KoruStay — Privacy Policy

Last Updated: August 2026

Version: 2.0

Your privacy is important to us. This privacy policy has been created to demonstrate KORUSTAY LIMITED’s commitment to protecting your personal information in accordance with the New Zealand Privacy Act 2020 and global privacy standards.

Through our website and platform, KoruStay provides a service for accommodation hosts to create and share digital guest guides, process upsells, and utilize AI concierge tools and automated safety engines. This policy outlines how we collect, use, store, and disclose personal information.

We advise all users to check this page regularly for any updates. Any significant changes may be notified to you via email.

Who this Policy Applies To

This policy applies to all users of the KoruStay service, including:

  • Hosts: Individuals or Property Management Companies (PMCs) who sign up for a KoruStay account to create and manage Digital Guest Guides.
  • Guests: Individuals who access and use a Digital Guest Guide, interact with our AI tools, receive safety alerts, or request/purchase Upsell Items.
  • Service Providers (“Fixers”): Tradespeople, cleaners, or contractors participating in the KoruWorks marketplace.
  • Advertisers & Partners: Businesses providing local guide information or participating in our B2B wholesale network.
  • Website Visitors: Anyone who browses our public website, korustay.co.nz.

Information We Collect

We collect information in the following ways:

1. Information you provide directly to us

  • For Hosts: When you sign up, we collect your name, email address, and account password. To provide the service, we also collect the content you submit for your guide (“Host Content”), which may include property details, contact information, and images.
  • For Guests (Safety Alerts & UpSells): If you opt-in to receive Automated Safety Alerts, we collect your email or phone number and stay dates. If you request or purchase an “Upsell Item” (via The KoruStay Way or Direct Request), we collect your name, email address, and stay details to issue receipts or confirmations and notify the Host. For External Booking Links, you interact directly with the third party and KoruStay collects no personal or payment data.
  • For Guests (VIP Global Profiles): If you sign up for a VIP Global Profile using Single Sign-On (SSO) or a magic link, we collect your Firebase UID, email address, first and last name, UI language preference, pseudonymous device UUIDs (for multi-device access), and explicit travel/dietary preferences or saved favorites.
  • For Advertisers & Partners: We collect your business name, contact details, and promotional material.
  • Payment Information: We do not directly collect or store payment card details; this is handled securely by our payment processor, Stripe.
  • When you contact us: We will store your email address and the contents of any communication you send to us.

2. Information we collect automatically

  • For all Users: When you use our website or a Digital Guest Guide, we collect standard server logs and analytics data, such as your IP address, device type, browser information, and how you interact with our service.
  • AI Interactions (Ask Pio, Koru Compass & Pion): When a Guest interacts with our guest AI tools (Ask Pio, Koru Compass) or a Host interacts with our co-pilot (Pion), we temporarily process and cache the text of the query/prompt to generate relevant responses, compile necessary context, and maintain system accuracy.

How We Use Your Information

KoruStay may use the information collected from you for the following purposes:

  • To provide, maintain, and improve our core service, including hosting your Digital Guest Guide.
  • To process subscription payments, VIP+ digital upgrades, and facilitate Guest Upsell transactions.
  • To power our AI Assistant tools, generate itineraries, and answer guest questions.
  • To sync conversational preferences (such as dietary restrictions and saved gems) to your Global Guest Profile to personalize future recommendations.
  • To dispatch Automated Safety Alerts based on geospatial hazards.
  • To facilitate Partner Integrations and B2B discounts.
  • To connect Hosts with Service Providers via the KoruWorks platform.
  • To respond to your enquiries and provide customer support.
  • To inform users of new features, services, and offers (you may opt-out of marketing communications at any time).

