Legal
Privacy Policy
This policy explains what information we collect, why we need it and the choices you have.
Last updated: 21 October 2026
Who is responsible for your information?
Moshims is responsible for the personal information it collects and holds.
- Address:
- 47 Takapu Road, Grenada North, Wellington
- Email:
- info@moshims.co.nz
- Phone:
- 027 MOSHIMS (027 667 4467)
Our privacy officer is Moshim Khan. For a privacy question or request, email info@moshims.co.nz.
What we collect and why
- When you order: your name, email, phone number, delivery address and any delivery instructions, what you order, and payment confirmations from Stripe (not your card number).
- If you create an account: your email address, your orders and your Moshims Rewards points.
- When you join a waitlist or sign up for news: your email address, when you agreed and what you agreed to (for delivery areas, also the suburb you typed).
- If you apply for a wholesale account (on wholesale.moshims.co.nz): your business name, NZBN, contact name, phone, email and delivery address.
- When you contact us: your messages and the details you give us.
- When you chat with Mooshi (the chat helper on our website): your messages, Mooshi's replies, any cart it makes for you, and an order number and email if you ask about an order. Chats are stored and may be read by the Moshims team.
- When you visit our site: through Google Analytics and Meta Pixel, the pages you visit, the device and browser you use, roughly where you are (from your internet address) and how you found us.
We use this to take and deliver your orders, answer your questions, run wholesale accounts and Moshims Rewards, keep records for tax, and improve our website and ads.
The Privacy Act requires collection to serve a lawful business purpose and be necessary for it. We must explain the purpose, intended recipients and relevant choices when collecting information. See the Privacy Commissioner's guidance on necessary collection and collection notices.
Your choice to provide information
To place an order we need your name, email, phone number and delivery address. Delivery instructions are optional, and so is an account: you can check out as a guest.
To join a waitlist or sign up for news we need your email address and your tick to agree. Marketing sign-up is optional.
To apply for a wholesale account we need your business name, NZBN, contact name, phone, email and delivery address.
You can choose not to provide information. If details needed to deliver an order, process payment or answer a request are missing, we may be unable to provide that service.
Where information comes from
Most of it comes straight from you. The only other sources are Stripe, which confirms your payments, and Google and Meta, which give us statistics about visits to our site.
When we collect personal information from another source, we must take reasonable steps to notify the person as required by the Privacy Act, unless an exception applies. This includes explaining the source-related collection, purpose, recipients and access and correction rights.
Card payments
Card payments are made on Stripe's secure checkout page. We only see the last 4 digits of your card and its expiry date. Stripe holds your full card details. If you subscribe to a box, Stripe keeps your card on file so each box can be charged.
Who we share information with
Each of these only receives what it needs to do its job for us:
Junior MMKS Limited
What for
Carries out most of our home deliveries, so it receives what's needed to deliver your order, such as your name, phone number, delivery address and instructions.
Where
New Zealand
Vercel
What for
Hosts our website.
Where
Sydney, Australia (our website's server). Pages are delivered through Vercel's worldwide network.
Supabase
What for
Our database: accounts, orders, addresses and sign-ups.
Where
Sydney, Australia
Stripe
What for
Card payments, on Stripe's secure checkout page.
Where
United States and other countries
Resend
What for
Sends our order emails and account sign-in codes.
Where
United States
Addy
What for
Finds your address as you type it at checkout (it receives what you type in the address box).
Where
New Zealand and Australia
Anthropic
What for
Writes Mooshi's replies in our website chat (it receives the chat's messages).
Where
United States (where it keeps information); a reply may be worked out in another country
Google
What for
Google Analytics: statistics about visits to our site.
Where
United States
Meta
What for
Meta Pixel: visits to our site, to measure and improve our Facebook and Instagram ads.
Where
United States
OpenAI
What for
AI tools that help us run orders and deliveries.
Where
United States
SMS Gateway
What for
Sends our business text messages, from our own phone.
Where
Not published (it deletes messages within a month)
Xero
What for
Invoices.
Where
Australia, New Zealand and the United States
Base44
What for
Our wholesale site (wholesale.moshims.co.nz) and wholesale accounts.
