Privacy Policy

This Privacy Policy explains how Lemon Tree ("we", "us", "our") collects, uses, shares and protects your personal information when you use our website and apps (the "Service"). Lemon Tree is based in New Zealand and follows the New Zealand Privacy Act 2020. Where other privacy laws apply to you, such as the Australian Privacy Act 1988 or the EU and UK GDPR, we follow them too.

1. Information we collect

Information you give us

• Account. When you sign in with Google or Apple, we receive your name, email address and, if you have one, your profile photo. We do not receive or store your password. You can change your name in your profile.
• Stalls you run. If you add or claim a stall, we collect what you provide, including the stall name, address, location, photos, products, prices, opening details and seller name.
• Proof you run a stall. When you claim a stall, or answer someone else's claim on yours, you take a photo of a code you have written down and put at the stall. We collect the photo, when it was taken, how far your phone was from the stall's pin and how accurate that reading was, the code we gave you, and any note you add. We keep the distance, never the coordinates.
• What you share. Stalls you tag, Updates, photos, reviews and ratings, comments, and reactions.
• Your choices. The stalls you follow, your notification settings and your language.
• Messages. What you send us through the contact form or in a report, including your email address so we can reply.
• Subscription. If you subscribe as a seller, the App Store or Google Play tells us whether your subscription is active and when it renews or ends. We never receive your payment details.
• Launch notifications. If you ask to be told when Lemon Tree launches, your email address and whether you have a stall or want to find stalls.

Information about other people

When someone tags a stall, they may share details about a stall that a seller runs from their home, such as its location and photos. If this is your stall, you can claim it in the app to manage it, or contact us to have it corrected or removed.

Information we collect automatically

• Location. If you allow it, your device's location is used to show stalls near you. You can say no and search by suburb or town instead. We don't keep your device's location.
• Your area. If you choose to hear about new stalls near you, we keep the area you choose: a place, or wherever your phone is, rounded to about a kilometre, and how far from it to look. If you choose wherever your phone is, the app sends us its location, rounded the same way, from time to time. We may suggest a town from your IP address, but we only keep an area once you save it. Your area is never shown to other people.
• Devices. An ID for each app install or browser you use, the token needed to send it notifications, the platform and app version, and when it was last used.
• Signing in. The IP address and the browser or device type of each signed-in session, so we can keep your account secure and show you where you are signed in.
• Usage and diagnostics. The pages and features you use, an approximate location from your IP address, error reports, and similar technical information.
• Cookies and local storage. See section 7.

2. How we use your information

• To run the Service: signing you in, showing stalls near you, publishing stalls, Updates and reviews, and letting you follow stalls;
• to send the notifications and emails you ask for, such as Updates from stalls you follow, news of stalls near you, and service messages;
• to manage seller subscriptions;
• to keep the Service trustworthy and safe: checking stalls and content, and preventing fraud, spam and abuse;
• to understand how the Service is used and to improve it; and
• to meet legal obligations and respond to lawful requests.

We use automated tools, including AI models, to check reviews and comments for harmful content and to help us assess new stalls, such as spotting duplicates. These tools flag things for us to look at. A person decides whether to remove content or reject a stall.

When you send proof that you run a stall, an automated provider checks the photo: whether the code can be read, whether it is on a roadside or farm-gate stall, whether it looks like the stall's own photos, and whether it looks like a photo of a screen or edited. It only gives a suggestion. An admin looks at the photo and decides whether to approve the claim, ask for another photo or turn it down.

We do not sell your personal information and we do not use it for third-party advertising.

3. Legal bases (EEA and UK)

If the GDPR applies to you, we rely on:

• contract, to provide the Service and seller subscriptions you sign up for;
• legitimate interests, to keep the Service safe, prevent abuse, and understand and improve it;
• consent, for device location, your area, notifications and analytics cookies, which you can withdraw at any time; and
• legal obligation, where the law requires us to keep or share information.

