Your information.

Who you’re contacting

The Graphic Lab is a trading name of Darren Kelly Motorsport Limited and provides branding, print, signage, web design and marketing services from Hampton Downs, New Zealand. Use our contact form for questions about your information.

Enquiries and customer records

The contact form requires your name, email and service interest. Your project description, reference photos and other business details are optional. Reference photos are kept in private file storage and linked to your enquiry for the team to review. Enquiry notifications mention attached photos and direct staff to the private admin inbox; the photos are not sent to the website AI assistant. Submitted enquiries are stored in our private customer database so the team can respond and keep track of your project. We record whether details came from an enquiry or a shop order.

Orders and artwork

We store the product options, quantities, artwork files, notes, name, email and delivery details you provide to prepare and fulfil orders. Artwork is kept in private file storage, with access limited to authorised staff and the signed-in customer whose account owns the file. Guest files are linked to the secure browser cart. The order dashboard also records production status and tracking references.

Customer records, orders and enquiries use the hosting platform’s Cloudflare D1 database; artwork uses private Cloudflare R2 storage. Services may process information outside New Zealand. Internal test records are kept separate from paid sales.

Customer accounts

Accounts use your email and password. We verify your email when you register, and you may choose an additional email-code check for each new sign-in. We store a salted password hash, your verified email, security preference, saved delivery profile, session identifiers and links to your orders and artwork. We do not store readable passwords. A guest order is not exposed simply because someone types the same email into a form. Signing out revokes account sessions and clears this browser’s cart access. Our transactional email service (Resend) receives your email and verification, recovery or security message for delivery. Codes expire after ten minutes; raw codes are not stored in the database. Password recovery verifies your email before allowing a new password and signs out existing sessions.

Deleting your account

Use “Delete my account” under Account settings to review the consequences and request deletion. We ask you to type DELETE, acknowledge the explanation, confirm your current password if you have one, and enter a fresh email code. The code expires after ten minutes and only works with the signed-in account and browser that requested it.

Confirmed deletion removes your account, saved profile, sign-in sessions, Google sign-in link, customer pricing settings and artwork-library access. Unused artwork saved to the account is removed from the database and private storage. If storage is temporarily unavailable, deletion is queued and retried when the team next opens its dashboard. It cannot be downloaded while that cleanup is pending. We also clear the remembered email in this browser; your browser or password manager may separately retain information you saved there.

Deleting your account does not cancel an order, erase an outstanding balance or remove records we still need to fulfil existing work, handle enquiries or meet legal obligations. Relevant order, payment and transaction records are generally retained for seven years, and artwork needed for active work or legitimate support may be retained. Those records remain restricted to authorised staff. A new account does not automatically recover the previous orders or artwork.

Lead notes linked only to your deleted account are removed when there is no order, enquiry or tracked project or task to support. Notes linked to existing work are retained for staff review alongside those business records. Account deletion withdraws promotional-email permission. We retain your email and minimal withdrawal evidence to prevent it being added back to marketing exports. We retain a limited security audit record of the deletion. Enquiries and other records supplied separately may require review; contact us if you would like those reviewed for deletion too. The store-owner account requires a secure ownership transfer before it can be deleted.

Google sign-in

When enabled, you may choose Google to create or access your account. Google sends us your verified email, basic name and a stable Google account identifier. We use these to identify your account; we do not request access to Gmail, Drive, contacts or other Google content, and do not retain Google access or refresh tokens. Existing email/password accounts require their password once before linking Google. Your existing extra email-code setting still applies. Google also handles information under its own privacy policy.

Address suggestions

Where enabled, Geoapify provides New Zealand address suggestions in the account and checkout forms. Address text entered into the lookup is sent to Geoapify to find matching addresses. You can choose to enter your address manually instead. The address you save or submit with an order becomes part of your customer or order record.

Website chat

Our website assistant provides general guidance, not a human live-chat service. AI can make mistakes; our team confirms quotes and job details. When AI replies are enabled, your messages and recent conversation context are sent to OpenAI to generate a reply. We request that responses are not stored as API application state; OpenAI may retain service and abuse-monitoring data under its own policies. Please do not send passwords, sign-in codes, payment details or sensitive personal information. The assistant cannot access customer accounts, orders or uploaded artwork.

We do not save chat transcripts in our customer database. Chat stays in page memory until you clear it, reload or leave. If you choose to carry your messages into the contact form, a temporary draft is kept in this browser tab for up to 15 minutes and removed when opened. You can also choose “Review enquiry” within chat, edit your brief and provide a name, email and optional phone number. Only the details you explicitly submit with permission to contact you become an enquiry in our private team inbox, labelled as a chat enquiry. Typed form fields are not sent to OpenAI (optional voice transcription is described below), and submitting them does not subscribe you to marketing. Short-lived hashed network identifiers and daily request counters limit misuse and AI usage.

Optional voice typing starts only when you press the microphone button and allow microphone access. A recording of up to 60 seconds is held temporarily in browser memory. When you choose Stop & transcribe (or reach the recording limit), the audio is sent securely through our server to OpenAI to convert it into text. We do not save audio in our database or file storage; OpenAI may retain service and abuse-monitoring data under its own policies. Cancelling before transcription discards the recording without uploading it. Cancelling during transcription cannot recall audio already sent to OpenAI. Closing chat or leaving the page stops recording. Review or edit the resulting text before choosing to send it. Text sent as a chat message follows the AI processing described above; text submitted in the enquiry form goes to our team. Browser and device support varies. You can always type instead.

