Pubd

Privacy Policy

Last updated 19 October 2026

Pubd Limited (“Pubd”, “we”, “us”) is a New Zealand company. We design, build and host websites for businesses, and provide the Pubd app, where our clients edit their website and manage their enquiries, messages, reviews and social posts. This policy explains what personal information we collect, why, who we share it with and the choices you have. It applies to pubd.io, the Pubd app (cms.pubd.io) and the websites we host. We follow the New Zealand Privacy Act 2020.

Two roles we play

  • For our own clients, visitors and prospects, we decide how your information is used, and this policy is our promise to you.
  • For our clients’ customers (people who fill in a client’s website form, message their Facebook Page or Instagram, leave them a Google review, subscribe to their newsletter or book through their site), we hold and process that information on our client’s behalf, to provide our service to them. The business you contacted is responsible for how it uses your information and for telling you about it. We only use it to provide our service to that business. See When we act for our clients.

Information we collect

  • Account information: the name, email address and business details of each person with a Pubd login, and which business they belong to.
  • Your website content: the text, images, files and settings you manage in the Pubd app, and the history of changes.
  • What you send us: details you give us through pubd.io (the contact and “Get started” forms), by email, or while designing a new site with us in the New Site Studio (your answers, your logo and photos, and the design we make together).
  • Billing information: invoices, payments and plan details. Card payments are handled by Stripe; we never see or store your full card number.
  • How you use the Pubd app: which features and screens you use, what you click, how long you spend, and whether you use a phone, tablet or computer. We use this to find what is confusing and improve the app. It never includes the content of your messages, enquiries or posts.
  • Security and operating records: sign-ins, significant account actions (such as publishing your site or adding a login), with the time, approximate location and device, and error reports when something breaks.
  • Businesses we approach: when we contact a business about our services, we use contact details that business publishes (for example on its website, Google profile or social media) and keep a simple record of who we contacted and how they replied, so we do not contact anyone twice or after they have said no.
  • Google data you connect: only if you choose to connect a Google account. With your permission we access:
    • Google Analytics (analytics.readonly): your website’s visitor statistics.
    • Google Search Console (webmasters.readonly): how your site performs in Google Search.
    • Google Business Profile (business.manage), where you connect it: your profile’s details, reviews and performance, so you can reply to reviews, keep your details up to date and post updates from the Pubd app.
    • Your Google account email, to show which account is connected.
  • Public Google reviews: we read the reviews shown publicly on your business’s Google listing, using Google’s Places service, so they appear in your inbox and, if you choose, on your website.
  • Facebook and Instagram data you connect: only if you choose to connect your Facebook Page and the Instagram professional account linked to it. With your permission we access:
    • The list of Facebook Pages you manage, so you can choose which one is your business.
    • The name and ID of the Page you choose, and the username and ID of its linked Instagram account.
    • Permission to publish the posts, photos and videos you compose in Pubd to that Page and Instagram account.
    • Messages people send to that Page and Instagram account, including the sender’s name and the text of the message, so they appear in your Pubd inbox and you can reply.
    • Permission to subscribe your Page to our notifications, which is what allows a message to reach your inbox at all.
  • Your customers’ information: enquiries from your website forms, messages, reviews, newsletter subscribers, people you ask for a review and, where you use our booking tools, your members’ booking details. We hold these for you (see below).

How we use it

  • To run the Pubd app and your website: hosting, publishing your changes, and keeping both secure.
  • To bring your enquiries, messages and reviews into one inbox, and alert you when something new arrives.
  • To publish the posts you create, now or at the time you schedule.
  • To show you how your website, Google listing and posts are performing, with suggestions to improve them.
  • To send the emails you ask us to send for you, such as your newsletter or review requests.
  • To bill you, answer your questions and tell you about changes to the service.
  • To understand how the app is used, so we can improve it.

We do not sell personal information, and we do not use it for advertising.

AI features

Some features in the Pubd app use artificial intelligence. To work, they send the information listed below to our AI providers (currently Anthropic). Our providers do not use it to train their models, and keep it only for a limited period for safety and abuse monitoring. Everything an AI feature produces is a suggestion: you decide what to send, post or publish.

  • Sorting your inbox: the text of a new enquiry or message and the sender’s name, to label it hot, warm or cold, spot sales pitches and suggest tags. The labels help you decide what to answer first; they never hide or delete anything.
  • Reply drafts: the conversation with a customer (their enquiry or messages and your earlier replies) and some of your website’s wording, to draft a reply for you to check and send.
  • Review replies: a Google review and your business details, to draft a reply for you to check.
  • Captions: the photos or video cover you choose and some of your website’s wording, to draft a caption in your voice.
  • Insights and your weekly briefing: summarised figures about your website, search results and enquiries, to explain them in plain language and suggest what to do next.
  • Your Google listing: your website’s wording, to write page titles and descriptions for Google and to draft your Google Business Profile category and description.
  • Change requests: what you ask to change and the relevant part of your website, to prepare the change.
  • Designing and building sites: your answers, logo, photos and existing website, to design your new site and prepare it for the Pubd app.

