Privacy policy

Just reading

This website doesn't use analytics, advertising or tracking tools, and it doesn't set any cookies while you're reading it.

Like every website, the service that hosts it (Netlify) records basic technical details of each request, such as your IP address, your browser and the page asked for. These are used to run the site, protect it from abuse and limit how many requests one address can make. We don't use them to work out who you are.

Using the contact form

The form asks for your name, your business name, your email address and a message, and optionally your phone number and fleet size.

When you send it, the form is turned into one email to our inbox (ben@irongate.co.nz), delivered by our email provider, Resend. It isn't saved in the Vanbase database or added to any mailing list. We don't have a mailing list.

We use what you send only to reply to you and to talk about whether Vanbase suits your business. We keep it in that inbox while we're talking, and delete enquiries that don't lead anywhere within 12 months.

What we hold

• Your account: your name, email address, role (owner or staff), language, whether your account is active, and when you last signed in. Your password is stored by our sign-in provider as a one-way hash, so nobody at Vanbase can see it.
• Your business details: business name, address, phone, email, GST number, logo, brand colour, confirmation notes and settings.
• Your business records: vehicles, rates, insurance tiers, quotes, bookings, payments, handovers, maintenance and notes, including which staff member recorded what.
• A record of each quote and confirmation email sent from Vanbase: who it went to, the subject and text, who sent it and when.
• Sign-in security logs kept by our sign-in provider, including IP addresses.

What we use it for

To run Vanbase for you, to send the emails you ask it to send, to send account emails (such as setting up a staff account or resetting a password), and to help when you ask for support.

We only look at your business records when you ask us to, to fix a problem, or to set your account up with you.

How long we keep it

Your information stays in Vanbase while you use it. There isn't an automatic deletion process yet: when you stop using Vanbase, tell us and we'll delete your business and everything in it, and give you a copy of your data first if you'd like one. Our database provider keeps daily backups for seven days, so the last backup holding it is gone about a week after that.

The terms of your operator agreement also apply.

Who is responsible

The rental business you dealt with decides what information to collect about you and what to do with it. Vanbase stores and processes it for them, as their service provider. Under the Privacy Act, the business is responsible for it, and we only use it to provide Vanbase to that business.

What an operator can store in Vanbase

• Your name, email address, phone and WhatsApp number, address, date of birth, driver licence number, flight number and preferred language.
• Your quotes and bookings: dates, vehicle, pick-up and drop-off locations, prices, the insurance you chose, and any note you add when you accept or decline a quote.
• Payments recorded against your booking: amounts, how they were paid and a reference. Vanbase doesn't take card payments and doesn't store card numbers.
• Handover records: odometer readings, notes on the van's condition, and photos taken at pick-up and return. These are photos of the vehicle, but other things can end up in the frame.
• Notes the business's staff write about your booking.
• If you booked through a travel agent: the agency's name, contact person, email and phone.

If the business prices insurance by age, your date of birth is used to work out your age band. Your quote shows the band (for example "a driver aged 25 and over"), never your date of birth.

Emails and links you receive

Quotes and booking confirmations are emailed through Resend from noreply@vanbase.co.nz, under the business's name. Replies go to the business's own email address when it has set one.

Each email contains a link to a web page showing your quote or confirmation, including your name, contact details, hire dates, vehicle and prices. The link contains a long random code, so it can't be guessed, but anyone who has the link can open the page. These links currently don't expire and can't be switched off, so treat the email like the document itself and only forward it to people you'd give a copy to.

Seeing or correcting your information

Ask the business you hired from: they can see and correct your details in Vanbase. If you contact us instead, we'll pass your request to them and help them answer it.

A business can delete a customer record that isn't attached to any booking. Records attached to a booking can't be deleted in Vanbase yet, because the booking keeps the history of the hire; if the business needs one removed, we can do it for them.

Your information is kept for as long as the business keeps it in Vanbase, and deleted when the business leaves Vanbase, as described for operators above.

Where information is kept, and who processes it

Vanbase uses three service providers to store and process information for us. We use them as our agents, and we remain responsible for how your information is handled.

Supabase

Database, file storage (logos, handover photos, vehicle spec sheets) and sign-in. Stored in Sydney, Australia. A paused copy of an earlier Vanbase database, from before we moved to Sydney in August 2026, is kept unused in Seoul, South Korea, as a backup.

Netlify

Hosts this website and the Vanbase app. The app's servers run in Sydney, Australia; pages and images may be delivered from Netlify's servers in other countries. Netlify is based in the United States.

Resend

Delivers every email Vanbase sends: quotes, confirmations, account emails, notifications and contact form messages. Resend is based in the United States.

Because these providers are in Australia, South Korea and the United States, information is stored and processed outside New Zealand. Nothing else is loaded from other companies: the fonts and icons on this site are served from our own domain.

What we don't do

• No analytics, tracking pixels or advertising tools, on this website or in the app.
• We don't sell, rent or trade personal information, or share it with anyone for their marketing.
• We don't contact operators' customers, or use their information for anything other than providing Vanbase to that operator.
• We don't combine information from different businesses. Each business's data is kept apart from every other business's by the database itself.

Cookies

Reading this website sets no cookies. When you sign in to Vanbase, the app sets cookies that keep you signed in, and a cookie that remembers your language if you change it. They are only readable by Vanbase and aren't used for tracking.

Keeping it safe

Everything is sent over encrypted connections. Each business can only reach its own records, and that rule is enforced by the database, not just the app. Handover photos and spec sheets are kept in private storage and shown through links that expire. An owner can disable a staff account, which signs that person out everywhere at once.

If a privacy breach is likely to cause someone serious harm, we will tell the people affected and the Privacy Commissioner, as the Privacy Act requires, and we'll tell any affected business straight away.

Complaints

If you're unhappy with how we've handled your information, tell us first and we'll try to put it right. You can also complain to the Office of the Privacy Commissioner.

Changes to this policy

If we change how we handle personal information, we'll update this page and the date at the top. We'll email operators about any significant change before it takes effect.