This statement explains what Themescape collects about you, why we collect it, where it is kept, who can see it, and how you can see, correct or delete it. It covers the Themescape website at themescape.co.nz and the Themescape app at app.themescape.co.nz.
Themescape is run by Themescape Limited, a New Zealand company, number 9459933, with its registered office at 168 Hawthornden Road, Avonhead, Christchurch 8042. We follow the Privacy Act 2020 and its information privacy principles. Our privacy officer is Charlotte Price, and you can reach her about anything in this statement at privacy@themescape.co.nz.
Your research data
Themescape is built so that your research data never reaches us. When you open your files in Start a project, or import a project from your coding software such as NVivo, your web browser reads them on your own computer. Your quotes, codes, themes, definitions and notes are not uploaded to Themescape, and we do not store your projects. When you save your progress, the files, including any layout file that holds your arrangements and figures, are downloaded to your own computer. Your research data therefore stays in the storage you have chosen and your ethics approval describes.
Settings kept in your browser
The app keeps a few settings in your browser so that it behaves the same way next time:
- your viewer preferences
- how you have set out the side panels
- which tips you have already seen
- a random code that identifies the browser for the sign in alerts described below
If you ticked Keep me logged in on this device, the browser also keeps you signed in until you log out; otherwise you are signed out when you close the tab. None of this includes your research data, and apart from the browser code, none of it leaves that browser. The tick box in Log out & exit, which is ticked unless you untick it, clears these settings, so please log out with it ticked when you finish on a shared computer.
The coding template
The coding template can be downloaded from the app as a spreadsheet, or copied into your own Google Drive from a link in the app. A copy in your Google Drive belongs to your Google account, and Themescape cannot see it.
The one exception: connecting a Google Sheet
The rule that your data never leaves your computer has a single exception, which happens only if you choose it. You can connect a Google Sheet instead of loading files. The sheet must then be shared so that anyone with its link can view it, and your browser reads it directly from Google, once, when you press Connect. Anyone who obtains the link can open the sheet, and Google handles it under its own privacy policy. Please use this option only for data that is not confidential, such as a teaching example or synthetic data, and set the sheet's sharing back to Restricted once your map is open. Do not use it for participant data, identifiable data, or any data that your ethics approval requires you to keep private.
Information we hold about you
Your account
When you create an account, we collect:
- your first and last name
- your email address
- your university or organisation
- your role
We also record whether you would like occasional updates from us, and that you were shown this statement, with its version and the date.
Signing in
You can sign in with an email address and password, or with your Google or Microsoft account. Passwords are handled by Google's Firebase Authentication service and are stored only in a scrambled form that no one at Themescape can read. If you sign in with Google or Microsoft, that company confirms who you are and shares your name and email address with us. Google may also share a link to your profile picture, which Themescape does not use. We never receive your Google or Microsoft password, and we cannot see anything else in those accounts.
The student check
If you choose the Student plan, we confirm that you study at a university. When your login email is a university address, that address is enough. Otherwise we send a 6 digit code to a university email address you give us, and once you enter the code we keep that address and the date you confirmed it.
Your profile photo
You can add a profile photo on the Account page if you wish. Your browser crops it to a square and shrinks it to 160 pixels before sending it, so we never receive the original. We keep this small copy with your account and show it on your account button and your Account page. You can remove it at any time on the Profile tab, and it is deleted when you do.
The Getting started checklist
Your Account page shows a Getting started checklist. To tick its steps, the viewer tells us when you first open the sample dataset, load your own data and export a figure. We record only yes or no for each of these steps, never anything about your project, and you can hide the checklist on your Account page.
Linking your account to a university
The Profile tab lets you link your account to a university only if your login email belongs to it. To check this, our server compares the part of your email address after the @ with a public list of universities and their email domains, published on GitHub under an open licence, which we refresh on the 1st of each month and add to when a university is missing. Only the domain of your address is compared. We do not contact your university, and the check tells no one that you use Themescape.
Sign in alerts
Each time you log in, your browser sends us the random code it created for itself. We store a scrambled version of the codes for up to 20 browsers per account. When a browser we have not seen before signs in to your account, we email you the time, the type of browser and the operating system, so that you can act if it was not you. We do not record your location.
Records that limit misuse
We keep 2 further records to limit misuse. When you change your login email, we keep your previous address with your account, so that the change can be undone if it was not you. When someone asks for a password reset, we keep a scrambled form of the address entered and a count of requests for 30 days, so that reset emails cannot be sent too often. We also record whether you have hidden the getting started checklist on your Account page.
Payments, teams and organisations
Payments
Payments are handled by Stripe. When you start a plan, Stripe's checkout page collects your card details, your billing address and, if you give one, your tax number, and Stripe uses your address to work out the GST or other tax that applies. We never see or store your full card number, though Stripe gives us its last 4 digits and its expiry date, which appear in our receipts and payment reminders. We keep a link between your account and your Stripe customer record so that we can tell whether your plan is active, and Stripe tells us about each payment, such as its amount, its date and whether it went through. You manage your plan and your card in Stripe's billing pages, which open from Manage billing on your Account page.
