Privacy Policy

Last updated: 4 March 2026

Hostu Limited ("Hostu", "we", "us", "our") is committed to protecting your privacy in accordance with the Privacy Act 2020 (New Zealand). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the Hostu platform ("Platform").

1. Information We Collect

Information you provide

• Account information: name, email address, phone number, and password when you create an account.
• Profile information: profile photo, bio, and property details for Hosts.
• Listing information: property descriptions, photos, pricing, availability, and house rules.
• Payment information: bank account details for Hosts receiving payouts; payment card details for Guests (processed securely by our payment provider — we do not store full card numbers).
• Communications: messages exchanged between Hosts and Guests through the Platform, and any correspondence with our support team.
• Identity verification: government-issued identification documents where required to maintain the trust and safety of the New Zealand host network.

Information collected automatically

• Usage data: pages visited, features used, search queries, and interactions with the Platform.
• Device information: browser type, operating system, IP address, and device identifiers.
• Location data: approximate location derived from your IP address.

2. How We Use Your Information

We use your personal information to:

• Provide, maintain, and improve the Platform.
• Process bookings and payments through our Secure Trust Account.
• Facilitate communication between Hosts and Guests, including human follow-ups for the Serious Complaint Process and booking support.
• Manage guest lists on behalf of Hosts, enabling direct rebooking relationships.
• Send booking confirmations, reminders, and service-related notifications.
• Respond to your enquiries and provide customer support.
• Comply with legal obligations, including tax reporting requirements.
• Analyse usage patterns to improve the Platform (in anonymised or aggregated form where possible).

3. Sharing Your Information

We do not sell your personal information. We may share your information with:

• Other users: Hosts see Guest names and booking details; Guests see Host profiles and listing information.
• Payment providers: to process transactions securely (e.g. Stripe, BlinkPay).
• Service providers: trusted third parties who assist us in operating the Platform, such as cloud hosting (AWS), email delivery, and analytics — bound by confidentiality obligations.
• Legal requirements: where required by New Zealand law, court order, or government request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with appropriate notice.

4. Cookies & Tracking

We use cookies and similar technologies to remember your preferences, keep you logged in, and understand how the Platform is used. You can manage cookie preferences through your browser settings. Disabling cookies may affect Platform functionality.

We use:

• Essential cookies: required for the Platform to function (authentication, security).
• Analytics cookies: to understand usage patterns and improve the Platform.

5. Data Retention

We retain your personal information for as long as your account is active, or as needed to provide services, comply with legal obligations (including tax record-keeping requirements), resolve disputes, and enforce our agreements.

Account closure and data deletion

When you request account closure (via the Dashboard or by emailing support@hostu.co.nz):

1. Your account is immediately set to DEACTIVATED. Listings are removed from search results and login is disabled.
2. You receive a confirmation: “Your account has been deleted. All your data is scheduled to be deleted 30 days from today’s date.”
3. After 30 days, all personal identifying information (PII) — including your name, email address, listing content, photos, and guest databases — is permanently and irreversibly deleted.
4. Legal retention exception: Non-personal transaction records required for Inland Revenue (IRD) compliance (GST collected, payout amounts, invoice references) are moved to a secure, encrypted archive and retained for the statutory 7-year period under New Zealand tax law. These records are stripped of all personal identifying information.

If you have active bookings at the time of closure, your account remains in a limited state until those bookings are completed or cancelled, after which the 30-day purge schedule begins.

6. Your Rights

Under the Privacy Act 2020, you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate or incomplete information.
• Request deletion of your personal information. Your account will be deactivated immediately and all PII permanently deleted after 30 days (subject to legal retention requirements outlined in Section 5).
• Withdraw consent for optional data processing at any time.
• Complain to the Office of the Privacy Commissioner if you believe your privacy has been breached.

To exercise any of these rights, contact us at support@hostu.co.nz.

7. Security

We take reasonable steps to protect your personal information from unauthorised access, use, or disclosure. Measures include encryption in transit (TLS), secure cloud infrastructure, access controls, and regular security reviews.

No method of transmission over the internet is completely secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Children

The Platform is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete it.

9. International Data Transfers

Hostu is a New Zealand entity, governed by the Privacy Act 2020. Your information may be stored and processed on cloud infrastructure located outside New Zealand (including AWS servers in Sydney, Australia). We ensure appropriate safeguards are in place to protect your information in accordance with New Zealand privacy law, regardless of where it is physically stored.

Unlike US-based platforms subject to foreign privacy regimes, your data rights are always governed by New Zealand law and enforceable through the Office of the Privacy Commissioner.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on the Platform. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

11. Contact

If you have questions or concerns about this Privacy Policy or how we handle your personal information, please contact us:

Email: support@hostu.co.nz

You may also contact the Office of the Privacy Commissioner at www.privacy.org.nz.