Last updated: 12 November 2026

We Respect Your Privacy. Here’s How We Handle Your Information

At ThriveableBiz, we believe in being upfront about how we collect and use your information. This policy explains how we use your personal information when you visit our website, use our free tools, or purchase our products and services.

Important: By using our website or services, you agree to this Privacy Policy and our Terms of Service.

1. Who We Are

Business Name: ThriveableBiz (a registered trademark of Engage4Insights Limited)

Owner: Judy Celmins

Contact Email: [email protected]

Phone: +64 (0) 21 277 1232

Location: Rangiora, New Zealand

We are committed to protecting your privacy in accordance with the New Zealand Privacy Act 2020 and maintaining the highest standards of information privacy.

2. What Information We Collect

We collect information in several ways depending on how you interact with us.

2.1 Information You Give Us Directly

When you use the Reality Chat (free assessment):

  • Your first name
  • Your email address
  • Your business idea or current business description (including proprietary concepts, business models, or innovations)
  • Your stage of business (idea, starting, established)
  • Your specific challenges or questions
  • Market insights or competitive advantages you have identified
  • Any additional information you choose to share in your responses

Important: Your business ideas and proprietary information are treated as confidential. See Section 2.4 below.

When you use the Business Idea Generator (free tool):

  • Information about your skills, work history, background and where you live that you choose to enter
  • This information is used to generate your personalised business ideas. We do not keep a copy of what you entered. You do not need to give an email address to use the tool or to download your PDF.

If you choose to sign up for Breathing Room, Judy’s free five-day email gift, on your results: your email address and, if you give it, your first name. These are sent to our email list provider only when you tick the sign-up box (see Sender.net in Section 4.1).

When you use a microphone button in one of our tools:

  • Some of our tools let you speak your answers instead of typing them. If you choose to use the microphone button, your browser’s own speech service (for example Google in Chrome or Apple in Safari) turns your speech into text, under that company’s privacy terms. ThriveableBiz receives only the text, never the recording, and handles it in the same way as anything you type. You can always type instead.

When you contact us via email or phone:

  • Your name, email address, and phone number
  • The content of your message or conversation
  • Any business details you share

When you purchase Ingredients, Condiments, or bundles:

  • Your name and email address
  • Billing information (processed securely by Stripe, see Section 4)
  • Business name (if purchasing for a business)
  • Your country and location (for appropriate service delivery)

When you sign up for our email list:

  • Your name and email address
  • Your interests (where selected during sign-up)

2.2 Information We Collect Automatically

When you visit our website:

  • Technical information: IP address, browser type, operating system, device type
  • Usage data: pages visited, time spent on pages, links clicked, referring website
  • Cookies and similar technologies: small files stored on your device (see Section 9 for details)
  • Abuse protection: our free AI tools use Cloudflare Turnstile to confirm you are a human visitor, and apply rate limiting to stop automated misuse. Turnstile processes technical browser signals for this purpose, and rate limiting briefly processes your IP address. Neither is used to identify you personally.
  • Security and server logs: to keep the website and Hub secure, our server and security software record technical details of connections and sign-in attempts. This includes your IP address, the date and time, the page requested and, for a sign-in attempt, the username or email address entered. These logs are used only to detect, investigate and block attacks or faults.

When you access the ThriveableBiz Hub (my.thriveablebiz.com):

  • Sign-in events needed to create and maintain your secure session
  • A secure session cookie that keeps you signed in across the Hub and your apps (see Section 2.5)

When you complete the Reality Chat:

  • The answers you select, the scores calculated from them, and the date and time you finished

  • These are stored without your name, email address, or any account identifier. There is no field in this record that identifies you

  • We use them to understand which gaps founders most often have, and which parts of the chat are working. See Section 4.1 for where this is stored

  • Your name and email address are used to send you your Recipe and, only if you opt in, our emails. They are handled separately (see Sections 2.1, 4.1, and 6)

When you work inside an Ingredient, Condiment or Tool app, or use the Business Type Decision Tree:
  • We do not currently record how you move through the apps or the Decision Tree. If we start, we will update this policy first.

