Celecom legal

Privacy policy

Celecom helps people remember occasions and send greetings, drawings, photos, stamps and, when offered, gifts. This policy explains what information Celecom collects, why we use it, when it may be shared, and the choices available to you.

In this policy, Celecom, we, us and our mean CELECOM LIMITED, a New Zealand limited company (company number 9349712, NZBN 9429052914676), with its registered office at Celecom, Flat 2, 11a Arcadia Road, Epsom, Auckland 1023, New Zealand. The service includes celecom.net, its web application, the Celecom mobile apps, emails we send, and related services that link to this policy.

The Celecom iPhone app shows the same service as the website. Where this policy says "the app", it means that app.

1. Our privacy commitments

• We do not sell or broker personal information.
• We do not give a gift buyer a recipient's private sizes, preferences or other profile details. Where matching features are introduced, Celecom may apply those details on the recipient's behalf without revealing them to the buyer.
• We do not currently use third-party advertising trackers or general website analytics SDKs.
• We minimise the information we ask for and use it for stated purposes.
• Pictures are re-encoded before they are stored: public pictures by our server, and photos added to a card by the app before upload. Embedded EXIF metadata, including GPS coordinates, is not kept.
• We use automated tools to assist people and moderators, but an automated content check does not make the final enforcement decision by itself.

2. Information we collect

2.1 Account and profile information

Depending on how you use Celecom, this can include:

• name, username, email address and phone number;
• password and authentication records managed by Amazon Cognito. Celecom does not store your plain-text account password in its application database;
• profile photo, biography, birthday, locale and time zone;
• business-account status, notification choices and reminder lead time;
• identity information supplied by Google when you choose Google sign-in, such as your Google account identifier, name, email address and available profile photo;
• if you choose Sign in with Apple, the identifier Apple gives us for you, the name you choose to share and your email address, which can be a private relay address if you choose to hide yours;
• account verification, onboarding stage and account status;
• the country you live in, the age group you chose (under 18, or 18 or over), when you gave them, the wording version you saw, and the invitation you joined with (never a date of birth);
• the people you have blocked; and
• if you use a Celecom mobile app and allow notifications, a device token for that device, kept with your account so reminders reach it.

2.1A What the app asks your device for

The app asks before it uses any of these, and works without them:

• Location, while you use the app. Only when you tap Use my location while filling in a place. Your device's position, as accurately as the device chooses to give it, can be saved as that place's pin. The pin is kept with the place and only the account that added the place can retrieve it; it is not shown to other members, followers, guests or the public. While you place the pin, the map is loaded from OpenStreetMap, which receives its coordinates. We do not track where you go.
• Camera. To scan the code on a card someone hands you, or to take a photo you choose to add. Only photos you add are kept.
• Photos, add only. To save a stamp to your photo library. The app cannot read your library.
• Notifications. To remind you before an occasion, using the device token above.

The app does not read your device's address book, microphone or advertising identifier.

2.2 People and occasions you add

Celecom lets an account holder create a managed profile for another person, a child, a pet, a place or a group. Information can include a name, photo, relationship, birthday, interests, description, species or place details.

Occasion information can include the occasion type, title, date, time, description, recipient, organiser, privacy setting, followers, allowed forms of participation, cover artwork, delivery zone and, if physical fulfilment is introduced, a delivery address.

Some occasion types can reveal sensitive facts, such as health, pregnancy, bereavement, religion or information about a child. We will not use those facts for advertising targeting. Features that infer or use sensitive information must have an appropriate legal basis and additional safeguards before release.

2.3 Greetings, parcels and creative content

This can include:

• recipient name and contact details supplied for delivery;
• message, salutation, closing and sign-off;
• photos, captions, drawings, signatures and drawing stroke data used to replay a drawing;
• stationery, colour, music, effects and layout choices;
• stamp and occasion references;
• seal date, time zone and locale;
• an optional parcel question hint and a salted cryptographic hash of the answer. We do not store the answer itself; and
• send, delivery, open, thank-you and unlock-attempt records.

