Privacy policy

Last updated: September 3, 2026

Acorn Post ("we," "us," "our") operates acornpost.co.nz and trades as The Great Christmas Letter (the "Services"). This Privacy Policy explains how we collect, use, store and disclose personal information when you visit our site, place an order, or otherwise contact us, and sets out your rights under the Privacy Act 2020 (NZ).

Our Services are built on Shopify, which hosts our store and processes some information on our behalf. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls in relation to personal information.

By using the Services, you confirm you've read and understood this Policy.

1. Personal Information We Collect

We collect the following categories of personal information, depending on how you use the Services:

  • Contact details — name, billing and shipping address, phone number, email address.
  • Payment information — processed by Shopify Payments and our payment providers; we do not store full card numbers ourselves.
  • Order and personalisation details — the items you purchase, and any details you enter to personalise a letter, including a child's first name, last name, title, age, hometown, a "good deed," and a delivery/"magical" address. See Section 5 (Children's Personal Information) below — this information is entered by you, the purchasing adult, not collected directly from a child.
  • Account information — if you create an account, your login details and order history.
  • Communications — anything you send us via email, contact forms, or social media.
  • Device and usage information — IP address, browser type, and how you interact with our site (via cookies and similar technologies).

2. How We Collect It

  • Directly from you — when you browse, order, create an account, or contact us.
  • Automatically — through cookies and similar technology as you use the site.
  • From service providers — Shopify and the apps/tools we use to run the store (see Section 6).

3. Why We Use Your Information

We use personal information to:

  • Process and fulfil your order, including producing and posting personalised letters, and arranging delivery.
  • Communicate with you about your order (confirmations, shipping updates, customer service).
  • Maintain your account, if you have one.
  • Improve our Services and understand how our site is used.
  • Send you marketing communications, where you've agreed to receive them — you can opt out at any time (see Section 9).
  • Detect and prevent fraud and keep our Services secure.
  • Meet our legal obligations, respond to lawful requests, and enforce our terms.

We do not use your (or your child's) personal information to build a profile of your child, to market directly to your child, or for any purpose beyond producing and fulfilling your order and reasonable related customer service.

4. Information Privacy Principles (Privacy Act 2020)

As a New Zealand business, we collect and handle personal information in accordance with the 13 Information Privacy Principles (IPPs) under the Privacy Act 2020. In summary, this means we:

  • Only collect personal information we genuinely need to provide the Services (IPP 1).
  • Collect it fairly and, where practicable, directly from the person concerned or, where a child is involved, from the parent/guardian placing the order (IPP 2, 4).
  • Tell you what we're collecting and why, at or before the time of collection (IPP 3) — this Policy, together with the order form itself, is how we do that.
  • Keep it secure (IPP 5), don't keep it longer than needed (IPP 9), and only use or disclose it for the purpose it was collected, or a directly related purpose, unless you've agreed otherwise or the law requires/allows it (IPP 10, 11).
  • Give you a way to access and correct your own information (IPP 6, 7).

5. Children's Personal Information

Some of our products require details about a child — their name, age, hometown, and similar — to produce a personalised letter. This information is:

  • Provided by you, the purchasing adult — not collected directly from the child, and not something we ask a child to submit themselves. Our site and checkout are directed at, and intended to be used by, adults.
  • Used solely for personalisation and fulfilment — printing/writing the letter, quality-checking the order, and, if you contact us about that order, customer service. We do not use it for profiling, targeted advertising, or marketing directed at the child.
  • Retained only as long as needed to fulfil the order, resolve any post-order issues (returns, reprints, disputes), and meet our own record-keeping and tax obligations — after which it is deleted or de-identified. Contact us (Section 12) if you'd like us to delete a child's personalisation details sooner.
  • Not sold or disclosed to third parties for their own marketing purposes.

If you're a parent or guardian and have questions about details submitted for a child, or would like them corrected or deleted, contact us using the details in Section 12.

6. How We Disclose Personal Information

We disclose personal information only where necessary, including to:

  • Shopify, which hosts our store and processes orders, payments, and some customer communications on our behalf.
  • Service providers who help us run the business — for example, payment processors, our fulfilment/production tooling (which we use to produce and mail letters), and delivery/courier partners who need a name and address to deliver your order.
  • Professional advisers (e.g. accountants, lawyers) where reasonably necessary.
  • Law enforcement or regulators, where required by New Zealand law, or to protect the rights, safety, or property of Acorn Post, our customers, or others.
  • A new owner, if we sell or transfer the business, subject to this Policy continuing to apply to information already held.

We do not sell personal information to data brokers.

7. Overseas Disclosure (IPP 12)

Some of the service providers we use — including Shopify and certain apps and productivity tools that support our fulfilment process — store or process information on servers located outside New Zealand (for example, in Australia, the United States, or elsewhere Shopify or our providers operate infrastructure).

Where we disclose personal information to an overseas person or organisation, we take reasonable steps to ensure it will be subject to privacy protections comparable to those under the Privacy Act 2020 — for example, by relying on providers who are themselves bound by data protection obligations, or by including appropriate contractual protections. You can find more detail on Shopify's own handling of information at Shopify's Privacy Policy: https://www.shopify.com/legal/privacy.

8. Security and Retention

We take reasonable steps to protect personal information against loss, misuse, and unauthorised access, using measures appropriate to the sensitivity of the information (including relying on Shopify's platform-level security for payment and hosting infrastructure). No method of transmission or storage is completely secure, and we can't guarantee absolute security.

We keep personal information only as long as reasonably necessary for the purposes described in this Policy, or as required by law (for example, tax and accounting record-keeping obligations under NZ law).

9. Your Rights and Choices

Under the Privacy Act 2020, you have the right to:

  • Access the personal information we hold about you (IPP 6).
  • Correct it if it's wrong (IPP 7).

To exercise these rights, contact us using the details in Section 12. We'll respond within the timeframes required by law, and may need to verify your identity first. There's usually no charge for this, though the Act allows a reasonable charge in some circumstances.

Marketing preferences — if you've opted in to marketing emails, you can unsubscribe at any time using the link in those emails. You'll still receive non-promotional messages related to an order you've placed (e.g. shipping confirmations).

10. Notifiable Privacy Breaches

If we experience a privacy breach that has caused, or is likely to cause, serious harm, we'll notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, in line with our obligations under Part 6 of the Privacy Act 2020.

11. Complaints

If you're unhappy with how we've handled your personal information, please contact us first (Section 12) so we can try to resolve it directly.

If you're not satisfied with our response, you can complain to New Zealand's Office of the Privacy Commissioner:

12. Contact Us

Questions about this Policy, or want to access, correct, or ask us to delete personal information (including a child's personalisation details)? Get in touch:

Acorn Post Email: info@acornpost.co.nz 

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or the law. We'll post the revised version here and update the "Last updated" date above.