacy question or request, contact hello@tryupwind.com.
What we collect
- Account details — your name and email address, via Google sign-in.
- Your site content — the text and images you add to your website.
- Enquiries (leads) — information people submit through the contact forms on your published site, which we store and pass to you.
- Usage & analytics — page views on your published site and basic in-app diagnostics to keep the service working.
- Billing — subscription status and a customer reference. Card details are handled by Stripe; we never see or store your full card number.
- Support — messages you send us.
How we use it
- To provide, operate, and improve the service.
- To publish and serve your website and deliver enquiries to you.
- To process payments and manage your subscription.
- To send service and account emails (e.g. sign-in links, lead notifications, support replies).
- To keep the service secure and prevent abuse.
Service providers we share with
We use trusted providers to run Upwind. They process data only to provide their service to us:
- Supabase — database, authentication, and file storage (Sydney, Australia).
- Railway — application and website hosting (United States).
- Cloudflare — content delivery, DNS, and custom-domain SSL certificates.
- Stripe — subscription and payment processing.
- Postmark — transactional and lead email delivery.
- Anthropic — AI content generation (the “build my site” feature).
- Google — sign-in.
Some providers may store or process data outside New Zealand. We take reasonable steps to ensure it’s handled with appropriate protection. We don’t sell your personal information.
Leads on your site
When you publish a site with a contact form, you become responsible for the enquiry data you collect through it, and for having your own privacy notice where required. Upwind stores and forwards those enquiries on your behalf.
If a CoreShift partner built or manages your site, they may be able to access your site and the enquiries it collects in order to help you. Partners are required, under our Partner Agreement, to protect that information and comply with the privacy laws that apply. You can ask us to remove a partner's access at any time.
Cookies
We use only the cookies needed to keep you signed in and to run the service. The marketing site and published customer sites don’t set advertising cookies by default (a site owner may add their own analytics).
Retention
We keep your information for as long as your account is active and as needed to provide the service, then delete or anonymise it within a reasonable period, unless we’re required to keep it (for example, for tax records).
Your rights
You can ask to access or correct your personal information, export your content, or delete your account. Email hello@tryupwind.com and we’ll help. You can also contact the Office of the Privacy Commissioner if you have a concern.
Security
We use reputable infrastructure, encryption in transit, and access controls. No system is perfectly secure, but we work to protect your information and will notify you of a notifiable privacy breach as required by law.
Changes
We may update this policy; material changes will be notified through the service or by email.