Privacy policy

Who we are

GRID EATER is a product of America First Limited, a New Zealand company. For this privacy policy, GRID EATER means the GRID EATER website, directory and related services operated by America First Limited.

America First Limited is the agency responsible for personal information handled through GRID EATER. A privacy officer is available through hello@grideater.com using the subject Privacy Request.

What we collect directly

We may collect personal information when you contact us, request a directory edit, ask for a quote, buy or use a service, communicate with support, or provide information needed to verify a request. This can include your name, contact details, business role, correspondence, service requirements, billing-related records and evidence supplied with a request.

We aim to collect information that is reasonably necessary for the relevant purpose and to avoid collecting sensitive information that we do not need.

Public and indirectly collected information

The business directory may use information from approved public records, official data sources, business websites, other public business material, and information supplied by businesses or authorised representatives. Some business information can also be personal information, particularly for sole traders or businesses closely connected to an identifiable individual.

New Zealand's Privacy Act 2020 includes Information Privacy Principle 3A, in force from 1 May 2026, for personal information collected from someone other than the individual concerned. Where IPP 3A requires notification and no exception applies, we will take reasonable steps to ensure the individual is made aware of the collection and the matters the Act requires.

Why we use information

We use personal information to provide and support services, respond to enquiries, maintain and correct directory information, verify authority, manage accounts and billing, prevent abuse, secure systems, improve data quality, operate analytics, keep appropriate audit records and meet legal obligations.

We do not sell personal information to advertisers.

Directory publishing and automated assistance

The public directory is designed to publish reviewed business information rather than raw source material or private operational data. Public-data gates and review processes are used to reduce inappropriate publication.

We may use automation and AI-assisted tools to organise requests, research public information, identify potential data-quality issues, assist with content and detect abuse. Material directory changes remain subject to controlled publishing rules; automated tools do not give a requester direct control of a listing.

Analytics, logs and cookies

GRID EATER uses ordinary technical logs and security information needed to deliver and protect the service. We also use Google Analytics 4 to understand aggregate website use and improve pages and navigation.

More detail is available in our Cookie notice. Browser, device, network and request information may also be processed by hosting, security and analytics providers as part of delivering their services.

Service providers and overseas processing

We use third-party technology providers for functions such as hosting, security, analytics, email, development and AI-assisted processing. Depending on the service, information may be processed or stored in New Zealand or overseas.

Where a disclosure of personal information outside New Zealand is made and Information Privacy Principle 12 applies, we will use the safeguards required by the Privacy Act, such as reasonable grounds for comparable protection, appropriate contractual safeguards, or informed authorisation where permitted and required.

Security, retention and privacy breaches

We use reasonable technical and organisational safeguards appropriate to the information and service, including access controls and infrastructure security measures. No internet service can promise absolute security.

We retain personal information only for as long as reasonably required for the purpose for which it was collected, service delivery, security, legal obligations, dispute handling, audit needs or correction-history integrity.

If a privacy breach is likely to cause serious harm, we will assess and notify the Office of the Privacy Commissioner and affected individuals as required by the Privacy Act 2020, subject to any lawful exception.

Access, correction and complaints

You may ask whether America First Limited holds personal information about you and request access to or correction of that information, subject to the Privacy Act 2020. Email hello@grideater.com with the subject Privacy Request and enough information to identify the relevant record.

We may ask for reasonable evidence of identity or authority before providing or changing personal information. If you are dissatisfied with how a privacy matter is handled, you can also contact the New Zealand Office of the Privacy Commissioner.