A recipient does not need an account to open a greeting link. Anyone who has the private link may be able to open the parcel after its seal conditions are met, so recipients and senders should treat the link like a private letter.

2.4 Social and activity information

This can include accounts and occasions you follow, muted occasions, saved recipients, stamps you create or receive, stamp visibility and likes, content reports, notifications, reminder consent, unsubscribe state and interactions needed to provide the feature. We also record which cards, occasions and Moments Home has shown you, so that Home can put what matters first and does not keep repeating the same items.

We record a parcel open and the minimum interaction information needed for the service, such as whether a delivery or action succeeded. Celecom's current email design does not use an invisible email-open tracking pixel. A link click may be recorded when it is necessary to complete the requested action and preserve a working link.

We do not currently run product analytics. In future we may use privacy-preserving analytics, such as counts of which features are opened and whether an action succeeded, to understand and improve the service. If we do, it will stay on our own systems, will never be shared for advertising, and we will update this policy before we start.

2.5 Communications and support

If you contact us, report content or request help, we collect the information in your message and the records needed to investigate and respond. Administrative and moderation records can include the action taken, the reason, the responsible administrator and a timestamp.

2.6 Technical information

Our infrastructure and security providers necessarily process information such as request time, service endpoint, authentication token metadata, error details and network information, which can include an IP address in infrastructure logs. If something goes wrong in the app or website, it sends us an error report linked to your account: the page, what failed and when. Celecom does not currently build advertising profiles from IP addresses, use device fingerprinting, or intentionally store an IP address in its product database.

The web application uses browser local storage for authentication sessions, unfinished signup or event intent, unsent drawing recovery, sound preference and limited interface state. These are functional storage items, not advertising cookies. Clearing site data or signing out can remove some of them.

2.7 Information from other people

A sender or organiser may give us information about a recipient who does not have a Celecom account, including their name, birthday, email address, phone number or photo. We use it to provide the requested occasion, greeting or delivery feature. We do not use a non-member recipient address for unrelated marketing.

Where law requires it, we will provide or enable an appropriate notice to a person whose information was supplied by someone else. A person may contact us to ask what we hold about them and to request access, correction or deletion.

2.8 Early access requests

If you ask to join Celecom through the Early Access form on our website, we keep the email address you enter, your first name if you give it, and whether Celecom is for you or for an organisation. For an organisation, we also keep its name, your role and its size, if you give them. We record when you asked and which button on the page you used.

We use this to invite you to Celecom, to send you one confirmation email, and to understand who is asking. A copy of each new request goes to our team inbox so we can answer you. We do not keep your IP address. To stop the form being misused, we keep a scrambled code made from it, which changes every day and is deleted after a day.

To be taken off the list, reply to the confirmation email or write to hello@celecom.net.

If we invite you to join, we keep your email address with the invitation, when it expires and whether it has been used.

2.9 Organisations, invitations and Moments

If you act for an organisation on Celecom, we keep its members, their roles, and a record of actions naming the member who took them. Contacts an organisation adds or imports, which can include a name, email address, date, relationship, job title and group, are visible to the organisation's members.

If you import contacts from a file, we keep the rows you choose to import (a name and, if the file has them, an email address, a date, a relationship, a job title and groups) until you remove them or undo the import.

If a host invites you to an occasion, the host and co-organisers can see the guest list and your reply.

Moments keep the photo, caption and any stamps or occasion you share, and whether you have seen other people's Moments.

