Privacy Policy

1. Who we are

TooGood Digital Ltd ("TooGood", "we", "us") is a digital marketing agency based in Auckland, New Zealand. We provide Google Ads management, SEO, social media, analytics services, and free web-based tools to New Zealand businesses.

We are subject to the Privacy Act 2020 (New Zealand) and handle your personal information in accordance with its Information Privacy Principles.

Contact us about privacy matters at: hello@toogooddigital.co.nz

2. Information we collect

2.1 Information you give us directly

When you contact us via our website enquiry form, we collect:

• Your name
• Your email address
• Your phone number (if provided)
• Your business name and website (if provided)
• The content of your message

2.2 Information collected via our tools (Location Ad Spend Audit)

When you use our free Location Ad Spend Audit tool, you connect your Google account via Google OAuth. We collect:

• Your name and email address (from your Google profile)
• Your Google profile picture
• An OAuth access token and refresh token, stored temporarily in a secure, signed, HTTP-only session cookie

We do not store your Google Ads data. Your advertising data is queried in real time directly from Google's API and is never written to our databases or servers. When you close your session, your data is gone.

2.3 Information collected automatically

When you visit our website we automatically collect standard web analytics information via Google Tag Manager and Google Analytics 4, including:

• Pages visited and time spent
• General geographic location (country/city level)
• Device type and browser
• Referring website

This data is aggregated and does not identify you personally.

3. How we use your information

We use the information we collect to:

• Respond to your enquiries and provide the services you request
• Operate and improve our free tools
• Send follow-up communications where you have expressed interest in our services (you can opt out at any time)
• Understand how our website is used so we can improve it
• Meet any legal obligations

We do not use your information for automated decision-making that has legal or similarly significant effects on you.

4. How we share your information

We do not sell your personal information. We share it only with the following third-party service providers who help us operate our business, each bound by their own privacy commitments:

Where information is transferred outside New Zealand, we take reasonable steps to ensure it is protected in a manner consistent with the Privacy Act 2020, including relying on the privacy frameworks of our service providers.

5. Cookies

We use cookies for the following purposes:

• Session cookie — a secure, HTTP-only cookie used to maintain your signed-in session when using our audit tools. It expires after 24 hours.
• Analytics cookies — set by Google Analytics to understand website usage. These can be blocked via your browser settings or a browser extension such as uBlock Origin.
• State cookie — a short-lived cookie (10 minutes) used during Google OAuth sign-in to prevent cross-site request forgery. It is deleted immediately after sign-in.

We do not use advertising cookies or tracking pixels on this website.

6. How long we keep your information

• Enquiry and contact data — retained in our CRM for as long as we have a business relationship or legitimate interest, and no longer than 3 years after last contact.
• Google Ads data from our tools — not retained. Queried live and discarded at session end.
• Session cookies — expire after 24 hours.
• Analytics data — retained by Google Analytics for 14 months (our configured retention period).

7. Your rights under the Privacy Act 2020

Under the Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Correct any personal information that is inaccurate or misleading
• Ask us to delete your personal information (subject to any legal obligations we have to retain it)
• Complain to the Office of the Privacy Commissioner if you believe we have breached the Privacy Act

To exercise any of these rights, email us at hello@toogooddigital.co.nz. We will respond within 20 working days as required by the Act.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner: privacy.org.nz or 0800 803 909.

8. Security

We take reasonable steps to protect your personal information from loss, unauthorised access, use, modification, or disclosure. Our technical measures include:

• HTTPS encryption across all pages
• HMAC-signed, HTTP-only session cookies (not accessible to JavaScript)
• OAuth tokens are never logged or stored in databases
• Access to our systems is restricted to authorised personnel

No method of transmission over the internet is 100% secure. If you believe your information has been compromised, contact us immediately.

9. Children

Our website and tools are directed at businesses and their representatives. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page will reflect any changes. We encourage you to review this policy periodically. Continued use of our website or tools after any changes constitutes acceptance of the updated policy.

11. Contact us

For any questions, requests, or complaints about how we handle your personal information:

TooGood Digital Ltd
Auckland, New Zealand
hello@toogooddigital.co.nz