Where
United States
| Who | What for | Where |
|---|---|---|
| Junior MMKS Limited | Carries out most of our home deliveries, so it receives what's needed to deliver your order, such as your name, phone number, delivery address and instructions. | New Zealand |
| Vercel | Hosts our website. | Sydney, Australia (our website's server). Pages are delivered through Vercel's worldwide network. |
| Supabase | Our database: accounts, orders, addresses and sign-ups. | Sydney, Australia |
| Stripe | Card payments, on Stripe's secure checkout page. | United States and other countries |
| Resend | Sends our order emails and account sign-in codes. | United States |
| Addy | Finds your address as you type it at checkout (it receives what you type in the address box). | New Zealand and Australia |
| Anthropic | Writes Mooshi's replies in our website chat (it receives the chat's messages). | United States (where it keeps information); a reply may be worked out in another country |
| Google Analytics: statistics about visits to our site. | United States | |
| Meta | Meta Pixel: visits to our site, to measure and improve our Facebook and Instagram ads. | United States |
| OpenAI | AI tools that help us run orders and deliveries. | United States |
| SMS Gateway | Sends our business text messages, from our own phone. | Not published (it deletes messages within a month) |
| Xero | Invoices. | Australia, New Zealand and the United States |
| Base44 | Our wholesale site (wholesale.moshims.co.nz) and wholesale accounts. | United States |
Information must only be used or shared as permitted by the Privacy Act. A provider listing does not authorise unrelated use. The Act governs how information is handled.
AI-assisted work
We use AI tools, including OpenAI, to help run orders and deliveries. They only receive what's needed.
Mooshi, the chat helper on our website, is an AI: Anthropic's Claude writes its replies from our own information (our products, prices, delivery days and policies). It can put items in a cart for you, but it never takes payment and can't refund, cancel or change an order: it passes those requests to our team. Please don't type card details into the chat.
Cookies, analytics and advertising
We use Google Analytics to see how people use our site (which pages they visit, for how long, and how they found us), and the Meta Pixel to measure and improve our ads on Facebook and Instagram. If you use Facebook or Instagram, Meta may link your visit to your account.
Both use cookies (small files in your browser) to recognise repeat visits. Our own site keeps a few things in your browser itself: your cart and your Build a Box (so they're still there when you come back), and a small setting so the welcome animation plays once per visit. When you check an address, we remember it in your browser so you don't have to type it again. It stays on your device and you can clear it anytime. If you chat with Mooshi, a cookie with a random number keeps your chat together.
You can block or delete cookies in your browser settings, stop Google Analytics with Google's opt-out add-on, and choose how Meta uses your activity in your Facebook or Instagram ad preferences.
Marketing choices
- Every marketing email has an unsubscribe link.
- Reply STOP to any of our text messages to stop them.
- Opt-outs are permanent.
You can also ask us to stop marketing messages by contacting info@moshims.co.nz. This does not stop messages needed to deal with an order.
Overseas handling
Our database and our website's server are in Sydney, Australia. Some of the services we use handle information in other countries, mostly the United States. The table above shows where each one is.
Where a provider only processes information on our behalf, Moshims remains responsible for that information. Where information is disclosed to an overseas organisation for its own purposes, the applicable overseas-disclosure rules must be met.
Security and retention
Customer and order details are kept on our servers, where only our own systems can read them: the public website can only read our product list and delivery schedule. Card details stay with Stripe.
We keep orders for 7 years, for tax. You can ask us to delete your account and marketing details at any time. Chats with Mooshi are kept for 90 days after the chat, then deleted; you can ask us to delete yours sooner.
If a privacy breach causes or is likely to cause serious harm, we must notify the Privacy Commissioner and affected people as soon as practicable, subject to the Act's exceptions.
Your rights and frequently asked questions
- Can I see the information you hold about me?
Yes. You can request access to your personal information. We may need to check your identity in a way that is reasonable for the request.
We must decide on an access request as soon as reasonably practicable, generally within 20 working days. If a lawful extension is needed, we must explain it. See access-request guidance.
- Can I correct information that is wrong?
Yes. You can ask for a correction. If we do not make the change, you can ask for a statement of the correction you want to be attached to the information. See correction rights.
- Can I ask you to delete my information?
Yes. You can ask us to delete your account and marketing details at any time. We keep order records for 7 years, for tax. See retention limits.
- What if I have a privacy complaint?
Contact info@moshims.co.nz or 027 MOSHIMS (027 667 4467). You can also raise a complaint with the Office of the Privacy Commissioner.
Children and policy updates
Privacy rights apply to children too. Contact us if you have a concern about a child's information.
When we change this policy, we update the date at the top of this page. For big changes, we'll also email our customers.