Privacy
Privacy notice
Effective: 10 November 2026
Long Line Site-Day is operated in New Zealand by David Christopher Long as a sole trader. This notice explains how personal information is collected, used, stored and disclosed when you use Site-Day. Site-Day is the agency collecting and holding account information and cloud diary information. Our online contact address is the Site-Day support form.
Information we collect
We collect the information you provide to operate your account and diary, including your email address, diary content, jobs, tasks, notes, priorities, due dates, workers and hours, site instruction records (the name and role of the person giving the instruction, what was agreed, and any sketch and signature), QR site sign-in records, feedback and support requests. Billing is handled by Stripe; Site-Day stores subscription identifiers and status but does not store your full card number.
QR site sign-in
If an account holder sets up a site sign-in QR code, people who scan it enter their name and company and tap Sign in or Sign out. We record those details with the time, plus a random code saved on that phone so a double tap is not recorded twice. No phone number, location or other details are collected. These records are shared only with the account holder who runs that site's diary, who decides how they are used, and they are kept until the account holder deletes them or closes their account. If you signed in on a site and want your records accessed, corrected or deleted, ask the person who runs that site or use our support form.
Why we use it
We use personal information to provide Site-Day, authenticate users, sync and back up diary data, administer subscriptions, provide support, improve the service, prevent abuse, maintain security and meet legal obligations. Providing an email address and password is voluntary, but without them we cannot create a cloud account or provide cross-device sync. Information requested in the support form is voluntary, but we need enough contact and request information to investigate and respond.
Storage, recipients and service providers
Your browser keeps a local copy of diary data. When signed in, your cloud copy is stored in Supabase, with the Site-Day database currently hosted in Sydney, Australia. Vercel hosts the application and server functions, Stripe processes payments and subscriptions, and Resend (United States) delivers emails such as support replies and account notices. These providers receive or process the information needed to perform those services and may process it outside New Zealand on our behalf. We use access controls, encryption in transit and provider security controls to protect information. We remain responsible for personal information handled by service providers acting as our agents.
Access, correction and deletion
You may ask for access to personal information we hold about you, ask us to correct it, or request account/data deletion through the Site-Day support form. We may need to verify your identity before releasing information. For an access or correction request, we will make the required decision as soon as reasonably practicable and normally within 20 working days, subject to any lawful extension. If we refuse access or a requested correction, we will provide the information or statement required by applicable New Zealand privacy law.
Retention
We keep account and diary information while needed to provide the service and for a reasonable period afterwards for support, security, backup and dispute purposes. If you request deletion, we will delete or de-identify information that is no longer required. Some records may be retained where law requires it, including tax, accounting, payment and fraud-prevention records.
Security and privacy incidents
Site-Day uses per-user authentication, row-level database access controls, server-side billing credentials and restrictive production security headers. If a privacy breach is likely to cause serious harm, we will assess our notification obligations and notify affected people and the New Zealand Privacy Commissioner where required.
Browser storage, cookies and emails
Site-Day uses your browser's storage to keep your diary, sign-in session and settings on your device. We do not use advertising or tracking cookies or third-party analytics. We only send marketing emails if you have agreed to receive them, and every marketing email includes a way to unsubscribe. Service emails about your account, sign-in and billing are sent as needed.
Sharing
We do not sell your diary content or account information to advertisers. Information is disclosed only as needed to operate the service, comply with law, protect users or investigate security and fraud issues.
Information about other people
A diary may contain personal information about workers, clients or other people, entered by the account holder or collected through the account holder's QR sign-in. Site-Day holds that information on the account holder's behalf. Account holders are responsible for ensuring they are authorised to collect and enter it and for meeting any privacy notice obligations that apply, including telling people when information about them is collected from someone else (Information Privacy Principle 3A).
Privacy officer and contact
David Christopher Long is the privacy officer for Site-Day. Privacy, access, correction and deletion requests can be made through the support form.