Privacy Policy

Last updated: 05 November 2026

Hearthstone ("we", "us", "our") provides independent, in-person short-term rental audits across Queensland, New South Wales and Victoria. This policy explains what personal information we collect through hearthstonestays.com.au, why we collect it, and how it's handled. We aim to comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

1. Information we collect

We only collect what we need to run the service. Depending on how you use the site, this may include:

  • Booking requests: your name, email, phone number, property address, preferred audit dates, number of nights, listing platform, and any message you include.
  • Contact form: your name, email address, and message.
  • Owner mailing list: your email address, suburb, and state — the suburb/state is used only to let you know when we'll be auditing in your area.
  • Guest mailing list: your email address.
  • Invoices: if you're issued an invoice for an audit, we record your name, email, property address, nights booked, and the amount payable.
  • Admin/agent accounts: a username and a securely hashed password for staff who log in to manage bookings and reports. We never store passwords in plain text.

2. How we use your information

  • To respond to booking requests and enquiries
  • To schedule and carry out property audits, and to produce guest-facing and host-facing reports
  • To send invoices and process payments
  • To send the marketing emails you've specifically signed up for (owner tips and local availability, or guest stay updates) — you can unsubscribe from either list at any time via the link in every email
  • To sync confirmed bookings to our calendar so we can plan travel

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

3. Third-party services we use

Some of what we do relies on other providers, each of which processes a limited slice of information on our behalf:

  • Stripe processes any payments and invoices. We never see or store your full card details — that's handled entirely by Stripe under its own privacy policy.
  • Google Calendar is used internally to sync confirmed booking dates so we can plan our travel schedule.
  • Anthropic's AI service helps our auditors draft report text from their structured on-site notes. Property and booking details relevant to a report may be processed this way; this is used purely to speed up drafting, and every report is reviewed and edited by a human before publishing.

4. Cookies

We use a small, functional session cookie to keep staff logged in to the admin area. We don't currently use advertising or analytics tracking cookies on this site. If that changes, we'll update this policy.

5. Storage and security

Information is stored on secured servers with restricted access. Passwords are stored using industry-standard one-way hashing, never in plain text. While we take reasonable steps to protect your information, no online system can be guaranteed completely secure.

6. Data retention

We keep booking, invoice and report records for as long as reasonably necessary for business, tax and legal purposes. Mailing list details are kept until you unsubscribe or ask us to remove them.

7. Access, correction and complaints

You can ask us what personal information we hold about you, request a correction, or ask us to delete it, by contacting us using the details below. If you're unhappy with how we've handled your information, you can also raise a complaint with the Office of the Australian Information Commissioner (OAIC).

8. Changes to this policy

We may update this policy from time to time as the business or site changes. The date at the top of this page reflects the latest revision.

9. Contact us

For any privacy question or request, get in touch via our contact page.