3. Why we use information

We use personal information to:

1. create, authenticate, secure and support accounts;
2. provide profiles, occasions, follows, reminders, greetings, stamps, music, effects and delivery;
3. enforce an occasion's visibility and a parcel's seal or optional question;
4. send transactional messages requested by a user, including verification, parcel delivery, occasion reminders and service notices;
5. remember notification choices and honour unsubscribe requests;
6. personalise the service and, if introduced with the required controls, recommend relevant gifts or content;
7. generate optional writing, drawing, speech or occasion artwork when a user asks us to;
8. detect abuse, screen public images, investigate reports and protect users and the service;
9. diagnose errors, monitor reliability and maintain security;
10. comply with law, respond to lawful requests, establish or defend legal claims and keep required business records; and
11. create aggregated or de-identified statistics that are not reasonably capable of identifying a person.

For people in the European Economic Area or United Kingdom, the legal basis will depend on the activity. It may be performance of our contract, our legitimate interests in operating and securing the service, compliance with law, protection of vital interests, or consent where consent is required. We do not rely on consent where it cannot be freely refused or withdrawn.

4. AI-assisted features

Some Celecom features use AI models run by other companies. We ask before any of them is used with your information. The question appears the first time you use one of these features, names each service and what it receives, and nothing is sent until you choose Allow. You can change your answer at any time in Settings, under Privacy choices. Saying no never stops you using Celecom.

| Feature | What is sent | Who receives it | | --- | --- | --- | | The writer (drafting or shortening a greeting) | Your instructions, any words you ask it to build on or shorten, the occasion and how soon it is, the first name of the person the card is for, and how you told us you know them (for example "sister" or "colleague"). Never their surname, contact details or date of birth, and never an occasion's title. | Amazon Bedrock in Australia (models by Anthropic, Mistral AI and Amazon). OpenAI in the United States if those cannot answer. | | Reading a card aloud in an OpenAI voice, if we have chosen one | The words on the card, including any names in them. | OpenAI in the United States. | | The automatic check of a stamp published to everyone | The picture, including anyone in it. | OpenAI in the United States. |

Reading a card aloud. When somebody plays a card in the Celecom voice, or you play a preview of a card you are writing, the words on the card, including any names in them, are sent to Amazon Polly in Australia (Asia Pacific, Sydney), which returns the audio. This is the usual voice. It works for every card, whatever its sender chose above. If we choose an OpenAI voice instead, a card is read by OpenAI in the United States only when its sender chose Allow to this question, which names reading aloud; every other card is still read by Amazon Polly. We keep the audio in our own private storage so the card can be played again, and a preview is kept the same way for the sender who made it. If the Celecom voice cannot answer, the reader's own phone or browser reads the words instead, and nothing leaves the device. Amazon Polly may keep the words it reads to improve its service, and OpenAI may keep them for up to 30 days to detect misuse.

Which voice reads a card. The voice is chosen from what we already hold about the person who sent the card, never from the card's words, a name or a photo. The accent follows the country on the sender's account, and the voice is a woman's or a man's according to the answer the sender gave for themselves in their account; where there is none, a man's voice is used. This uses nothing we did not already keep and sends nothing more to Amazon Polly than the words. Our administrators can also switch reading aloud off, or have the reader's own phone or browser do it, and can limit how much is read each month. A card is read by an OpenAI voice only if its sender allowed it in the AI help question above, which names reading aloud, and every other card is read by Amazon Polly.

If you say no, or withdraw your answer, nothing more is sent to those companies, and none of your cards is read by an OpenAI voice. The writer is not available, and a person at Celecom checks your public stamps before anyone else can see them.

Information about other people. A card is often about someone else, and a photo may show other people. Your answer covers what you choose to share, so we send as little about other people as the feature needs (for the writer, only a first name). Leave private details about other people out of your instructions, and only make a picture public if the people in it would be happy for it to be seen.

Amazon Bedrock and OpenAI do not use this information to train their models. OpenAI may keep it for up to 30 days to detect misuse. We record your answer, the version of the wording you saw and when; your answer is included in your data download.