When hub_outputs data is synced from an Ingredient app or Name & Identity:

  • Structured summary fields from your completed Ingredient work (see Section 2.6)
  • This data is synced automatically when you finish an Ingredient or Name & Identity, and again if you use the Export function
  • It is used to generate your Business Plan and Operations Manual (and, when it is released, your Marketing Strategy) inside the Hub

When you write answers in the Hub itself (for example your mission, goals, experience and team, registration and contact details, premises and assets, funding, and owner pay):

  • They are stored with your account and used to build your Hub documents
  • If you ask us to erase your data, they are erased with your hub_outputs summary

When your answers are backed up from an Ingredient, Condiment or Tool app:

  • The full set of answers, notes, and content you have entered in that app
  • This includes any complete AI responses you have chosen to paste into optional boxes
  • Your work is backed up automatically to your ThriveableBiz account while you use the app, so it is not lost if your browser clears its stored data, and so you can continue on another browser or device
  • This backup is stored only to protect and restore your work. It is separate from the hub_outputs summary above and is not used to build your Hub documents (see Sections 8.1 and 8.2)

2.3 Information We Do Not Collect

We do not collect:

  • Credit card details directly (handled by Stripe)
  • Sensitive personal information (health, religion, political views) unless you voluntarily share it
  • Information from anyone under 18 (our services are for adults only)

2.4 Confidentiality of Your Business Ideas

We treat your business information as confidential. When you share business ideas, strategies, or proprietary information with us (through the Reality Chat, email support, or any other service), we protect that information as follows.

What we keep confidential:

  • Your specific business concept or innovation
  • Proprietary processes, methods, or systems you have developed
  • Market insights or competitive advantages you have identified
  • Customer lists, pricing strategies, or business plans
  • Financial projections or revenue information
  • Any information marked as confidential or that would reasonably be considered confidential

How we protect it:

  • We will not share your business ideas with other clients or third parties
  • We will not use your ideas for our own commercial benefit
  • We will not disclose your proprietary information publicly
  • We store all business information securely
  • Access is limited to Judy only (and any essential staff under confidentiality agreements)

A note on our service providers: delivering our services means some of what you enter is processed by the trusted providers listed in Section 4 (for example, the AI provider that generates your results, or our email and payment providers). They act only on our instructions, under contract, and may not use your information for their own purposes. This is not the same as sharing your business ideas, which we do not do.

Exceptions, when we may use your information:

  • Anonymised learning (with all identifying details removed). For example: “Service business owners often struggle with pricing strategy” never “Sarah from Auckland wants to start a bakery with [her specific concept].”
  • Success stories: only with your explicit written permission. You can review before publication, request anonymisation, or withdraw permission at any time.
  • Required by law: court order or legal obligation. We will notify you first if legally permitted.

You retain all rights to your business ideas. Our role is to advise, not to take ownership.

2.5 Session Cookies and Hub Authentication

When you complete a purchase, or sign in on a new device, you are authenticated to the ThriveableBiz Hub using a secure session cookie. This cookie:

  • Is an httpOnly, Secure cookie set on the thriveablebiz.com domain, which means it cannot be read by JavaScript in your browser and is only sent over encrypted (HTTPS) connections
  • Identifies you to the Hub and to the apps you have purchased, so you do not have to log in separately on each one
  • Expires after 30 days, and is refreshed periodically while you are actively using the Hub
  • Is never shared with any third party for its own use. It passes only through the infrastructure providers that operate our website and Hub (see Section 4.1)
  • Is cleared automatically if expired or invalid

You can end your session at any time by using the Logout option in the Hub, or by clearing cookies in your browser. If you sign in again, a fresh session cookie is issued.

2.6 Hub_Outputs Data (Ingredient App Exports)

A structured set of summary fields (called hub_outputs) is sent to our server automatically when you finish an Ingredient or Name & Identity, and again if you use the Export function. When you use the Export function, two things happen at the same time:

  • A JSON file is downloaded to your device for your own use and backup
  • A structured set of summary fields (called hub_outputs) is sent to our server

The hub_outputs data contains your completed work in a structured format, such as your validated market definition, financial projections, pricing decisions, and go/no-go outcomes. This data is stored against your customer account in our database and is used solely to generate your Business Plan and Operations Manual (and, when it is released, your Marketing Strategy) and, if you use Plated, your Plated Business Plan and Pitch Deck inside the Hub.