Data Retention & Purpose Limitation (Guest Data)

KoruStay operates on a privacy-by-design architecture, ensuring guest identities are strictly decoupled from standard public databases and adhering to data minimization principles:

  • Automated Safety Alerts (Auto-Deletion): When a Guest provides contact information specifically to receive automated safety alerts or guide notifications during their stay, this data is held only temporarily. KoruStay’s system automatically deletes this specific notification contact data from our active database immediately following the departure date set by the Guest.
  • VIP Global Profiles: If a Guest actively registers for a VIP Global Profile, their authentication tokens, stay history, and travel preferences are retained in our secure cloud database (Google Cloud Firestore) to personalize future trips across the KoruStay network, until the Guest requests account deletion.
  • Commerce Engine (Upsells): For transactions facilitated via The KoruStay Way, the Host acts as the sole Merchant of Record via Stripe Connect; transactional records are retained strictly to comply with financial, accounting, and dispute resolution management requirements (e.g., chargebacks). For Direct Requests, guest contact details are shared exclusively with the Host to arrange fulfilment off-platform. KoruStay strictly ring-fences this data: we do not use Guest Upsell data for marketing, promotional campaigns, or general contact outside of fulfilling that specific transaction.

Who We Share Your Information With

We do not sell, trade, or rent your personal information to others. However, we share your information with trusted third parties who assist us in operating our business:

  • Stripe: Our payment processor and gateway, which securely processes Host subscription payments, Guest VIP+ upgrades, and connected Host Upsell transactions via Stripe Connect.
  • Google Cloud Platform / Firebase: We utilize Google Cloud (Firestore) and Firebase Authentication to securely manage VIP Guest identities, Global Guest Profiles, and authentication tokens separate from our primary web hosting environment.
  • Our Web Hosting Provider: Who stores our core website data on secure servers.
  • AI Infrastructure Providers: We utilize enterprise Large Language Model APIs (e.g., Google Cloud Vertex AI / Gemini) to power “Ask Pio,” “Koru Compass,” and “Pion.” We send prompt text to these models to generate answers and itineraries; however, we do not transmit Guest Personally Identifiable Information (PII) to third-party AI processors unless explicitly provided by the user in the prompt.
  • Service Providers (KoruWorks): If a Host utilizes the KoruWorks marketplace to book a service, the Host explicitly authorizes KoruStay to share necessary operational data (e.g., Property location, Guest check-out time, access codes) with the selected Service Provider to fulfill the job.
  • Strategic B2B Partners (The Partners & Deals Engine): To provide Hosts with exclusive wholesale discounts, we partner with enterprise providers. This data sharing is solely to verify eligibility (limited to Username and Email) for the Partner’s exclusive discount. We do not share Guest data or financial information with B2B Partners.

Security

As required by the Privacy Act 2020, we follow strict security procedures. All data is stored behind enterprise-grade firewalls. KoruStay utilizes Application Default Credentials (ADC) and cryptographic token validation to secure data transfers between our web platform and cloud microservices. Access to your personal data is limited to authorised personnel who need it to perform their duties.

Cookies, LocalStorage, and Tracking Technologies

Our site uses cookies, localStorage, and sessionStorage to enhance user experience, authenticate secure sessions, and analyze website traffic. We utilize browser storage to maintain secure, hashed PIN sessions (we never store your raw security PIN in the browser), handle seamless SSO logins, and temporarily cache AI chat transcripts during your active session. You can manage your cookie and storage preferences through your browser settings.

Your Rights (Access, Correction, and Opt-Out)

You have the right to ask for a copy of any personal information we hold about you and to ask for it to be corrected if you think it is wrong.

If you would like to ask for a copy of your information, request a correction, request account deletion for your VIP Global Profile, or opt-out of marketing communications, please contact our Privacy Officer at: info@korustay.co.nz.

At your request, we will remove your personal information from our active database.

Third-Party Links

This privacy policy applies solely to information collected by KoruStay. We are not responsible for the privacy practices of third-party websites that may be linked to from our site, from within a Digital Guest Guide, or from Partner offers.