Privacy policy
Last updated 29 September 2026
Stuff & Things is a small business systems, automation and AI consultancy run by Sammy Rae in Wānaka, New Zealand. This policy explains what personal information I collect, why, who I share it with, and your rights under the Privacy Act 2020. If you have a question, email sammy@stuffandthings.co.nz. I’m the privacy officer for the business.
What I collect
- The quick business audit. Your business name, the type of business, how many people work in it, the tools you use, what takes up your time, your rough admin hours, your website (if you give it) and your email address.
- When you book or contact me. Your name, email and anything you choose to tell me, through email, phone or my booking page.
- When you’re a client. The information needed to do the work, which is covered by our statement of work (see “Client work” below).
- Basic website statistics. Page views and similar counts through Cloudflare Web Analytics, which doesn’t use cookies or track you across other sites. The site doesn’t set cookies.
How I use it
- To write your quick business audit read-out and show it to you.
- To follow up with you about the audit or a conversation, if it looks like I can help.
- To quote for, deliver and support work you’ve asked me to do.
- To keep basic business records, including invoices.
I don’t sell your information, and I don’t add you to a mailing list without asking.
Who I share it with
I use a small number of trusted services to run the business. They only get what they need:
- HubSpot, my customer database. Audit and contact details are stored there.
- Anthropic (Claude), which writes the audit read-out from your answers, and your website if you give it. Anthropic’s commercial terms say information sent through their API isn’t used to train their models.
- Cloudflare, which hosts this website and provides the website statistics.
- Calendly, if you book a chat, and Google Workspace for email and files.
- Google Fonts, which serves the fonts on this site and may see your IP address when a page loads.
- Xero, for invoicing, if you become a client.
Some of these services store information outside New Zealand, including in the United States and Australia. I choose services with strong security and privacy commitments, as the Privacy Act requires when information goes overseas. I’ll also share information if the law requires it.
Client work
When I work on your systems:
- I build inside your own accounts wherever possible, so you own the work and can see it.
- I only have access for the build, and access is removed when the project closes.
- The AI tools I use are on paid business plans that don’t learn from your data.
- A person checks anything before it reaches your clients.
How long I keep it
I keep audit and contact details while we’re in touch and for up to two years after our last contact, unless you ask me to delete them sooner. Client and invoice records are kept for as long as the law requires (generally seven years for tax records).
Keeping it safe
I use reputable, secure services, strong passwords and two-factor authentication, and I limit who can see your information. If there’s a privacy breach that’s likely to cause serious harm, I’ll tell you and the Privacy Commissioner, as the law requires.
Your rights
You can ask to see the personal information I hold about you, and ask me to correct it or delete it. Email sammy@stuffandthings.co.nz and I’ll respond within 20 working days. If you’re not happy with how I’ve handled your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Changes
If I change this policy, I’ll update it here with a new date.