Client Care
Privacy Policy
You are trusting us with details about your body, your wedding and your payment. This page explains, in plain language, what we collect, why, who else sees it, and how to have it removed.
Last updated: 1 August 2026
The short version
- credit_card_offWe never see your card number. Payments are handled entirely by Stripe.
- sellWe never sell your information or hand it to anyone for their own marketing.
- inventory_2We collect what an order needs — name, email, phone, delivery address — and little else.
- deleteAsk and we'll show you or delete it. One email is all it takes.
Who we are
FOUNDATION by Sarah Stoute ("FOUNDATION", "we", "us") is a New Zealand business based in Christchurch, trading at foundationbysarahstoute.com. We are the agency responsible for the personal information described here, and we handle it in accordance with the New Zealand Privacy Act 2020 and its information privacy principles.
This policy covers this website only. Sarah Stoute Bespoke, our sister couture business at sarahstoutebespoke.com, is a separate business with its own privacy practices.
What we collect, and when
We only collect information you give us, or that your browser sends automatically. We never ask for information we don't need.
| When you… | We collect | Why |
|---|---|---|
| Place an order | Name, email address, phone number, delivery address, the items and sizes you bought, and the amount paid | To take payment, pack and send your parcel, email your confirmation and tracking, and handle any problem afterwards |
| Join the mailing list | Email address, first name if you give one, and which part of the site you signed up from | To send occasional news about the collection. You can unsubscribe at any time |
| RSVP to an event | Name, email, mobile number, number of guests and any message you add | To confirm your place, manage numbers on the night, and contact you if plans change |
| Use the Stylist Board | Your dress selections and the styles recommended to you, against a random session number — no name or contact details | To show you your recommendations, and to understand which dress shapes brides are asking about |
| Email the concierge | Whatever you choose to tell us, including any fit or measurement details you share | To answer you properly |
| Simply browse | Pages viewed, approximate location, device and browser type, and how you arrived — collected by Google Analytics using cookies | To see which pages are useful and improve the site. This is reported to us as aggregate numbers, not as individuals |
Payment information
Card numbers never touch our website or our servers. When you check out you are taken to a secure payment page hosted by Stripe, a PCI-DSS certified payment provider, and your card details are entered there. Stripe tells us only that the payment succeeded, along with the name, email, phone and delivery address you entered so that we can send your order.
Who else sees your information
We share the minimum necessary with a small number of service providers who help us run the shop. They may only use it to provide their service to us — never for their own purposes. We do not sell, rent or trade your personal information.
- ·Stripe — payment processing and fraud prevention.
- ·Starshipit and NZ Post — your name, delivery address, email and phone are passed to our fulfilment system and courier so your parcel can be labelled, tracked and delivered.
- ·Resend — sends your order confirmation, shipping and RSVP emails on our behalf.
- ·Google — Firebase and Google Cloud host the site and store order records; Google Analytics and Google Ads measure site traffic and advertising performance.
We may also disclose information where the law requires it, or where it is necessary to protect our rights or someone's safety.
Where it is stored
Your order records are held in Google Cloud infrastructure, on servers located in Australia. Some of our providers — Stripe, Resend and Google — are based overseas and may process information in other countries. Before sharing information with any provider outside New Zealand we satisfy ourselves that they are subject to comparable privacy safeguards, as required by principle 12 of the Privacy Act 2020.
Cookies and analytics
This site uses a small number of cookies. Some are essential — they remember what is in your cart between pages. The rest are set by Google Analytics and Google Ads, and tell us how many people visited a page, which links they followed, and whether an advertisement led to an order.
You can block or delete cookies in your browser settings at any time; the shop will still work, though your cart may not persist. To opt out of Google Analytics specifically, Google publishes a browser add-on at tools.google.com/dlpage/gaoptout.
Marketing emails
We only add you to our mailing list if you ask to join it. Buying something does not sign you up. Every marketing email carries an unsubscribe link, and you can also email us to be removed — we will action it promptly. Transactional emails about an order you have placed (confirmation, dispatch, tracking) are not marketing and will still be sent.
How long we keep it
Order and payment records are kept for seven years, as New Zealand tax law requires. Mailing list entries are kept until you unsubscribe. Event RSVPs are removed once the event has passed and any follow-up is complete. Anonymous Stylist Board and analytics data is retained in aggregate. Emails to the concierge are kept while they are still useful for looking after you.
Your rights
Under the Privacy Act 2020 you may ask us for a copy of the personal information we hold about you, and ask us to correct anything that is wrong. Email foundationss@gmail.com and we will respond within 20 working days. There is no charge.
You can also ask us to delete your information. We will do so unless we are legally required to keep it — order and payment records within the seven-year tax retention period are the usual exception.
Keeping it safe
The site is served entirely over HTTPS. Order records are stored in a database that is not readable from the public internet, and the administration console is restricted to authorised FOUNDATION staff. Credentials for our payment, email and courier providers are held in an encrypted secret store, not in our code. No system is perfect, but if a breach ever caused you serious harm we would notify you and the Office of the Privacy Commissioner, as the Act requires.
Children
Our products and this website are intended for adults. We do not knowingly collect information from anyone under 16. If you believe a child has given us their details, contact us and we will delete them.
Changes to this policy
If we change how we handle your information we will update this page and move the date at the top. Material changes will be signalled clearly rather than made quietly.
Contact and complaints
Any question about privacy, or a request to see or delete your information, goes to the same place:
Email foundationss@gmail.com
FOUNDATION by Sarah Stoute, Christchurch, New Zealand
If you are not satisfied with how we have handled a privacy matter, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.
Contact the concierge