What Coffer does with your information

Coffer is operated by a sole-trader based in New Zealand. This policy describes how Coffer collects, uses, stores, and shares personal information when you use the service at coffer.co.nz.

It is written under the New Zealand Privacy Act 2020. Where any wording in this policy is unclear, the Privacy Act controls.

Coffer is in early access. The service is currently used by its founder and a small number of invited testers. As features mature, this policy will be updated. The "Last updated" date at the top tracks revisions.

Coffer collects only what it needs to run as an invoicing and tax tool.

From Google when you sign in

• Your name, as Google holds it on your account.
• Your email address.
• Your Google profile picture URL.
• A stable Google account identifier so we can recognise you on future sign-ins.

Coffer asks Google for permission to see your name, email address, and profile picture only. We do not request access to your Gmail, Google Drive, Calendar, or any other Google service.

What you enter into Coffer

• Your business details (trading name, address, GST number).
• Your bank balance snapshots and overdraft limit.
• Your client details (name, email, address, notes).
• Your invoice content (line items, amounts, periods, custom fields, notes, email bodies you send).
• Your tax events (payments to IRD and their dates).
• Your pots and ringfencing settings.
• Your expected annual income or hourly rate (for the bracket-aware tax math).

Automatic technical data

• A session cookie (essential, not for tracking) so you remain signed in across page loads.
• Standard web request logs (IP address, user agent, requested URL, response code) kept by our hosting provider for operational reasons.
• Aggregate analytics for public pages only (the landing page, sign-in, privacy, and terms). We use Cloudflare Web Analytics to count page views, referrers, country, and device type. It does not set cookies and does not identify individual visitors. It is not active on any signed-in page; once you log in, no analytics beacon fires on anything you do inside the app.
• On our public marketing pages only, we run Google Ads conversion tracking (Google's gtag) to measure our advertising. This sets Google advertising cookies and shares page-visit data with Google. Like the analytics above, it is never active once you are signed in, so it never touches anything you do inside the app.

Aside from the Google Ads conversion tracking on our public marketing pages described above, Coffer uses no other advertising trackers, no Google Analytics, and no Facebook Pixel. No advertising cookies are ever set on a signed-in page; the only cookies inside the app are the ones needed to keep you signed in.

• To authenticate you and keep you signed in.
• To render your invoices, dashboards, and tax projections.
• To send invoice emails on your behalf, only when you explicitly click Send on an invoice.
• To compute your GST and income tax ringfenced amounts.
• To respond to support questions you raise. If you contact us, we read what you send.

Coffer does not sell your information. Coffer does not use your account, invoice, or client data for advertising (the ad measurement above runs only on anonymous public-page visits). Coffer does not train any machine learning model on your invoice or client data.

Coffer is hosted on infrastructure run by third parties. To run the service, your information necessarily flows through them. The list of sub-processors below is exhaustive at the date of this policy.

• Vercel Inc. hosts the Coffer application. Web requests, request logs, and the application runtime live on Vercel's infrastructure. Vercel privacy policy.
• Neon Inc. hosts the Coffer Postgres database in the Sydney region (Australia). Your invoice, client, and settings data lives in this database. Neon privacy policy.
• Google LLC handles the "Sign in with Google" step. Google shares your email, name, and profile picture URL with Coffer when you sign in. Coffer does not share data back to Google beyond what is needed to recognise you on future visits. Google also provides advertising and conversion measurement (Google Ads) on Coffer's public marketing pages only, as described in the cookies note above. Google privacy policy.
• Amazon Web Services, Inc. (Amazon SES) delivers the emails Coffer sends on your behalf, including invoices you send to your clients, invitations, and account notifications. When Coffer sends an email, the recipient address, subject, body, and any PDF attachment are submitted to AWS SES in the Sydney region (Australia) for delivery. SES does not retain email body or attachments after delivery; only metadata (message ID, timestamp, recipient, delivery status) survives in SES's standard logging. AWS privacy notice.
• Cloudflare, Inc. provides Web Analytics on Coffer's public pages only (landing, sign-in, privacy, terms). Cloudflare receives aggregated pageview counts, referrers, country, and device class. It does not see anything you do once you sign in, does not set cookies, and does not identify individual visitors. Data is held in Cloudflare's analytics infrastructure. Cloudflare privacy policy.

Coffer does not share your information with anyone else. Coffer does not use data brokers, ad networks, or third-party analytics services. If the list of sub-processors changes, this policy will be updated and the "Last updated" date moved forward.

Your data (invoices, clients, settings, etc.) is stored in a database in Sydney, Australia, run by Neon. This is an offshore data transfer under the NZ Privacy Act. Australia has comparable privacy protections under its own Privacy Act 1988, and Neon has a contract with Coffer covering how your data is handled.

Coffer's application runs on Vercel's hosting. Requests are routed to Vercel infrastructure close to you. Responses are sent back to your browser and not stored beyond standard caching for the public pages (landing, sign-in, privacy, terms).