How we use Google user data (Limited Use)

Pubd’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We use Google Analytics, Search Console and Business Profile data only to provide the features you see in the Pubd app.
  • We do not sell this data, and we do not use it for advertising.
  • We do not transfer it to others except as needed to provide the service, with your consent, or as required by law.
  • No human reads your Google data except with your consent, for security or to resolve a problem, or where required by law.
  • Where an AI feature uses Google data (as described above), it is sent to our AI provider only to produce what you see on screen, and is not used to develop, improve or train generalised AI or machine-learning models.

How we use Facebook and Instagram data

  • We publish only the posts you compose yourself, to the accounts you choose, when you press Share or at the time you schedule. We never post on your behalf otherwise.
  • We show you the messages sent to your Page and Instagram account, and send the replies you write. We do not message anyone who has not messaged you first.
  • We do not sell this data, and we do not use it for advertising.
  • We do not transfer it to others except as needed to provide the service, with your consent, or as required by law.
  • No human at Pubd reads your messages except where you ask us to, for security, or to resolve a problem you have reported.
  • Your data is never used to develop, improve or train generalised AI or machine-learning models. The AI features above that use it (sorting your inbox, drafting replies and drafting captions) send it to our AI provider only for that purpose.

When we act for our clients

When we hold information about a client’s customers, the client is the business responsible for it under the Privacy Act. That includes telling their customers that the information is collected and how it is used, including when it reaches them indirectly (for example through Facebook, Instagram or Google). We:

  • use it only to provide our service to that client, as described in this policy;
  • never contact a client’s customers ourselves, except to send what the client asks us to (such as their newsletter or review requests);
  • keep it secure, and delete it when the client asks or closes their account;
  • help the client respond if one of their customers asks to see or correct their information.

If you are a client’s customer and have a question about your information, please contact that business first. You can also contact us.

Who we share it with

We share information only with the providers that help us run the service, and only what each one needs:

  • Supabase: our database and file storage.
  • Vercel and Netlify: hosting for the Pubd app and for websites.
  • GitHub: stores the code and content of the websites we build.
  • Resend: sends our emails, and the emails we send for you.
  • Anthropic: our current AI provider (see AI features).
  • Google and Meta: the accounts you connect, and Google Analytics on pubd.io and the websites we host.
  • Stripe: card payments.
  • Sentry: error reports, so we can fix problems.

We may also disclose information where the law requires it.

Where your information is stored

Our database is hosted in Singapore. Some of our providers also process information in other countries, mainly the United States (including Anthropic, Resend, Stripe, Sentry, GitHub, Google and Meta). We choose providers that protect personal information to standards comparable to New Zealand’s, and the information is protected in transit and at rest.

How we protect it

Access to information is limited to the people who need it. Where we store a Google, Facebook or Instagram connection, the access tokens are encrypted at rest and are never sent to your browser. No method of storage is perfectly secure, but we take reasonable steps to protect your information, and we will tell you, and the Privacy Commissioner where required, if a privacy breach is likely to cause serious harm.

How long we keep it

  • Account information, website content, enquiries, messages and reviews: while your account is active. Messages already in your inbox stay there after you disconnect Facebook or Instagram, because they are your business’s correspondence; email us if you want them deleted.
  • Search Console history: so the Pubd app can show how your search performance changes over time, we store a daily record of your results (the pages and search terms your site appeared for, with clicks, impressions and position). Google Analytics data is read live and not stored. We keep that history while your account is active, including after a disconnect, so your trends are still there if you reconnect.
  • How you use the Pubd app (screens, presses, time): 13 months.
  • Security records: 90 days, after which only monthly totals are kept.
  • When your account closes, we delete your information within 30 days, or sooner if you ask, except invoices and payment records, which New Zealand tax law requires us to keep for 7 years.

Your choices and rights

  • You can ask to see the personal information we hold about you, and ask us to correct it. Email us and we will respond within 20 working days.
  • You can disconnect Google at any time in the Pubd app. This deletes the stored connection and token, and we stop collecting any further Google data. You can also revoke access at myaccount.google.com/permissions.
  • You can disconnect Facebook and Instagram at any time in the Pubd app. This deletes the stored tokens and stops your Page sending us any further messages. You can also remove access in Facebook’s Business Integrations settings.
  • To delete your account and its data, email us and we will action it.
  • If you are not happy with how we have handled your information, you can complain to the Office of the Privacy Commissioner.

Cookies and similar technology

  • The Pubd app uses cookies only to keep you signed in, and stores a few preferences (such as light or dark mode) in your browser.
  • pubd.io uses Google Analytics, which sets cookies to count visits and see which pages are read. It also remembers, for the length of your visit, the link you arrived from, so we know which of our channels brought you.
  • We do not use advertising cookies.

Children

Our service is for businesses. It is not directed at children, and we do not knowingly collect information from anyone under 16.

Changes to this policy

We update this policy when the service changes, and change the “last updated” date above. If a change significantly affects how we use your information, we will tell our clients by email.

Contact

Questions about this policy or your information? Email our privacy officer at hello@pubd.io.