Privacy Policy
Last updated 9 November 2026
This policy explains how The Trustee for Hearthstone, T/A Hearthstone Stays · ABN 50 149 914 763 (“Hearthstone”, “we”) collects, uses, shares and protects personal information when you use Hearthstone Stays. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
What we collect
| Information | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email, phone, password (stored scrambled, never in plain text), profile description | You |
| Booking details | Dates, number and type of guests, pets, messages to the Host, booking history, reviews | You and your Host |
| Payment details | Card type, last four digits, payment status, refunds. Full card numbers go straight to Stripe — we never see or store them. | Stripe |
| Host details | Property address, short-term rental registration numbers, payout account (held by Stripe), identity information Stripe needs to pay you | Hosts and Stripe |
| Messages | Messages between Guests, Hosts and us | You and other users |
| Technical information | IP address, browser type, pages viewed, a session cookie that keeps you logged in | Your device |
We don’t ask for sensitive information (such as health or religious information). Please don’t put it in messages or reviews. If you tell us about a health need — for example to ask about step-free access — we use it only to help with that request.
Why we use it
- To create and run your account, and to make, manage and support bookings
- To take payments, pay Hosts, give refunds and handle chargebacks
- To let Guests and Hosts communicate, and to send booking confirmations, reminders and service messages
- To keep the Platform safe: preventing fraud, investigating complaints, enforcing our Terms
- To meet legal obligations, such as tax and record-keeping, short-term rental laws and government levies
- To improve the Platform
- To send marketing, but only if you’ve opted in. Every marketing email has an unsubscribe link.
Who we share it with
- Your Host or Guest. When you book, your Host sees your first name, booking details, messages and number of guests. Once a booking is confirmed, your Host may also see your full name and phone so they can manage check-in, and the Guest receives the property address and the Host’s contact details.
- Service providers who help us run the Platform, under confidentiality obligations: Stripe (payments), our web host and email provider, and mapping providers (OpenStreetMap tiles load in your browser).
- Government and regulators where the law requires — for example NSW Fair Trading under the short-term rental Code of Conduct and exclusion register, the State Revenue Office Victoria for the Short Stay Levy, the ATO, or police with a lawful request.
- A buyer of our business, if Hearthstone Stays is sold, on the basis that this policy keeps applying to your information.
We do not sell your personal information.
Overseas
Some of our service providers, including Stripe, may store or process information outside Australia, including in the United States. We use providers with recognised security and privacy standards.
Automated decisions
We don’t use computer programs to make decisions about you that significantly affect your rights without a person involved. Search results are ranked automatically using the factors described in our Terms. If we introduce automated fraud checks that could block a booking, we’ll update this policy first, and you can always ask a person to review a decision.
Cookies
We use one essential cookie to keep you logged in and secure your session. We don’t use advertising or cross-site tracking cookies. Google Fonts and map tiles are loaded from third-party servers, which receive your IP address in the usual way.
How long we keep it
We keep booking and payment records for at least 7 years for tax purposes, and records of NSW stays for at least 3 years as the Code of Conduct requires. We keep account information while your account is open. When we no longer need information, we delete or de-identify it.
Security
We protect information with encrypted connections (HTTPS), hashed passwords, access controls and limits on who can see what. If we have a data breach likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the law requires.
Your choices and rights
- Access and correction. You can see and update most details in your account. Ask us for a copy of the information we hold about you, or to correct it, at info@hearthstonestays.com.au. We respond within 30 days.
- Deletion. You can ask us to close your account and delete your information. We’ll keep only what the law requires us to keep, such as booking and tax records.
- Anonymity. You can browse without an account. To book, we need to know who you are.
- Marketing. You can opt out any time.
Complaints
If you think we’ve mishandled your information, email info@hearthstonestays.com.au with “Privacy” in the subject. We’ll respond within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
We’ll post any changes here and update the date at the top. If a change is significant, we’ll email you.