• Account data: kept as long as you have an account. You can request deletion from Settings → Privacy inside the app. After the request is approved you have a 14-day grace period during which you can cancel the deletion. Once the grace period passes, your invoices, clients, settings, tax records, and other business data are removed from active systems, and the email on your account is anonymised so the row no longer identifies you.
• Limited retention for accountability: a small amount of metadata about administrative actions on your account is retained for a bounded period after deletion, as permitted by NZ Privacy Act 2020 principle 11(2). This exists so we can answer dispute or legal-notice questions ("did you ever have an account for this email?") after the active record is gone. It does not include your invoice content, client lists, or other business data.
• Backups: database backups are retained on a rolling 7-day window by our database provider. Deleted data can persist in backups for up to 7 days before rolling off.
• Emails Coffer sends on your behalf: AWS SES does not retain email body or attachments after delivery. Metadata (message ID, timestamp, recipient, delivery status) is retained in SES's standard logs per AWS's policies.
• Operational logs: request logs are retained by Vercel under their standard retention (currently a small number of days; check Vercel's policy for the latest).
• Tax records you have entered: NZ tax law (IRD) generally requires you to keep tax records for 7 years. While Coffer is your record store, we recommend you periodically export or back up your data so you remain compliant independent of Coffer's availability.

• All connections to Coffer use HTTPS, the standard secure web protocol. Your browser will refuse to connect to Coffer over an insecure connection.
• The database is encrypted at rest and only reachable over a secure, authenticated connection.
• Sign-in is handled by Google. Coffer doesn't store passwords. If you have two-factor authentication set up on your Google account, that protection carries through to Coffer.
• Your account's data is fenced off at the database itself, not just by application code. Every request runs in a database session pinned to your account, and the database refuses to return rows belonging to anyone else. Even a bug in Coffer's code that forgot to scope a query couldn't leak data across accounts.
• When something goes wrong, the error report that gets sent to Coffer's error-tracking service is filtered first. Invoice content, client details, request bodies, and your session cookie are stripped out before the report leaves Coffer's runtime. The crash itself is captured so we can fix it; what you typed isn't.
• Every form submission checks that the request came from a real Coffer page in your browser, not from a malicious site trying to act on your behalf.
• Public endpoints (sign-up, invoice sending, feedback) are rate-limited per IP address and per account. Generous for normal use; tight enough to make automated abuse impractical.

If Coffer discovers a privacy breach we believe qualifies as a notifiable breach under the New Zealand Privacy Act 2020, we will notify affected users and the New Zealand Office of the Privacy Commissioner within the timeframes the Act requires. See the OPC's notifiable-breach guidance for what that means in practice.

Coffer does its best, but no system is perfectly secure. If you believe Coffer has been compromised or your data has been exposed, please contact us promptly using the details at the end of this policy.

You have the right to:

• Download a copy of your data. From Settings → Privacy inside the app you can request an export. Once approved, we provide a download containing your account information, clients, invoices, tax events, bank snapshots, pots, settings, and email-send history as data files you can open with any text editor or import into a spreadsheet. Each request is reviewed before action so we have a record of every data export event.
• See administrative actions taken on your account. From Settings → Privacy you can request a report of every administrative action on your account (what was done, when, why). The report is emailed to you as a downloadable file.
• Delete your account. Also from Settings → Privacy. There is a 14-day grace period after approval during which you can cancel. After that, your data is wiped and your account email is anonymised. See "How long we keep it" above for what is retained beyond that point.
• Correct information that is wrong: edit it directly in the app, or contact us.
• Withdraw your consent to processing where consent is the legal basis. Coffer is an invoicing and tax tool, so in practice the data you have entered (your business details, clients, invoices, tax settings, bank snapshots, account identity, and so on) is what makes the service work for you. If you want to withdraw consent fully, that is the same outcome as deleting your account; use the deletion option above. Partial withdrawal of consent for specific data categories is not something we can offer because Coffer's features are tightly coupled to the underlying data.
• Make a complaint to the New Zealand Office of the Privacy Commissioner if you are not satisfied with how Coffer has handled your information. How to make a complaint.

The self-service flows above are the fastest path. If you would rather contact us, or if a request needs human judgement, use the email at the end of this policy. We do not charge for handling reasonable requests.

Coffer uses one essential cookie: the session cookie set when you sign in. It keeps you signed in between page loads. It isn't accessible to scripts running in your browser, is only sent over secure connections, and expires when your session ends.

Coffer does not use cookies for analytics, advertising, or tracking. The aggregate analytics on public pages (Cloudflare Web Analytics) is cookie-free by design. There is no cookie banner because, under the NZ Privacy Act, an essential session cookie used only for the function you have explicitly asked for (signing in) does not require a consent banner. (The EU GDPR has its own rules; if you are using Coffer from the EU and we are at that stage, talk to us.)

Coffer is built for self-employed contractors and is not intended for anyone under 18. Coffer does not knowingly collect information from children. If you believe a child has signed up, contact us and we will remove the account.

When this policy changes in a material way (for example, when a new sub-processor is added, when the data location moves to a different region, or when the legal basis for processing changes), the "Last updated" date at the top will move forward, and active users will be notified by email. Smaller editorial fixes will not trigger a notification.

For privacy questions, data access requests, or to report a concern, email privacy@coffer.co.nz. We aim to respond within five working days.