What the hub_outputs summary does not include:

  • Your full set of raw answers and notes (only the structured summary fields are included in hub_outputs)
  • Free-text working detail beyond the structured summary fields

Your full answers are backed up separately. So that you do not lose your work and can move between devices, the complete set of answers you enter in an app is also backed up to your account. That backup is described in Section 8. Unlike the hub_outputs summary, your full-answer backup is used only to restore your work, and is never used to build your Hub documents.

If the sync fails for any reason (for example, if you are offline), your work on your device and any JSON file you export are unaffected. Sync runs quietly in the background and will not interrupt your work.

3. How We Use Your Information

3.1 To Provide Our Services

Reality Chat:

  • Process your responses and generate your personalised assessment
  • Recommend your custom Recipe (specific Ingredients for your situation)
  • Send you the assessment results via email
  • Follow up once to see if you have questions (you can opt out)

Business Idea Generator:

  • Generate your personalised business idea results
  • Send you Breathing Room, five short emails from Judy, one a day, only if you tick the sign-up box

Purchased Ingredients and Condiments:

  • Grant and manage your access via the ThriveableBiz Hub (my.thriveablebiz.com)
  • Validate and manage your access to each purchased product (this happens behind the scenes; you sign in with your email and password, not a key)
  • Send purchase confirmations and access instructions
  • Respond to support questions via email

Companion spreadsheets:

  • When you generate a companion spreadsheet inside an app, the relevant answers are sent to that app’s own secure server, used to fill in your spreadsheet, and returned to you in the download. They are processed transiently and are not stored (see Section 8.1).

Answer backup and device continuity:

  • Back up your in-progress answers to your ThriveableBiz account while you work, so your work is not lost if your browser clears its stored data
  • Restore your answers if you return on a new browser or device, or if your local copy is lost
  • This backup is separate from your hub_outputs summary and is not used to generate your Hub documents

Hub Document Assembly:

  • Use your synced hub_outputs data to generate your Business Plan and Operations Manual (and, when it is released, your Marketing Strategy) on demand
  • Documents are generated fresh each time and downloaded directly to your device; they are not stored on our server. This includes Plated documents: the rewritten text is held in your browser only while the Plated page is open, and we do not keep it. If you want a Plated document again after leaving the page, it is generated again, which uses another Plated generation

3.2 To Improve Our Products and Services

We use anonymised data to understand common challenges business owners face, identify which Ingredients need improvement, develop new content based on recurring questions, and improve our website and user experience. Your specific business details and personal information are removed before any analysis.

3.3 Understanding How Our Products Are Used

We look at how customers move through the Ingredients, Condiments and Tools they have bought, so we can see which products people finish, which ones people start and put down, and where the material could be improved. If you have opted in to receive marketing from us, we may also use this to send you a reminder about a product you have bought and not yet finished.

Unlike the anonymised analysis described above, this activity information is linked to your account. Even so, it is only a small set of activity signals: which of your purchased products you have started working on, when you last worked on one, how many times your work has been saved, and whether you have finished it. We do not read what you have written. Your answers are stored so that your work is backed up to your account and so your Hub documents can be built, and they are never read or used to decide what we send you.

This activity information stays on ThriveableBiz systems and is not shared with any third-party analytics service. The one exception is a reminder: if we send you one, your email address and the name of the product it relates to are handled by our email provider so the message can be sent (see Section 4.1). Your answers are never shared with them.

You can unsubscribe from these reminders at any time, in any reminder email, without losing access to anything you have bought. If you ask us to erase your saved answers (see Section 7.3), your record is no longer counted here and you will not be sent these reminders.

3.4 To Communicate With You

Service-related emails (you cannot opt out):

  • Purchase confirmations and receipts
  • Access instructions and sign-in details
  • Responses to your support requests
  • Important updates to services you have purchased
  • Changes to our Terms of Service or Privacy Policy

Marketing emails (you can opt out anytime):

  • New Ingredients or services relevant to your interests
  • New blog posts or resources
  • Special offers or bundles
  • Reminders about a product you have bought and not yet finished

To opt out: click the unsubscribe link in any marketing email. You will still receive service-related emails.

We may use or disclose your information if required by New Zealand law, a court order, or a law enforcement request. We will share only the minimum required information and will notify you if legally permitted.

3.6 AI Transparency and Automated Processing

We use AI to power some of our tools, and we tell you when we do.