Payments

When online payments are enabled, checkout will redirect to Stripe. Stripe handles payment details; this website does not collect or store card numbers. Our order record keeps the payment status and a Stripe transaction reference. Production is released only after payment confirmation and the necessary artwork approval.

Thank-you emails and feedback

After completed work, we may send a single thank-you email inviting an honest Google review and optional private feedback. Private feedback is stored in our restricted customer inbox and emailed to sales@thegraphiclabnz.com through Resend. It is not published, and submitting it does not subscribe you to marketing. The email includes a link to stop future review requests. We retain a hashed email suppression record to honour that preference. Feedback links remain available for 90 days; follow-up records are retained with the relevant order or enquiry under the retention periods below. Google handles public reviews under its own policies. You can choose either feedback option, both, or neither.

Optional marketing

Enquiring or ordering does not subscribe you to marketing. You may separately choose to receive occasional news, product ideas and offers. On the account registration form, the optional promotional-email box is selected by default; untick it if you do not want promotional emails. The required terms/privacy box starts unticked. We record the wording, source, form defaults, time and email verification of your registration choices. An unverified registration does not subscribe you. Existing marketing withdrawals remain in place. Authorised staff can export contacts who opted in to an email platform; no marketing email is sent automatically by this website.

You can ask us to withdraw your marketing permission through the contact form. Email campaigns will also need an unsubscribe option. A withdrawn contact is excluded from subsequent marketing exports.

Cookies and technical information

The shop uses an essential, secure cart cookie to connect your browser to your saved cart and order. It lasts up to 30 days. A separate HttpOnly customer session normally expires after 12 hours and is not given a persistent browser expiry. Selecting “Keep me signed in” allows it to last up to 30 days on that device. Signing out or changing account security revokes existing sessions. If you select “Remember my email on this device”, we store only your email address in this browser until you choose “Forget saved email” or clear browser data. This does not sign you in or store your password. Your browser or password manager may separately save sign-in details according to its own settings. Google sign-in uses a separate secure, short-lived cookie and ten-minute verification state to protect the redirect. Motion preferences may also be saved on your device. The admin area requires a verified website account belonging to the owner or a staff member the owner has explicitly authorised. Staff permission changes require the owner’s password and are recorded in the activity log.

Short-lived hashed network identifiers help limit spam and excessive requests. The site records staff changes and downloads for accountability. It does not intentionally log enquiry contents, artwork or card details in application logs.

Advertising pixels are not enabled. If you allow analytics, our website also stores aggregate daily counts of public page views and selected interactions for up to 90 days. These counts do not store visitor profiles, customer IDs, contact details, form text or browsing sessions. Short-lived hashed network rate limits protect this endpoint from excessive requests. You can decline or withdraw analytics permission at any time. When Google Analytics is configured, it loads only after you choose Allow analytics. You can decline or withdraw permission through Analytics preferences. Your preference is stored in this browser for up to 180 days. Consented measurement includes public page paths and selected interactions such as submitting an enquiry; our configured events exclude arbitrary query strings, form contents, artwork and account details. Only exact campaign labels created in our campaign planner may accompany a measured page view; customer details are not used as campaign labels. For recognised search and AI referral services, consented measurement may include the referring website origin. We remove the referring page path and query strings and omit unrecognised referring addresses from this feature. It does not identify every search or AI recommendation. Google processes analytics data under its own policies. Account, admin, cart and order pages are excluded from our page-view events. If purchase measurement is enabled, a confirmed online payment may also produce a Google Analytics purchase event after you have allowed analytics. This contains a non-identifying transaction reference, product IDs and retail values, with tax and delivery separately. It does not contain your name, email, address, artwork, custom wording or the private order-page URL. A temporary flag in this browser tab helps prevent repeated purchase events. Unpaid requests, on-account orders, test orders and orders under payment review are excluded. Analytics is not our accounting record; browser settings and consent can affect reporting. Analytics reports are separate from the transaction records we need to operate the shop. The motorsport image on the homepage is delivered by Holley’s image service, which receives a normal image request; its referring-page information is suppressed. Other portfolio images and fonts are served with this website.

Courier delivery

To calculate delivery, we send your delivery address and parcel measurements to NZ Post through its eShip service, powered by Starshipit. When a paid order is packed and ready for shipping, authorised staff can send your name, delivery address, contact details and order contents to eShip to prepare an unshipped order. Staff review and purchase courier labels separately. Courier providers process these details to deliver and track your order.

Access, corrections and retention

You may request access to your personal information, corrections or removal through the contact form. We aim to respond promptly and within applicable legal timeframes, generally 20 working days for access or correction requests. If we cannot resolve a privacy concern, you may contact the New Zealand Office of the Privacy Commissioner.

Contact us to ask about information you have supplied, request corrections, withdraw marketing permission or discuss deletion. We may need to confirm your identity. Business records may need to be retained for order fulfilment or record-keeping. Our retention policy is seven years for tax and transaction records, up to two years after the last enquiry for unconverted project enquiries, and while an account is active for its reusable artwork. Unused guest artwork is reviewed for removal after 90 days; account or order artwork can be retained longer where needed for an active job, legal records or an agreed repeat-order service. Self-service account deletion is described above. Historical enquiries, guest uploads and retained order records are reviewed for deletion when they are no longer needed; legal retention duties and active work may require longer retention.