Trust & Security

EcoBay operates this site on Lovable Cloud. Lovable provides the underlying platform (hosting, database, authentication and email infrastructure with controls such as encryption in transit, managed backups and Row Level Security). EcoBay is responsible for the content, configuration, business logic, staff access, and how customer information is collected and used. You are responsible for keeping your account credentials safe and for the accuracy of the information you give us.

• Fresh Club sign-in uses email + password or magic link, served over HTTPS.
• Member, staff, partner and admin areas are gated behind role checks; roles are stored in a dedicated table and checked server-side.
• Database access is protected by Row Level Security — members can only read and modify their own records.
• Staff accounts use the same authentication system with additional role-based authorization.

We collect only what we need to run the shop and the Fresh Club programme: contact details, Fresh Club profile (date of birth for 16+ confirmation, suburb, preferences), order history, points and redemptions, customer-care messages, and basic technical/analytics information. Payment card numbers are handled by our payment provider and are not stored on our servers. Full details are in our Privacy Policy.

• Account and Fresh Club data is kept while your account is active.
• Order and transaction records are kept for at least seven years to meet New Zealand tax record-keeping obligations.
• Customer-care messages are kept while needed to resolve your enquiry and for a reasonable period afterwards for quality and training.
• On request to support@ecobayfresh.com, we will close your Fresh Club account and delete or de-identify information we are not legally required to retain.

We share personal information only with trusted providers that help us operate the business, and only for the purposes set out in our Privacy Policy. Current categories are:

• Platform & hosting — Lovable Cloud (hosting, database, authentication, email infrastructure, file storage).
• Email delivery — transactional email provider used to send confirmation, magic-link and order emails from notify.ecobayfresh.com.
• Payments — our card payment processor handles card data directly; we receive only the result of the transaction.
• AI customer-care assistant — AI model providers process chatbot messages to generate replies.
• Analytics — basic, privacy-respecting analytics to understand how the site is used.

Some providers may store or process data outside New Zealand (for example Australia, the United States, or the EU). We take reasonable steps so that information has comparable protection to the New Zealand Privacy Act 2020.

We use cookies to keep you signed in, remember your cart, and measure aggregate site usage. You can control cookies in your browser, but turning them off may prevent you from staying signed in to Fresh Club. We do not sell personal information.

Under the New Zealand Privacy Act 2020 you can ask what information we hold about you, request corrections, opt out of marketing, or close your Fresh Club account. Email support@ecobayfresh.com. We may need to verify your identity before acting on a request.

If you believe you have found a security issue, or you suspect your Fresh Club account has been accessed without your permission, email support@ecobayfresh.com with the subject line "Security" and as much detail as you can safely share. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond.

If a notifiable privacy breach occurs, we will notify affected individuals and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

We update this page as our controls and providers change. The "last updated" date at the top always reflects the current version.