Celecom's own team also uses AI for occasion artwork and stamp artwork, through OpenAI or Stability AI models on Amazon Bedrock in the United States. Those requests contain the team's own prompts, not your information. Business accounts can make stamp artwork, and have their product photos checked automatically, only after AI help is allowed for the business account; until then, artwork is not made and a person checks every product photo.

We return generated wording for you to review before it is used. Image moderation may approve an image or refer it to a person, but it does not automatically reject or punish an account by itself.

Celecom does not currently make a solely automated decision that produces a legal or similarly significant effect on a user.

5. When we disclose information

We disclose information only as needed for the purposes above:

• People you choose to share with. Profile, occasion, greeting, stamp or participation information is shown according to the audience you select and the design of the feature. Public profiles or occasions may be visible beyond your followers. A private greeting is available to the holder of its link.
• Recipients and organisers. Information required to identify a sender, recipient, organiser, participant or delivery can be shown to the relevant people. Private recipient preferences are not disclosed to gift buyers.
• Amazon Web Services. AWS provides Cognito authentication, S3 media and audio storage, Aurora PostgreSQL databases, AppSync, Lambda, email delivery, secrets management, operational logging and, in Sydney, Amazon Polly, which turns the words on a card into the voice that reads it aloud. Most systems run in the Asia Pacific (Sydney) region, Australia. Email is sent through Amazon SES in the United States, and AI requests are handled through Amazon Bedrock as described in section 4.
• Google. Google receives information when a person chooses Google sign-in. Google Places may process an address search if that address suggestion provider is enabled. If it is not enabled, the Photon geocoder operated by Komoot receives the address search text instead.
• OpenAI. OpenAI processes the content described in section 4 when you have allowed AI help, for that feature or as a fallback.
• Apple. In the iPhone app, Apple delivers notifications you allow (Apple Push Notification service receives a device token and the notification text) and, when you choose it, provides Sign in with Apple, including a private relay email address if you choose to hide yours. When you delete your account, or stop using Sign in with Apple with Celecom, we ask Apple to revoke Celecom's access to your Apple ID.
• Fonts and maps. Pages load typefaces from Google Fonts, so Google receives your device's IP address and browser details when a page opens. A place's map is shown from OpenStreetMap, which receives that place's coordinates and your IP address.
• App Store. Apple's App Store handles downloading the app and its updates under Apple's own privacy policy. Apple may give us statistics about installs and crashes that do not identify you.
• Payments on celecom.net. Nothing can be bought in the app. When a payment is offered on our website, Stripe, Inc. processes your card or wallet payment. Stripe receives your payment details, the amount, your email address and a reference to your Celecom account. Celecom never sees or stores your full card number. Stripe may process this information in the United States and other countries.
• Email and delivery participants. Email providers, mobile carriers and the recipient's chosen communication service process an address and message as necessary to deliver it. Sign-in codes sent by text message go through Amazon Cognito and Amazon SNS.
• Licensed content providers. Celecom currently imports approved music into Celecom-controlled storage. The recipient does not need to contact Pixabay to play an imported track.
• Professional advisers and authorities. We may disclose information to advisers, insurers, auditors, courts, regulators, law enforcement or another person where reasonably necessary and legally permitted.
• Corporate events. If an organisation uses Celecom, authorised organisers may see event-level participation and operational information described at collection. We will not give an employer the private content of a personal greeting merely because the greeting relates to a workplace event.
• Business changes. Information may be disclosed under confidentiality in a merger, financing, acquisition, reorganisation or sale of assets, subject to applicable law and continued protection.

We do not include a provider in this list merely because we may use it later. Payment processors, gift vendors and advertising partners must be added to this policy before the corresponding feature goes live.

6. Public content and private links

You control whether an occasion or stamp is public, follower-only, selected or private where the product offers that choice. Public content can be copied, indexed, saved or reshared by other people. Changing a setting may limit future access but cannot retrieve copies already made by others.