Tools that use AI:

  • Reality Chat, generates your reflections and personalised Recipe
  • Business Idea Generator, generates business ideas from what you enter
  • Name & Identity (paid), helps generate business name ideas
  • Plated (paid), rewrites your Business Plan and Pitch Deck from your answers, and words the goals you set in the Hub. Your free Business Plan and your Operations Manual are built from your answers without AI.

The AI provider is Anthropic (Claude API). See Section 4.1 for how your data is handled and Section 10 for international transfers. Anthropic does not use your data to train its models under its standard API terms.

You are told when you are interacting with AI. Each AI-powered tool discloses that it is AI-powered within the tool before you start, and labels its output as AI-generated. This reflects transparency rules that now apply in some countries, including the European Union under its AI Act, and it is simply how we think it should work everywhere.

No automated decisions with legal or significant effects. Our AI tools generate suggestions and draft documents based on the information you provide. They do not make automated decisions that produce legal effects or similarly significant effects for you. Nothing about you is approved, refused, priced, scored or gated by AI. You decide what to do with every output, and you can reach a person any time at [email protected].

4. Who We Share Your Information With

4.1 Service Providers

Website Hosting:

  • DigitalOcean: hosts our WordPress website and database. Servers located in Sydney, Australia.

Hub and App Hosting:

  • Vercel: hosts the ThriveableBiz Hub (my.thriveablebiz.com) and our Ingredient, Condiment, and free tool apps. Vercel is a US-based platform. Data processed in accordance with their privacy policy at vercel.com/legal/privacy-policy.

Security and Infrastructure:

  • Cloudflare: sits in front of thriveablebiz.com and routes visitor traffic to our website, providing security filtering and performance services. Cloudflare also provides the Turnstile bot-protection check used by our free AI tools, which works independently of that routing. Cloudflare processes technical data including IP addresses as part of this role. Cloudflare is a US-based company operating a global network. Privacy policy at cloudflare.com/privacypolicy.
  • Upstash: provides rate limiting on our free AI tools to prevent abuse. It processes IP addresses briefly for this purpose only; this is not used to identify you.

Payment Processing:

  • WooCommerce: manages the checkout process on our website
  • Stripe: processes all payments securely. We never see or store your full card details. Stripe adheres to PCI-DSS standards. We receive only payment confirmation and basic transaction details (amount, date, last 4 digits of the card).

Email:

  • Resend: sends transactional emails (purchase confirmations, access instructions, Reality Chat results, and our own internal notifications)
  • Sender.net: manages our marketing email list and sends newsletters and nurture sequences. Sender stores your name and email. If you opted in through Reality Chat, it also stores a short summary of your Reality Chat result so we can send you relevant material: your stage of business, what prompted you to take the chat, your background, whether you plan to bring someone in, your scores for each area, the area that most needs attention, your recommended Ingredients, and the date you finished. If you signed up through the Business Idea Generator, it stores only your email address and, if you gave it, your first name. It tracks opens and clicks, and is based in Vilnius, Lithuania. GDPR-compliant data processing. Privacy policy at sender.net/privacy-policy/. Where we send a reminder about a product you have bought and not yet finished, Sender.net also processes which product the reminder relates to, so the message can be sent. It does not receive your answers.
  • Microsoft 365: hosts our support mailbox ([email protected]), where your emails to us are kept. This data is currently held in Australia.
Backup Storage:
  • Backblaze B2: stores our encrypted off-site backups of the website and database. These backups include your answer backup and hub_outputs data. Backups are encrypted before they leave our server, are encrypted again by Backblaze, and are held with write protection so they cannot be altered or deleted for 30 days. Backblaze is a US-based company, and this bucket is in their United States (East) region. Privacy policy at backblaze.com/company/privacy.html

Analytics:

  • Google (Apps Script and Sheets): stores the Reality Chat analytics record described in Section 2.2. It contains your answers and scores, but not your name or email address.

  • Vercel Analytics: collects anonymous page-view and performance data on the Business Idea Generator so we can see whether the tool is working and where people leave. It does not use cookies and does not identify you.
AI Processing:
  • Anthropic (Claude API): used to generate your Reality Chat reflections and Recipe, your Business Idea Generator ideas and your Name & Identity name suggestions, and, if you use Plated, to write your Plated documents and to word your goals. During a Plated generation, your hub_outputs summary and the answers you have written in the Hub (for example your mission, goals, experience, team, premises, funding and owner pay) are sent to the Anthropic API. Your free Business Plan and your Operations Manual do not use AI. Anthropic’s privacy policy applies at anthropic.com/privacy. Data is not used to train Anthropic’s models under their standard API terms.

