Last updated 11 November 2026

Privacy Policy

In plain English (the full text below applies if there is any difference): We collect the information we need to run your SquareMeter account and keep it secure. Your plans and quotes are yours. We do not sell your data, show ads, or send your plans to AI services. Our service providers hold and process your data, some of it outside New Zealand. You can ask us for a copy of the personal information we hold about you or to correct it, and you can ask us to delete your account.

Who we are

SquareMeter (squaremeter.co.nz) is a browser-based tile takeoff-to-quote app for New Zealand tile contractors. It is operated by BUILDUP TECHNOLOGY LIMITED (NZBN 9429053904935), New Zealand (“we”, “us”). Its registered office is shown on the New Zealand Companies Register. We collect and hold the information described in this policy. Privacy officer: contact us at support@squaremeter.co.nz and your message will go to our privacy officer.

What we collect

An email address and password (or signing in with Google) are needed to create an account; without them we cannot provide SquareMeter. Everything else you enter is up to you, although some quote features need it. No law requires you to give us this information.

• Account details: email address, your name if provided, and a hashed password (we never store your password in readable form).
• Company details you enter, such as business name, GST number, quote contact details and your logo if you upload one.
• Your content: projects, plan PDFs you upload, measurements, rates, quotes and issued quote PDFs.
• Information about your clients that you upload (see “Client information you upload” below).
• If you choose “Continue with Google”: your name, email address, profile picture link (if provided) and account identifier from Google. We also store the sign-in tokens and permission scope Google issues to us for the sign-in. We only ask Google for your basic profile and email address.
• Session data: each time you sign in we record your IP address (where available) and your browser’s user-agent text (browser, version and device type) with your login session, to keep your account secure. Sessions expire automatically, but we do not run a scheduled clean-up of expired session records, so they may stay in our database until we remove them or your account is deleted.
• Setup progress: we record which first-time setup steps your company has completed (for example, trade chosen or first quote issued), linked to your account by a one-way hash, and delete those event records after 30 days. We keep your setup answers (such as your trade and whether you price by rate card) and which tips you have dismissed. Our hosting providers (Vercel and Convex) also keep their own technical logs of requests and errors, which can include IP addresses and browser details, for their own retention periods. We do not use analytics or tracking tools.
• Abuse-prevention data: where our sign-in rate limiter is switched on, a counter of recent requests to our sign-in system, tied to your IP address, so we can limit repeated attempts. This counter does not record your email address.

How we use it

To provide SquareMeter: sign you in, store and calculate your projects, produce quotes, send verification and password-reset emails, secure the service and prevent abuse, give support, keep the service working and fix errors, and meet our legal obligations. We do not sell your data and we do not use advertising cookies or trackers.

We do not currently use any AI service. If we add one that handles your plans or personal information, we will update this policy first.

Client information you upload

Your plans and projects can include information about your clients, such as their names, email addresses and site addresses. We hold and process this information on your behalf to provide SquareMeter to you. We do not use it for our own purposes, and we look at it only if needed to give you support, keep the service secure or meet the law. You are responsible for it under the Privacy Act 2020, including having the right to share it with us and, where the Act requires, telling your clients that you hold their information and use a service provider such as SquareMeter to hold it. On request we will return it to you or delete it. Deletion and export are handled by us by hand after you email support@squaremeter.co.nz; there is no self-serve delete or export button yet. Your clients’ information is stored and processed by Convex and passes through Vercel, as described below. It is not sent to Resend or Google. SquareMeter does not currently email your clients: you download your quote PDFs and send them yourself.

If you are a client of one of our users and want to see or correct information about you, ask that user. If you contact us we will pass your request to them promptly.

Cookies

We use only the cookies and similar browser storage needed to sign you in and run the app. Cookies keep you signed in. Local browser storage remembers your most recent project and sheet and the progress of plan uploads. Your browser also keeps a cache of plan pages you have viewed, which includes images made from your plans, so they load faster. We clear that cache when you sign out and when a different account signs in on the same browser, but on a shared computer you should sign out. We do not use advertising, analytics or tracking cookies or scripts.

Who processes your data

• Convex (a United States company): holds the app data and files (database and file storage). We have chosen a hosting region outside New Zealand.
• Vercel (a United States company): runs the website and the servers that handle your requests and keeps technical request logs that include IP addresses.
• Resend (United States): sends account emails, such as verification and password reset.

Sign-in with Google: if you choose this, Google (United States) tells us your name, email address and account identifier, and learns that you signed in to SquareMeter. Google handles your information under its own privacy policy. It does not receive your plans, projects or client information.

The providers above act on our instructions to deliver the service. We do not disclose your personal information to anyone else except: as you direct us; to our professional advisers; where the law requires or authorises it (for example to prevent a serious threat to someone’s life or health); or to a buyer of our business or its assets, and we will ask the buyer to use it only for the purposes in this policy.

Storage overseas

Our providers are based in, or run their services from, countries outside New Zealand, mainly the United States and Australia, so your personal information may be stored or processed overseas. Where a provider only stores or processes your information on our behalf, we remain responsible for it under the Privacy Act 2020. Where a provider keeps information for its own purposes (for example Resend’s delivery logs and Vercel’s request logs), it is a separate recipient, and the privacy laws of the country it operates in may not protect your information in the same way New Zealand law does (see IPP 12 of the Privacy Act 2020). By using SquareMeter you accept that your information is handled overseas in this way.

How long we keep it

We keep your account data until you ask us to delete it. We do not currently delete accounts automatically when they are inactive or when you stop using SquareMeter. When you ask us to close your account we delete your account, projects, plans and quotes from our live systems by hand after confirming your identity, aiming to do this within 20 working days (this is a goal, not a legal deadline). Deleted data may remain in our providers’ backups until those backups expire; we have not set a fixed period. Our email provider (Resend) keeps its own delivery logs of the verification and password-reset emails it sends you. If you create an account but never verify your email, we may keep your email address and sign-up record until we remove it. We keep personal information only for as long as the law requires or we need it for the purposes described here.

Your rights

Under the Privacy Act 2020 you can ask us whether we hold personal information about you, ask for a copy of it, and ask us to correct it. Email support@squaremeter.co.nz. We will tell you our decision as soon as reasonably practicable and no later than 20 working days after we receive your request, unless the Act lets us extend that time, in which case we will tell you why. We may need to check who you are first and will do that promptly. If we decide not to correct something, you can ask us to attach a statement of the correction you sought. If we refuse, or you are unhappy with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Security and breaches

We use access controls, encrypted connections and hashed passwords. No system is perfectly secure. If you think your account has been compromised, tell us straight away. If a privacy breach happens that has caused, or is likely to cause, serious harm, we will notify the Privacy Commissioner and affected people as soon as practicable after we become aware of it, as the Privacy Act 2020 requires. For client information we hold on behalf of a contractor, we will tell that contractor so they can meet their own duties. Contact our privacy officer at support@squaremeter.co.nz.

Changes

We may update this policy. We will change the date at the top and, for material changes such as a new provider receiving your information, tell you by email or in the app. We will not use information you have already given us for a new purpose unless you agree or the Privacy Act 2020 allows it.

Questions: support@squaremeter.co.nz. Privacy Policy · Terms of Use