Teams
If you buy places for a team or an organisation, we keep its name and the email addresses of the people you give places to, and each person's name once they join. When you add someone, we email them an invitation that names you and the team, gives your email address for replies, and links to this statement. Please add only people who expect to hear from us about Themescape. As the buyer, you can see each person's name, their email address and whether they have joined.
Organisation quotes and licences
If you ask for a quote for an organisation, we keep the organisation's name, the numbers of staff and student places, the billing period, any purchase order number, and the email address of the billing contact you name. Your request goes by email to our billing team, and the quote is issued as a Stripe invoice to that billing contact. Once the licence is paid, the person who asked for the quote becomes its administrator. The administrator can invite people, see their names, email addresses and whether they have joined, and see the licence details, including its end date and renewal invoices. Some organisation licences cover everyone with an email address at the organisation's domain, and for those we check your login email against that domain.
Activation codes
If you join with an activation code, we record which account used the code and when. To stop codes being guessed, we also count wrong attempts for each account over a day.
Emails and messages
Emails about your account
We send emails that are part of running your account, such as email confirmations, password resets, invitations, receipts, trial and renewal reminders, security alerts and replies to your messages. They come from addresses at themescape.co.nz and are sent through Resend, an email delivery service, which receives your email address and the content of each message. We have switched off Resend's open and click tracking, so we do not know whether you open an email or follow a link in it. Stripe may also send you payment emails of its own.
Updates from us
We send occasional news and guidance about Themescape only if you ticked the box to receive updates. You can change your answer at any time on the Profile tab, and every update email has an unsubscribe link that takes effect straight away.
Messages you send from the app
When you use Request a feature or Report an error in the app, we receive your message, your name and email address, and the type of browser and operating system you are using. Report an error also adds technical details: the last error the app recorded, the page address, the view and mode you were in, and your browser's version information. These details are shown to you before you send them. An error message can occasionally include the name of a theme or code, so please check the details first, and do not paste quotes or other participant material into a message. Messages reach our support inbox, and we email you to confirm that we have it. Emails you send to hello@themescape.co.nz, billing@themescape.co.nz, support@themescape.co.nz or privacy@themescape.co.nz reach the same team through Google Workspace.
Forms on the website
The website at themescape.co.nz has forms for contacting us, joining the launch list and signing up for our newsletter. When you use one, we collect your name, your email address and anything you write, and keep them in a Notion database that our team works from. We send newsletter and launch list emails through Resend only to people who asked for them, and each one has an unsubscribe link.
Cookies and analytics
The website counts visits with Cloudflare Web Analytics, which uses no cookies or browser storage and does not fingerprint visitors. It records the pages viewed, the sites that sent visitors, the country each visit came from, and the type of browser and device. The Cookie policy lists everything the website and the app keep in your browser.
The website also uses Google Analytics, with your agreement, to count visits and see which pages people read. It loads only after you accept analytics in the cookie notice. Google Analytics then sets cookies in your browser and records:
- the pages you view
- what you do on them, such as the links and buttons you click, the videos you play and when you send a form, though never what you type in it
- how you reached the site
- your device and browser
- your approximate location, which Google works out from your IP address
Google does not store the IP addresses of visitors from the European Union, Switzerland or the United Kingdom. You can change your choice at any time through the cookie notice, and we keep analytics data for no more than 14 months.
How we use your information
We use this information:
- to create and protect your account
- to check that your plan is active each time you open the app
- to take payment and manage your plan
- to let team buyers and licence administrators give places to the right people
- to send the emails described above
- to answer your questions
- to see how the website is used
We use your role and organisation to understand who uses Themescape and to offer suitable plans, such as student pricing. We do not sell your information or use it for advertising, and the app uses no advertising, analytics or tracking tools.
What is optional
Your name, email address, organisation and role are needed to create an account, and without them we cannot give you access. A profile photo and the updates box are optional, and leaving them out does not change what you can do in Themescape.
Who else is involved and where information is kept
We use a small number of service providers to run Themescape, and some of them keep information outside New Zealand.
Google runs most of the service. Your account details, profile photo, team places, licence records and quote requests are kept in Google Cloud Firestore in Sydney, Australia, and the app reaches them only through our own server functions, which also run in Sydney. Sign in is handled by Google's Firebase Authentication, which runs only in the United States and keeps the email addresses, scrambled passwords, browser details and IP addresses it needs to sign people in and prevent abuse. Google serves the app from its worldwide network and keeps technical logs, such as each visitor's IP address, for periods of a few weeks to a few months. Each page of the app also loads its sign in code from Google's servers, so Google receives your IP address and browser details when you open it. Our team email runs on Google Workspace. Google's privacy policy is at policies.google.com/privacy.
Stripe
Stripe processes payments. Our contract is with Stripe New Zealand Limited, and Stripe stores payment information in the United States. Stripe processes this information for us, and also uses some of it for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy.