Error Monitoring:

  • Sentry: monitors our apps and the Hub for technical errors so we can find and fix faults. Sentry receives diagnostic error information (error message, the app it happened in, browser and device type) and the name of the app involved. It is configured not to collect your IP address or request headers, and it does not receive your answers, notes, or any content you enter.

  • In one specific case, where we cannot confirm that a saved set of answers belongs to your account, the report carries two short internal reference codes so we can trace the fault. These codes are not your name or email address, but we can link them back to your account, so we treat them as personal information. Sentry processes this data in the European Union (Frankfurt, Germany).

All service providers are contractually required to protect your data, can only use your information to provide services to us, and must comply with applicable privacy laws.

4.2 Professional Advisors

We may share your information with our lawyer or accountant where required. These advisors are bound by professional confidentiality.

We may disclose your information if required by New Zealand law, a court order, or a lawful request from authorities. We will notify you if legally permitted before disclosure.

4.4 Business Transfers

If ThriveableBiz is sold, merged, or undergoes a business restructure, your information may be transferred to the new owner, who must continue to honour this Privacy Policy. We will notify you before any transfer.

4.5 Who We Will Never Share With

We will never:

  • Sell your personal information to anyone
  • Share your information with advertisers or marketing companies
  • Post your business details publicly without your explicit permission
  • Share your Reality Chat responses with others (even anonymised case studies require your permission)

5. How We Protect Your Information

5.1 Technical Security

Website and Hub:

  • SSL/TLS encryption (HTTPS) on all domains
  • HTTP security headers on all apps and the Hub: Content Security Policy, Strict Transport Security, X-Content-Type-Options, Referrer Policy, Permissions Policy
  • Regular software updates and security patches
  • WordPress admin access restricted and protected

Authentication:

  • Session cookies are httpOnly and Secure, and expire after 30 days
  • Sign-in is protected by Cloudflare filtering and rate limiting, and by lockouts after repeated failed attempts
  • Administrator accounts use two-step sign-in and cannot be used to sign in to the Hub
  • Every ThriveableBiz endpoint that reads or changes your data requires a valid signed-in session, or a key held only on our own servers
  • CORS policy restricts API access to approved ThriveableBiz domains

Payment:

  • We never store full credit card details
  • Payment processing via PCI-DSS compliant Stripe

Hub_outputs data:

  • Stored in a dedicated database table against your customer account
  • Accessible only via authenticated API requests (a valid session is required)
  • Not stored in assembled document form; documents are generated on demand and never retained on our server

Answer backup data:

  • Stored in a dedicated database table against your customer account
  • Accessible only through authenticated API requests (a valid session is required)
  • Transmitted over encrypted (HTTPS) connections
  • Held within our standard server and backup security (see Sections 4.1 and 10)
  • Access is limited to authorised personnel on a need-to-know basis (see Section 5.2)
Encryption at rest:
  • The database tables holding your answer backup and your hub_outputs summary are encrypted at rest on our server, as are the database’s internal transaction and change logs
  • Our off-site backups are separately encrypted before they leave the server, and are held with write protection so they cannot be altered or deleted for 30 days
  • Encryption at rest protects your information if a copy of the database files is ever taken. It is not a claim that your answers are unreadable to us. Access by ThriveableBiz is limited as described in Section 5.2

5.2 Organisational Security

Only Judy (and any essential staff) can access your personal information, on a need-to-know basis. We conduct periodic reviews of security measures and third-party provider security.

5.3 Limitations

No system is 100% secure. You are responsible for keeping your login credentials safe and for the security of your device. If you suspect unauthorised access, contact us immediately at [email protected].

If there is a data breach likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as required by the NZ Privacy Act 2020, and take immediate steps to contain and remedy the breach.