4. Who can see or receive your information

• Everyone using Lemon Tree. Stalls and their details are public. Reviews, comments and Updates appear with the name on your profile. Please do not include personal details you want to keep private.
• Lemon Tree admins only, for proof photos. Proof photos and the distance from the stall are seen only by Lemon Tree admins. They are not shown to other people.
• Service providers. Companies that help us run the Service, under agreements that limit how they can use your information. They provide hosting, storage and content delivery; security and bot protection; maps and place search; notifications and email delivery; subscription management; analytics and error reporting; and automated content checks.
• Your sign-in provider and app store. Google or Apple when you sign in, and the App Store or Google Play when you subscribe.
• For legal reasons. Where we reasonably believe it is necessary to comply with the law, enforce our Terms of Use, or protect the rights, safety or property of people or the public.
• Business transfers. If Lemon Tree is involved in a merger, acquisition or sale of assets, your information may be transferred as part of it, and this policy will continue to apply.

Maps in the Service are provided by Google Maps, so Google's Privacy Policy also applies when you use them.

5. Where your information is stored

Some of our service providers are based outside New Zealand, so your information may be stored or processed in other countries, including the United States and the European Union. When we send information overseas, we take reasonable steps to make sure it is protected in a way comparable to New Zealand law, including through contracts with our providers.

6. How long we keep information

• Your account. While you have it. When you delete your account, we delete your profile, sign-in, devices, follows, notifications, reviews, comments and Updates. Stalls you ran and tags you added stay on the map so others can still find them, but they are no longer linked to you.
• Your area. Until you turn off alerts about stalls near you, change it, or delete your account. If it follows your phone, its location is replaced each time the app sends it.
• Proof photos. Deleted 90 days after we decide the claim, together with the distance and the other details collected with them.
• Stalls you delete. Removed from public view straight away.
• Launch-notification emails. Deleted once we no longer need them for that notification.
• Everything else. Only as long as we need it for the purposes in this policy. Backups and records we must keep by law are deleted on their normal schedule.

7. Cookies and analytics

We keep what we store on your device to a minimum.

• Essential. A cookie that keeps you signed in, the language you choose, an ID for this browser so you can see where your account is signed in, bot protection, and local storage for things you ask us to remember, such as the area you last looked at, the stalls you follow and a review you have not finished. The Service needs these to work, so they do not ask for consent.
• Counting stall visits. A random ID in local storage lets a seller's stall insights count each visitor once a day. It does not identify you, is not used for advertising and is never shared.
• Page counts. We count page views without cookies or anything that identifies you.
• Error reports. When something breaks or runs slowly, a report is sent so we can fix it. It does not use cookies.
• Product analytics. A cookie and local storage that recognise a returning browser, so we can see how features are used.

If you are in the European Economic Area, the United Kingdom or Switzerland, product analytics store nothing on your device unless you accept analytics cookies. If you decline, we still count your visit, but without cookies or local storage. You can change your answer at any time from Cookie settings at the bottom of every page. Elsewhere, analytics cookies are on by default, and you can block them in your browser settings.

The mobile app uses the same kinds of product analytics and error reports, linked to an ID for your app install. Blocking essential cookies may stop parts of the Service from working.

8. Your privacy rights

Depending on where you live, you can:

• access the personal information we hold about you;
• correct information that is wrong or out of date;
• delete your account and your personal information;
• object to or restrict some uses of your information, and get a copy of it in a portable format, where those rights apply to you (for example, under the GDPR); and
• withdraw consent, for example by turning off location, alerts about stalls near you, notifications or analytics cookies.

You can change much of your information, and delete your account, in the app. For anything else, contact us using the details below. We may need to confirm who you are first, and we will respond within the time the law requires.

9. Keeping information secure

We take reasonable steps to protect personal information against loss, misuse and unauthorised access, including encryption in transit and limits on who can access it. No online service can be completely secure, so we cannot guarantee absolute security. If a privacy breach is likely to cause you serious harm, we will tell you and the relevant privacy regulator.

10. Children

You must be at least 16 to use Lemon Tree, and people under 18 need the permission of a parent or guardian. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make a material change, we will let you know in the app or by email before it takes effect, and update the date above.

12. Contact us

If you have any questions, requests or complaints about your privacy, use our contact form. If you are not happy with our response, you can complain to your privacy regulator: in New Zealand, the Office of the Privacy Commissioner; in Australia, the Office of the Australian Information Commissioner; or in the EU or UK, your national data protection authority.