Public pictures, such as profile photos, stamps, Moments, occasion artwork, share cards and product photos, are checked and re-encoded by our server before they are published. They are then served at web addresses, including through celecom.net/media, that anyone with the address can view. Treat them as public. This includes a photo of a person that another member has added to an occasion or profile, when that occasion or profile is public.

The private contents of a card, such as its photos, drawings, signatures, printed copy and spoken message, are held in private storage and shown only through signed links that expire after about an hour, to people the service allows to see the card. A link already issued works for anyone holding it until it expires and cannot be recalled sooner.

7. International processing

Celecom is established in New Zealand and offers its digital service to people in multiple countries. Its main production systems are in Australia. Some providers or their support teams may process information in other countries, particularly the United States (email delivery and some AI requests) and locations used by Google and OpenAI. Provider locations and support arrangements can change. Contact us for current information about a particular provider or transfer.

Where cross-border privacy rules apply, we use appropriate contractual and organisational safeguards and assess the recipient or provider. You may contact us for more information about the safeguards used for a particular transfer.

8. Retention

We keep personal information only for as long as it is needed for the purpose for which it was collected, to operate shared history safely, to resolve a dispute, or to meet legal obligations.

We determine retention periods by considering the purpose, the expectations of the people involved, shared-history needs, security, disputes and legal obligations. This assessment covers:

• unconfirmed signups and abandoned drafts;
• sent and opened parcels;
• user uploads and replaced profile photos;
• unlock attempts, operational logs and moderation records;
• notification and delivery records;
• consent and unsubscribe evidence;
• deactivated accounts and managed profiles; and
• transaction and tax records if paid gifts are introduced.

Operational logs, including error reports, are kept for 90 days and then deleted.

Cancelling an occasion does not automatically erase greetings already sent by other people. We may retain a limited shared-history record while removing the cancelled occasion from discovery and stopping new activity. Where erasure is required, we will delete or de-identify information unless it must be retained for another lawful reason.

9. Security

We use measures appropriate to the nature of the information, including encrypted transport, cloud access controls, temporary upload credentials, segregated user upload paths, salted password-answer hashing, rate limiting, administrative access controls and audit records.

No online service is completely secure. Keep your account password and private parcel links confidential. Tell us promptly if you believe an account or link has been compromised.

10. Your choices and rights

Depending on your location and the circumstances, you may have rights to:

• know whether we hold personal information about you;
• request access to, or a portable copy of, your information;
• request correction of inaccurate or incomplete information;
• request deletion or de-identification;
• object to or restrict certain processing;
• withdraw consent without affecting earlier lawful processing;
• unsubscribe from non-essential messages and change notification choices;
• complain to us or an applicable privacy regulator; and
• receive information about significant automated decisions if Celecom introduces them in the future.

Profile, visibility and notification details can be changed in the service. The privacy choices centre lets an account holder download a machine-readable copy of information tied to their account, request correction and initiate account deletion. The copy includes the country you told us you live in, your age confirmation, the people you have blocked (not who has blocked you) and any decisions about your eligibility for a feature involving money. To correct your country of residence, use a correction request. We may need to verify your identity and consider the privacy rights of other people before responding. We aim to respond within 30 days, or within any shorter period required by law.

A deletion request does not mean every record can be removed immediately. Celecom may retain or de-identify limited information where needed for another person's rights, signed stamp provenance, security, dispute handling, legal obligations or backup restoration safeguards. The request record will state what was done and explain material information that must be retained. When your account is deleted, we delete the files stored in your account's own folders (the pictures and other media you uploaded), including ones you replaced, ones you uploaded but never attached and unfinished uploads, not only the files still attached to your records. A file that is part of something another person keeps, such as a card you sent them, stays for as long as they keep it. Some older uploads were stored in a way that cannot be searched by account: those your records name are deleted, and the deletion record notes where any others may be.