6. How Long We Keep Your Information

Free tools (whether or not you become a customer):

  • Reality Chat: your responses are processed to generate your personalised Recipe. We keep two separate records. The first is held against your email address and contains your email address, the Recipe generated for you, and the answers used to generate it. This record is kept for 90 days if you do not have an account, and until your account is closed if you do. If you take the Reality Chat again, the new Recipe replaces the old one. The second is the analytics record described below, which is held without your name or email address.
  • Reality Chat analytics: your answers and scores, held without your name or email address, are kept indefinitely so we can see long-term patterns. Because this record contains nothing that identifies you, we cannot locate it to remove it on request. Erasure under Section 7.3 covers your Recipe and your email address, which we can locate.

  • Business Idea Generator: your entries are used to generate your ideas and are not kept on our servers afterwards. A copy is saved in your own browser’s storage on your device, so you can close the tab and come back to your results. That copy stays on your device until you clear your browser data or use Start Over inside the tool, and we cannot see it or retrieve it. Your PDF is created in your browser and downloads straight to your device, and we do not receive a copy. If you tick the box to receive emails after your download, your email address and first name (if given) are held by Sender.net until you unsubscribe (see Section 4.1).

  • Security and server logs: kept for up to five weeks, then deleted automatically.

While you have an active account:

  • Account information: kept while the account is active
  • Purchase history: kept for 7 years (NZ tax and legal compliance requirement)
  • Support emails: kept while account is active plus 2 years
  • Hub_outputs data: kept while your account is active. You can request deletion at any time (see Section 7.3)
  • Answer backup data: kept while your account is active. We do not currently set a fixed deletion period. If we introduce one, we will update this policy before it takes effect. You can request erasure at any time (see Section 7.3)

After account closure:

  • Account information: deleted within 90 days (unless required for legal reasons)
  • Purchase and tax records: kept for 7 years (NZ legal requirement)
  • Marketing email list: removed immediately on unsubscribe
  • Answer backup data: removed when you ask us to erase it. We do not currently run an automatic purge, so if you want your backup removed, please request erasure (see Section 7.3)
  • Backups: kept for up to five weeks, then deleted automatically. If you ask us to erase your information, it is removed from the live system straight away and from backups within five weeks.

Anonymised and anonymous data:

  • Anonymised learning data may be retained indefinitely. It contains no personal identifiers.

7. Your Rights Under the NZ Privacy Act 2020

7.1 Right to Access

You can request a copy of the personal information we hold about you. Email [email protected] with “Privacy Access Request” in the subject line. We will respond within 20 working days. This is usually free; if a request is particularly complex, we may charge a reasonable fee and will notify you first.

7.2 Right to Correction

You can request we correct inaccurate personal information. Email [email protected] with the corrections. We will update within 10 working days and confirm via email.

7.3 Right to Deletion

You can request we delete your personal information. We will delete what we can within 30 days. Some information (purchase records) must be retained for legal compliance; we will confirm what can and cannot be deleted.

To request deletion of your hub_outputs data specifically, email [email protected] with “Hub Data Deletion Request” in the subject line. This will remove your assembled document inputs but will not affect your product access or purchase history.

To request erasure of your backed-up answers, email [email protected] with “Answer Backup Deletion Request” in the subject line. We will remove your saved answers from our server and confirm when it is done. After erasure, your apps stop backing up, and anything you enter afterwards stays in your browser only.

Erasing your backup from our server does not remove the copy held in your own browser. You can clear that yourself by clearing your browser data. Start Over inside an app clears the answers on your device and, when you are online, your saved backup of them. It also replaces your summary for that Ingredient with an empty marker, so your Hub documents leave that Ingredient out until you finish it again.

7.4 Right to Opt Out of Marketing

Click the unsubscribe link in any marketing email, or email [email protected] requesting removal from the marketing list. We will process it within 5 working days. Service-related emails (purchase confirmations, access instructions, support responses) are not affected.

7.5 Right to Complain

If you believe we have mishandled your information, contact us at [email protected] with “Privacy Complaint” in the subject line. We will investigate and respond within 20 working days.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner:

8. Ingredient Apps: How Your Working Data Is Stored

8.1 In-App Data Storage

ThriveableBiz Ingredient, Condiment and Tool apps (accessed via the ThriveableBiz Hub) are interactive web applications. As you work, your answers, notes, and in-progress work are saved in your browser’s localStorage on your own device. This local copy is your working copy and is always available to you, including when you are offline.

Your answers are also backed up to your ThriveableBiz account on our server. This backup exists so that your work is not lost if your browser clears its stored data, and so you can continue from another browser or device. It is described in full in Section 8.2.

