Privacy policy

Last updated 29 September 2026

HereFlick makes and publishes social posts for local businesses. It is run by Think and Form Limited, a New Zealand company ("we", "us"). This page explains what we collect to do that, why, who helps us, and how you can see, fix or delete it. We follow the New Zealand Privacy Act 2020.

What we collect

Your login details: your name, email address and, if you give it to us, your mobile number. We use them to send login links, approval requests and reminders.
Your business details: business name, services, brand colours, logos, and the photos and notes you send us for posts.
The posts we make: captions, images and videos, what you approved, and when and where they were published.
Connected accounts: when you connect Google Business Profile, Facebook or Instagram, we store access tokens and the IDs of the profile, page or account you chose. Tokens are stored encrypted.
Pilot enquiries: the name, business, email, phone number and message you send us through our website.
Basic technical logs: such as sign-in times and errors, so we can keep the service working and secure.

How we use it

To suggest topics and make captions, images and short videos for your business.
To ask for your approval and, only after you approve, publish posts to the accounts you connected.
To tell you whether a post went live, and to fix problems when it didn't.
To show you what your posts and profile achieved, and to suggest what to do next.
To reply to your enquiries and run the pilot with you.

We don't sell your information, and we don't use it to advertise to you. We never publish anything without your approval.

Google, Facebook and Instagram

We use the access you grant to list the profiles, pages and accounts you can publish to, publish posts you have approved, and check that they went live. As we add features to HereFlick, and only for the accounts you have connected, we also read:

Your Google Business Profile: how many people called, asked for directions or visited your website from your profile, the searches that showed it, its opening hours and map position, and your customers' reviews and your replies to them.
Your Facebook Page and Instagram account: how many people saw and reacted to the posts we published for you, and the results of any boost you run on them.

We don't read your private messages, and we don't read your followers' details. We use what we read only to show you your results, to suggest what to post next and to draft replies for you to approve. Nothing is sent, posted or replied to under your name without your approval.

Results, tracking and other businesses

Short links and codes: links in your posts may go through a HereFlick short link so we can count how many times they are opened. We count the visit and the device type (phone or computer). We don't keep the visitor's IP address and we don't set a cookie.
Public information about other businesses: to show where your business appears on Google Maps and how it compares with businesses nearby, we collect public information such as a business's name, Google rating, number of reviews, position in Google Maps results, and public Instagram counts. This comes from public sources and from providers who collect Google's public results, so it is close to, not exactly, what a person would see. It is shown only to you and never used to write your posts.
What AI assistants say about you: we ask AI assistants such as ChatGPT, Gemini, Claude and Perplexity questions about businesses like yours, and keep their answers, to show you whether and how your business is described. The questions include your business name, suburb and services.
Combined results: we may combine results from many businesses without names, to compare businesses of the same kind. We never show one business's results to another.

HereFlick's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who helps us

We use these providers to run HereFlick. They only get what they need to do their part:

Vercel: hosting, and storage for your photos and the posts we make.
Neon: our database.
Resend: email.
Twilio: text messages.
AI providers, including fal.ai and models reached through the Vercel AI Gateway: writing captions and making images and videos from your photos and notes.
Google and Meta: publishing the posts you approve, and the results and reviews described above.
Data providers and AI assistants: collecting public Google Maps results and asking the questions described above.

Some of these providers store or process information outside New Zealand, including in the United States. We choose providers that protect it in ways comparable to the Privacy Act.

How long we keep it

We keep your information while you use HereFlick, including the results, reviews and public information about other businesses we collect for you. When you leave, or ask us to, we delete it as described below, except for records we must keep by law, such as invoices.

Disconnecting accounts and deleting your data

Disconnect an account: email admin@thinkandform.co.nz and we delete the stored tokens straight away. You can also remove HereFlick's access yourself at any time from your Google Account or Facebook settings.
Delete everything: email admin@thinkandform.co.nz from the email address on your HereFlick login. We'll confirm it's you, then delete your business, posts, photos, connected accounts and login within 30 days and tell you when it's done.

Deleting your data from HereFlick doesn't remove posts already published on Google, Facebook or Instagram. You can delete those on each platform.

Seeing and correcting your information

You can ask for a copy of the personal information we hold about you and ask us to correct it. Email us at admin@thinkandform.co.nz. If you're not happy with how we handle your information, you can complain to the Office of the Privacy Commissioner.

Changes to this policy

If we change this policy in a way that matters, we'll tell you by email before the change takes effect.