To ask for your account to be deleted in the app, go to Settings, Privacy choices, Delete your account. If you do not have the app, use celecom.net/account-deletion or write to us. We aim to complete a verified deletion request within 30 days, and your account stays available while the request is pending. When an account is deleted, blocks it made or received are removed. The record of the residence and age confirmation given when joining is kept with the account's admission record, and any decision about eligibility for a feature involving money is kept as a financial record.

Australian users may complain to the Office of the Australian Information Commissioner after first giving us a reasonable opportunity to respond. New Zealand users may complain to the Office of the Privacy Commissioner. Other users may contact their local supervisory authority.

11. Children and managed profiles

Celecom supports profiles managed by an adult for a child, pet or other person. A managed profile is not automatically an account for the person it describes. The manager must have authority to provide the information and must use appropriate privacy settings.

You must be at least the minimum age for the country where you live to create a Celecom account: 16 in Australia and 13 elsewhere. Celecom is not open in every country. When you join, you tell us your country and choose an age group: under 18, or 18 or over. This is your own declaration; we do not ask for proof of age or a date of birth. To suggest your country on the joining screen, we read the country your connection appears to come from and your device's language list; we do not store either, and you confirm or change the country yourself. A person below the minimum age for their country must not create an account.

An account that declares an age under 18 starts private. A stranger sees only the name, username and photo, not the biography, website or counts, and search shows the same short card. A person under 18 cannot load credit or move money, and does not see adult-only gift brands. Blocking works in both directions.

An adult may create and manage a profile about a child only where the adult is their parent, legal guardian or is otherwise authorised to do so. A managed profile is not an account and must use privacy settings appropriate for the person concerned.

You can add a photo of a person you keep as a profile. Like any other photo you add, it is shown to whoever can see the occasion, card or profile it belongs to: everyone if the occasion is public, your followers, or only you, as you choose. We remove location and camera details from the photo before it is stored. We do not check the age of the person in a photo. Before a photo that others will see is saved, you confirm that you have the right to share it and, if it shows someone under 18, that you are their parent or guardian or have their permission, and that you understand who will see it. We keep a record of that confirmation with the photo, with the time and the wording you saw. Public content can be copied, saved or reshared by other people, and we cannot retrieve copies once they are made.

Only add a photo of another person where you have the right to share it. If you think a photo of you or your child has been added without that right, report it in the app or write to hello@celecom.net and we will review it promptly and remove it where it should not be shown.

If you block somebody, we record the block to stop new account-based follows, cards, invitations, discovery, reactions, and contributions to each other's shared envelopes. A card addressed by email may still be sent as ordinary email without appearing in the recipient's in-app post. Blocking does not delete cards already delivered or recall copies already downloaded. We will not use children's information for behavioural advertising. If we learn that an account is held by a person below the minimum age for their country, we may restrict or close it.

12. Email and notifications

We send account and service messages necessary to provide Celecom. A sender can also ask us to deliver a parcel to a recipient. We do not treat a sender's address book or a one-off delivery address as permission for unrelated marketing.

Where a non-member chooses occasion reminders, we store the exact wording they accepted, the occasion, time and withdrawal state. Each consent applies only to that occasion. Eligible messages contain sender identification and an unsubscribe method as required by law.

13. Changes to this policy

We may update this policy as Celecom changes or laws evolve. Administrative, clarifying or other non-material changes may take effect when the updated policy and effective date are posted, without individual notice. If a change materially affects how we use personal information or a person's rights, we will provide reasonable notice and seek consent where required by law. A new policy does not remove rights that have already accrued.

14. Contact us

Privacy Officer, CELECOM LIMITED

Company number 9349712, NZBN 9429052914676

Celecom, Flat 2, 11a Arcadia Road, Epsom, Auckland 1023, New Zealand

hello@celecom.net

Please include enough information for us to identify the account or record and explain what you are requesting. Do not send account passwords or a parcel's secret answer by email.