While you work, the following things leave your device:

  • Answer backup: the full set of answers, notes, and content you have entered in that app is backed up to your account. This includes any complete AI responses you have chosen to paste into optional boxes. See Section 8.2.
  • Hub_outputs summary: when you finish an Ingredient or Name & Identity, and again if you use the Export function, a structured summary of your work is synced to your account to build your Hub documents. This is a curated summary, not your full answers. See Sections 2.6 and 8.2.
  • Companion spreadsheet generation: when you choose to generate a spreadsheet, the relevant answers are sent to that app’s own secure server, used to fill your spreadsheet, and returned to you in the download. They are processed transiently and not stored.

This means:

  • Your answers are held both on your device and, as a backup, on our server against your account.
  • Because a backup is held on our server, we are able to store and restore your answers to operate and support the service. Access to that backup is protected and limited as described in Section 5.
  • If you clear your browser data, switch browsers, or use a different device, your answers can be restored from your account backup. Your local working copy, if you clear it, is not separately recoverable by us beyond that backup.
  • You can download everything you have entered at any time using Export Data, and you can ask us to erase your server backup at any time (see Section 7.3).

8.2 Your Answer Backup, Hub Sync, and the Export Function

Two separate things are sent to our server from these apps. They do different jobs, and we keep them separate.

Your answer backup (full answers). While you use an app, the complete set of answers, notes, and content you enter is backed up to your ThriveableBiz account. This is what lets you recover your work if your browser clears its stored data, and lets you continue on another device. It includes any full AI responses you have chosen to paste into optional boxes. It does not include your licence or access information, which is handled separately. This backup is used only to store and restore your work. It is never used to build your Hub documents.

Your hub_outputs summary (structured summary). When you finish an Ingredient or Name & Identity, and again if you use the Export function, a structured summary of your work (called hub_outputs) is synced to your account. This is the curated set of fields that builds your Business Plan and Operations Manual (and, when it is released, your Marketing Strategy) in the Hub. It is a summary and does not contain every raw answer you entered. See Section 2.6.

The Export function. When you use Export Data in an app, a JSON file containing everything you have entered is downloaded to your device, and your hub_outputs summary is synced to your account at the same time. The downloaded JSON file is your own copy to keep and back up as you wish.

How long we keep your backup, and getting a copy or erasing it. We keep your answer backup while you have an account with us. We do not currently set a fixed deletion period (see Section 6). You can download everything you have entered at any time using Export Data, without asking us. You can ask us to erase your server backup at any time (see Section 7.3). Erasing your server backup does not remove the copy held in your own browser.

8.3 Your Responsibility for Your Device Data

Because your working data is stored on your device and managed by you, you are responsible for the security and confidentiality of the information you enter into these apps. ThriveableBiz accepts no liability for loss or exposure of data resulting from using the app on a shared or unsecured device, failing to clear browser data after use on a shared computer, or allowing others access to your device.

8.4 The Export File

The exported JSON file contains your completed work in readable form. ThriveableBiz recommends storing it in a password-protected location, not sharing it via unsecured channels, and deleting it when no longer needed.

If your export file contains information about third parties (such as prospect names or customer details), you may have obligations under the NZ Privacy Act 2020 or the privacy laws of your country regarding how you store and handle that information.

8.5 Installed App (PWA) Version

Some ThriveableBiz apps can be installed on your device as Progressive Web Apps (PWAs). The installed version operates identically to the browser version in terms of data storage and privacy. As with the browser version, your working data is saved on your device and backed up to your account as described in Sections 8.1 and 8.2. Installing the app does not grant ThriveableBiz any additional access to your device, data, or information.

9. Cookies and Tracking Technologies

9.1 Types of Cookies We Use

Essential cookies (cannot be disabled):

  • Purpose: make the website and Hub work correctly (checkout, authentication, access)
  • Examples: session cookies, WooCommerce cart, the Hub authentication cookie
  • Duration: session cookies deleted when you close the browser; persistent cookies up to 30 days

Analytics cookies (set only with your consent):

  • Purpose: understand how people use our site so we can improve it
  • Provider: Google Analytics (GA4, does not log or store full IP addresses)
  • Duration: up to 2 years
  • How to disable: decline them in our cookie banner, or use browser settings or the Google Analytics opt-out tool at tools.google.com/dlpage/gaoptout

Marketing cookies (set only with your consent):

  • Purpose: track effectiveness of advertising if we run paid campaigns
  • Providers: Meta Pixel, Google Ads tag (planned; activated only if we run paid advertising, and only with your consent)
  • Duration: varies by provider

Your consent: We only set analytics and marketing cookies with your consent. When you first visit, you can accept or decline non-essential cookies, and you can change your choice at any time. Essential cookies do not require consent because the website and Hub cannot function without them.

