Haere Tahi · haeretahi.com · Last updated 26 September 2026 · Prepared under the Privacy Act 2020. Privacy contact: kiaora@haeretahi.com
Haere Tahi is operated by Hexagon NZ Limited, trading as Haere Tahi ("we", "us"). We operate haeretahi.com, a free members-only platform on which families share private car rides to and from sporting venues in New Zealand. This policy explains what personal information we collect, why, who can see it, and your rights.
| Information | Why we collect it |
|---|---|
| Name, suburb/town, region | To identify you to other members and show you relevant local trips. "General location" means your suburb, town or district only — never a street address, and never a precise or GPS location |
| Email address | Sign-in (one-time codes), account security, and service notifications |
| NZ mobile number | Account integrity; never shown to other members. Not required from members under 18 — a young member's guardian is the contact that matters |
| Children's details (name, age, school year, email) | Linked family accounts, junior seat/gear planning, and the under-16 guardian-approval safety feature. An email address is optional — a parent can add a child to their household without one. See section 3 for how this is collected |
| Age, asked of everyone at registration | To know whether an account belongs to a young person, so the right protections apply. If you are 18 or over we do not keep it — the answer is used and discarded |
| Guardian confirmation (which adult confirmed they look after a young member, and when) | So a child's account is supervised by a real adult who agreed to it, rather than by someone they simply named |
| Vehicle details incl. self-declared WoF and registration dates | So other parents can see what vehicle their child would travel in. We do not verify these details |
| Driver declaration — four yes/no confirmations, the date you gave them, and which version of the wording you agreed to | So other parents can see that a driver has confirmed they are licensed, insured for lifts given at no charge, and will carry passengers legally. We record only the yes/no answers. We never collect your licence number, insurance policy details, or copies of any documents, and we do not verify anything you confirm |
| Members you block | To hide that member's trips from you and stop join requests between you |
| Concerns you report (the reason you pick and what you tell us) | So we can look into safety and conduct concerns and act on them |
| Trips, join requests, offers, messages, interests | The core service — arranging shared rides |
| Ratings — two yes/no questions after a completed trip | Community trust. About a driver you are asked "Was the trip safe?" and "Would you join them again?". About a rider you are asked "Was the rider fine (behaviour, on time)?" and "Would you take them again?". Those are the only rating questions, and there are no free-text comments |
We do not collect payment information (the platform is free and has no payment facility), precise or GPS location, driver licence or insurance policy details, copies of identity or vehicle documents, criminal or driving-history records, or information from third-party sources.
There is no photo, image, or file upload anywhere in Haere Tahi. You cannot upload a profile picture, a photo of a bike, or a photo of a child, and we hold no images of any member.
Most children's information reaches us from a parent or legal guardian — for example when a parent adds a child to their household or names them in a trip party. Where a parent provides information about their child (indirect collection), this policy is the notice of that collection and its purposes, in line with the Privacy Act's information privacy principles including IPP 3A. An email address for a child is optional; a parent can add a child to their household without giving us one at all.
A child may also hold their own Haere Tahi login. Where that happens we collect their name, age, general location and email address directly from them at registration, and their trip activity as they use the Platform — for the purposes set out in section 2 and no others. We do not require a mobile number from anyone under 18.
No young member's account works until an adult confirms it. At registration a member under 18 gives their parent or guardian's email address. That adult is asked, in their own Haere Tahi account, to confirm they look after the young person. Until they do, the young member can sign in but can do nothing else — they see only a message saying we are waiting. A guardian can withdraw that confirmation at any time, which returns the account to the waiting state. This replaced an earlier arrangement in which a young member simply named an adult, who was told but never asked to agree.
What a young member's account can do depends on their age:
We take extra care with children's information: it is visible only as described in section 4, it is never used for marketing or advertising, and a parent or guardian may ask us to correct or delete it at any time.
Data is stored with our service providers: Supabase (database and authentication, hosted on AWS in Sydney, Australia), Netlify (website hosting), Cloudflare (domain and email routing), and Resend (sign-in emails). These providers act as our agents and are bound by their own security and privacy commitments. Because some infrastructure is located outside New Zealand, your information may be held overseas with providers we consider subject to comparable safeguards.
We do not use advertising cookies, behavioural tracking, or third-party analytics of any kind. To be specific:
The only thing Haere Tahi stores on your device is the sign-in session that keeps you logged in. Clearing your browser data signs you out.
Our hosting providers keep ordinary server logs — records of requests made to the website — for security and troubleshooting, as any host does. We do not use those to build a profile of you, and we do not sell or share any information with advertisers. We have never sold member information and will not.
All traffic is encrypted (HTTPS). Sign-in uses one-time email codes or a password you set. Database access rules restrict every account to the data this policy says it may see. Administrative access is limited to the operator.
We keep your information while your account is active. Past trips disappear from the app shortly after their date but are retained in the database as a record of what was arranged. Cancelled trips are retained (hidden) as a record.
Driver declarations are kept as a dated record for as long as your account exists. They cannot be edited or removed one at a time, and confirming the declaration again adds a new record rather than replacing the last one — the whole point of the record is to show what was confirmed and when.
You can delete your account and personal information (or your child's) at any time from Me → Delete my account in the app, at haeretahi.com/delete-account.html, or by emailing kiaora@haeretahi.com. Deleting your account removes your profile and the information linked to it — your vehicles, your kids' details and your driver declarations — from the live service. Any upcoming trips you are hosting are cancelled and the families booked on them told. Where you ask us by email rather than doing it yourself, we will action it within 20 working days.
Two things to be clear about, because "deleted" is rarely absolute:
Under the Privacy Act 2020 you may ask us at any time for a copy of the personal information we hold about you or your children, and ask us to correct it. Contact kiaora@haeretahi.com. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).
If a privacy breach occurs that risks serious harm, we will notify the Privacy Commissioner and affected members as required by the Privacy Act, tell you what happened and what we are doing about it.
We will post any changes to this policy here and note the date above. Material changes will be flagged in the app.