Privacy notice

Cozie Guides is run by a sole trader based in Brisbane, Queensland, Australia. Contact: hello@cozieguides.com. We make guest guides for holiday homes in New Zealand. This notice explains, in plain English, what we collect and what we do with it.

Because we work with New Zealand businesses, New Zealand’s Privacy Act 2020 applies to us. As a small Australian business we’re currently exempt from the Australian Privacy Act 1988, but we choose to follow the Australian Privacy Principles as good practice.

What we collect

Enquiries: your name, email and anything you tell us about your property, only so we can reply. No mailing list.
Owner questionnaire: property details, house instructions, local tips and photos, plus your name and email.
Private stay details: door or lockbox codes, Wi-Fi password, street address and phone numbers. These are stored separately from the public guide and shown only to guests who enter your stay PIN or open a private booking link you send them. The PIN is stored only as a scrambled (hashed) value; booking links expire the day after checkout and can be turned off at any time.
Payments: you pay by bank transfer against our invoice. We keep the invoice (your name, business, address if you give it, amounts) and a record of when it was paid. We don’t take card payments.
Business contact details: if we’ve emailed a holiday-home business about our service, we hold its name, the business email or contact form it publishes on its own website, where we found it, and whether it asked us not to get in touch.

You don’t have to give us any information, and you can enquire without giving your full name. But we can’t make a guide without the questionnaire answers, and we need a way to reply to you.

Guests using a guide

Guides don’t ask guests for personal information and don’t use analytics or third-party trackers. Our app doesn’t log guests’ IP addresses (it holds one briefly in memory to slow repeated PIN or login attempts). Our hosting provider may process IP addresses briefly to route traffic and protect against attacks. When a guest opens a guide, their phone may save the public pages for offline use. Private stay details are never saved for offline use.

Why we use it

Only to create, host and maintain your guest guide, to reply to you, to bill you if you become a customer, and (for business contact details) to offer our service to holiday-home businesses. Every such email says who we are and lets you unsubscribe by replying; we stop within 5 working days. We don’t sell data or use it for advertising.

Cookies

Only functional cookies: one that protects our forms against forgery, one that remembers a guest has unlocked private details (up to 24 hours for a PIN, or until a booking link expires), and a login cookie for our own team. No advertising or tracking cookies.

Photos

Uploaded photos are re-encoded and location (EXIF/GPS) data is removed. Please don’t upload photos that show guests, number plates or anything that identifies people without their consent.

Keeping it safe

Pages are only served over HTTPS. Private stay details are stored apart from the public guide and need a PIN or private link; PINs and our admin password are stored only as hashes. Only the business owner can log in to the admin area, uploaded files are checked and re-encoded, and backups are kept for 14 days. No system is perfectly secure, but we take reasonable steps to protect information from misuse, loss and unauthorised access.

Where it’s stored

Your guide, the questionnaire answers, private stay details, photos, enquiries and our daily backups are hosted in Sydney, Australia, with Fly.io (its “syd” region).

Service providers (sub-processors) that handle information for us:

Fly.io, Inc. (United States): hosting, storage and the host’s daily disk snapshots, in its Sydney region. Like any cloud company, its support staff and systems may be outside Australia.
Cloudflare: our domain name (DNS) and email forwarding, so emails to our address pass through it; guide pages and questionnaire answers don’t.
Our email provider (Google Gmail, and an email-sending service if we use one to reply from our business address), for messages you send us and our replies.
Our bank, for your bank transfer.

Our service providers hold or process information only on our behalf and don’t use it for their own purposes; we stay responsible for it (NZ Privacy Act 2020 s11). Information may be accessed or processed in Australia and the United States (Fly.io, Google, Cloudflare). If we ever need to disclose information to an overseas organisation for its own use, we’ll only do so as IPP 12 / APP 8 allow, which may mean asking you first.

How long we keep it

Unfinished questionnaires: deleted after 90 days.
Active guides: kept while your subscription runs. After you cancel, your guide is taken offline and its data deleted within 30 days.
Closed enquiries: deleted after 12 months.
Private booking links: deleted 30 days after they expire.
Invoices and payment records: kept for at least 5 years after the year they relate to, as Australian tax law requires (we may keep them up to 7 years).
Business contact details for outreach: deleted after 12 months if there’s no reply. If you ask us not to contact you, we keep only your email address on a do-not-contact list so we don’t email you again.
Backups: our daily copies, the host’s daily snapshots and any offline copy we keep all roll over after 14 days, so deleted data disappears from backups within about two weeks.

You can ask us to delete your data sooner at any time.

Your rights

You can ask to see or correct the information we hold about you, free of charge. We’ll respond within 20 working days. If we don’t agree to a correction, we’ll tell you why, and you can ask us to keep a note of the correction you asked for alongside the information. If a privacy breach is likely to cause serious harm, we’ll notify the people affected and the NZ Privacy Commissioner as soon as practicable.

If you’re unhappy with how we’ve handled your information, please contact us first. You can also complain to the NZ Office of the Privacy Commissioner or the Office of the Australian Information Commissioner.

Contact

Our privacy officer is the business owner. Email hello@cozieguides.com.