Trust & Security

EcoBay operates this site on Lovable Cloud. Lovable provides the underlying platform (hosting, database, authentication and email infrastructure with controls such as encryption in transit, managed backups and Row Level Security). EcoBay is responsible for the content, configuration, business logic, staff access, and how customer information is collected and used. You are responsible for keeping your account credentials safe and for the accuracy of the information you give us.

• Fresh Club members open their pass with the mobile number and email they joined with, checked server-side over HTTPS and rate-limited.
• Member, staff, partner and admin areas are gated behind role checks; roles are stored in a dedicated table and checked server-side.
• Database access is protected by Row Level Security — members can only read and modify their own records.
• Staff accounts use the same authentication system with additional role-based authorization.

We collect only what we need to run the shop and the Fresh Club programme: name, mobile, email, optional birthday month, contact preference, stamps, rewards and vouchers, customer-care messages, and basic security logs. We don't take online payments, so no card details are held. Full details are in our Privacy Policy.

• Account and Fresh Club data is kept while your account is active.
• Transaction records are kept for at least seven years to meet New Zealand tax record-keeping obligations.
• Customer-care messages are kept while needed to resolve your enquiry and for a reasonable period afterwards for quality and training.
• On request to support@ecobayfresh.com, we will close your Fresh Club account and delete or de-identify information we are not legally required to retain.

We share personal information only with trusted providers that help us operate the business, and only for the purposes set out in our Privacy Policy. Current categories are:

• Platform & hosting — Lovable Cloud (hosting, database, authentication, email infrastructure, file storage).
• Email delivery — transactional email provider used to send reward, voucher and account emails from notify.ecobayfresh.com.
• AI customer-care assistant — AI model providers process chatbot messages to generate replies.

Some providers may store or process data outside New Zealand (for example Australia, the United States, or the EU). We take reasonable steps so that information has comparable protection to the New Zealand Privacy Act 2020.

We use only essential storage to keep staff and partners signed in and remember your Fresh Club pass on your device. No advertising cookies. We do not sell personal information.

Under the New Zealand Privacy Act 2020 you can ask what information we hold about you, request corrections, opt out of marketing, or close your Fresh Club account. Email support@ecobayfresh.com. We may need to verify your identity before acting on a request.

If you believe you have found a security issue, or you suspect your Fresh Club account has been accessed without your permission, email support@ecobayfresh.com with the subject line "Security" and as much detail as you can safely share. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond.

If a notifiable privacy breach occurs, we will notify affected individuals and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

We update this page as our controls and providers change. The "last updated" date at the top always reflects the current version.