Resend, Cloudflare, Microsoft, Notion and Xero
Resend sends our emails. Themescape's emails leave from Resend's servers in Tokyo, but Resend stores email addresses, message content and delivery records in the United States (Resend privacy policy). The Themescape website at themescape.co.nz is hosted by Cloudflare, which records each visitor's IP address in its logs to deliver the site and protect it from attacks, and which stores data mainly in the United States and Europe (Cloudflare privacy policy). If you sign in with Microsoft, Microsoft handles that sign in under its own privacy statement and shares your name and email address with us. Entries from the website's forms are kept in Notion, which stores data in the United States (Notion privacy policy), and Google runs the website's analytics when you allow it. Our accountant receives billing records through Stripe and through Xero, our accounting software, which uses hosting providers based in the United States (Xero privacy notice).
Our responsibility
Google, Resend, Cloudflare, Notion and Xero act on our instructions and may not use your information for their own purposes. Each is bound by data protection terms that require it to protect personal information, and we remain responsible for that information under New Zealand law. Apart from these providers and our accountant, we share your information only where the law requires us to.
Security and privacy breaches
We protect account information by limiting who and what can reach it. Account records are held in a database that web browsers cannot open directly. The app reaches it only through Themescape's own server functions, which first check who is signed in. The keys that connect Themescape to Stripe and Resend are held in Google Secret Manager, outside our code. Every page and connection uses encrypted HTTPS. Only the Themescape team can see account records, and only when we need to in order to run the service or help you. Themescape Limited is owned by Integration Lab Limited, and our team uses Integration Lab accounts to run the service.
If a privacy breach happens that is likely to cause serious harm, we will tell the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act requires.
How long we keep your information
We keep your account details while you have an account. If your account has no active plan, team place or licence, we delete it 12 months after the later of your last log in and the end of your last membership, which lets you come back within that time without starting again. This includes accounts that never started a plan. We email you 30 days before the date, and logging in before then keeps your account.
Other records follow these rules:
- a team's places are deleted 12 months after its plan ends
- an organisation licence's records are deleted 12 months after the licence ends
- quote requests are deleted 12 months after their last change, unless the licence they led to is still on record
- messages in our email inboxes, and contact messages sent through the website, are deleted 12 months after the conversation ends
- newsletter and launch list entries are kept until you unsubscribe
When you delete your account yourself, the 7 day wait described below applies instead. After it, we delete your account record and your login, remove you from any team or organisation licence and from any quote you asked for, and ask Stripe to delete your customer record. Firebase Authentication removes deleted logins from its backups within 180 days. A profile photo you remove is deleted straight away.
Billing records, such as invoices and payment records, are kept for 7 years, because New Zealand tax law requires businesses to keep their records for at least that long. Stripe keeps its own payment records for at least 5 years to meet its legal obligations. Our providers' technical logs are kept for the short periods those providers set, from a few weeks to a few months.
Your rights
Seeing and correcting your information
You can ask to see the personal information we hold about you and ask us to correct it, and you can do much of this yourself. The Profile tab shows your details and lets you change them. Your data, on the Account page, downloads a file of your main account details, and you can email us for a complete copy of everything we hold about you. If you sign in with an email address and password, you can change your login email on the Account page, and we confirm the change with both your old and your new address.
Deleting your account
You can delete your account from Your data on the Account page. Your login is switched off straight away, and the account is deleted 7 days later, with a link in our email that lets you keep it until then. A free trial ends as soon as you ask, so you are not charged during the wait. If you are paying for a plan or manage a team, you will need to cancel it in Manage billing and wait until it ends. If you manage an organisation licence, please email us first so that we can pass it to someone else. We will help if your situation is not straightforward.
Asking us, and complaining
You can also email our privacy officer at privacy@themescape.co.nz with any request about your information. We will respond as soon as we reasonably can, and within 20 working days. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner.
If you are in the European Union or the United Kingdom
The General Data Protection Regulation, or the United Kingdom's version of it, may also apply to how we handle your information, and Themescape Limited is the controller of your account information. We rely on 4 legal bases:
- performing our contract with you covers your account, your plan, payments and service emails
- our legitimate interests cover security alerts, preventing the misuse of activation codes, the organisation check and understanding who uses Themescape
- your consent covers update emails, the newsletter, the launch list and website analytics, and you can withdraw it at any time
- our legal obligations cover keeping billing records
You also have the right to object to processing based on our legitimate interests, to ask us to restrict processing, and to receive your information in a portable form, such as the Your data download. You can complain to the data protection authority where you live or work. The European Commission and the United Kingdom both recognise New Zealand as providing an adequate level of protection for personal data.
Children
Themescape is designed for researchers and university students and is not intended for children under 16.
Changes to this statement
We will update this statement when Themescape changes what it collects or how it uses information, and the date at the top shows the current version. If a change is significant, we will tell members by email. We record which version of this statement each member was shown when they created their account.