9.2 How to Manage Cookies

You can manage cookies through our cookie banner and through your browser settings:

  • Chrome: Settings > Privacy and Security > Cookies
  • Firefox: Settings > Privacy and Security > Cookies
  • Safari: Preferences > Privacy > Cookies
  • Edge: Settings > Privacy > Cookies

Disabling essential cookies may prevent the website and Hub from working correctly.

10. International Data Transfers

ThriveableBiz is based in New Zealand. Some service providers we use have servers outside New Zealand (including Vercel, Cloudflare, Stripe, Google, Anthropic, Backblaze and Resend in the United States, DigitalOcean and Microsoft 365 in Australia, Sender.net in Lithuania, Sentry in Germany, and Upstash). This includes the answers you back up in our Ingredient, Condiment and Tool apps, which are stored in our WordPress database hosted by DigitalOcean in Sydney, Australia. When data is transferred internationally, we ensure service providers have adequate privacy protections and that contracts include data protection requirements consistent with the NZ Privacy Act 2020.

If you are based in Australia or another country, your information may be transferred to and stored in New Zealand or with our third-party providers. New Zealand has strong privacy laws. You retain all the rights described in this policy.

Our website may contain links to other websites. We are not responsible for the privacy practices of other websites. When you click an external link, their privacy policy applies.

12. Children’s Privacy

Our services are for adults (18+) only. We do not knowingly collect information from anyone under 18. If we discover we have collected information from someone under 18, we will delete it immediately and close their account if applicable. If you are a parent concerned about your child’s information, contact us at [email protected] and we will take appropriate action within 48 hours.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect new products or services, legal requirements, or improvements in clarity.

Minor changes (clarifications): updated “Last updated” date only. Continued use of our website constitutes acceptance.

Major changes (new data uses, new third parties): email notification to all customers at least 30 days before the change takes effect, with the option to close your account if you do not agree.

14. How to Contact Us

General privacy questions:

Email: [email protected] (subject: “Privacy Question”)

Phone: +64 (0) 21 277 1232

We will respond within 5 working days.

Formal requests (access, correction, deletion):

Email: [email protected]

Subject lines:

  • “Privacy Access Request”, to receive a copy of your data
  • “Privacy Correction Request”, to correct inaccurate data
  • “Data Deletion Request”, to delete your data
  • “Hub Data Deletion Request”, to delete your hub_outputs data specifically
  • “Answer Backup Deletion Request”, to delete your backed-up answers

We will respond within 20 working days as required by the Privacy Act 2020. Please include your full name, email address used with our services, your specific request, and proof of identity.

Privacy Officer: Judy Celmins

Email: [email protected]

We process your data on the following bases:

Consent: marketing emails (opt-in at subscription), Reality Chat and Business Idea Generator (voluntary submission), analytics and marketing cookies.

Contract: delivering Ingredients and Condiments you have purchased, granting Hub access, validating and managing your access, backing up and restoring the answers you enter so your work is not lost, generating documents from your hub_outputs data, fulfilling support obligations.

Legitimate interest: improving our services using anonymised data, understanding how customers move through the products they have purchased so we can improve them, website analytics to improve user experience, fraud prevention and security (including bot protection and rate limiting).

Legal obligation: retaining tax and financial records for 7 years, responding to lawful requests.

By using our website, taking the Reality Chat, or purchasing our products and services, you acknowledge that you have read and understood this Privacy Policy, you understand how we collect, use, and protect your information, you consent to the data practices described here, and you know how to exercise your privacy rights.

If anything in this policy is unclear or concerns you, please ask before using our services. We would rather clarify upfront than deal with confusion later.

ThriveableBiz is a registered trademark of Engage4Insights Limited.

© 2026 Engage4Insights Limited · Rangiora, New Zealand