Privacy Policy

1. WHO WE ARE AND HOW TO CONTACT US

EvryStay provides technology for accommodation hosts and property managers to manage guest information, digital guest guides, communications, recommendations, purchases and optional guest verification. In this policy, 'EvryStay', 'we', 'us' and 'our' mean:

Contact us at that email address for privacy questions, requests or complaints, or to ask for this policy in another reasonably available form.

Accommodation hosts, property managers, property management systems (PMSs), online travel agents and third-party booking or activity providers may handle the same information for their own purposes. Their privacy notices may also apply. This policy covers EvryStay's handling of information, not an independent organisation's practices.

2. OUR PRIVACY COMMITMENT

EvryStay is committed to handling personal information in line with the Australian Privacy Principles (APPs).

3. PERSONAL INFORMATION WE COLLECT AND HOLD

The information we handle depends on whether you are a website visitor, host, team member, guest, supplier or other contact, and which features you use. We may collect and hold the following kinds of information:

Property guide content may be deliberately made available to guests or the public by a host. Hosts should not place personal, confidential or sensitive information in public guide fields unless that disclosure is appropriate and authorised.

4. HOW WE COLLECT INFORMATION

We collect personal information in several ways:

• Directly from you: when you create or use an account, connect a PMS, configure a property, communicate, make or receive a payment, complete verification, request support, submit a form or choose marketing preferences.
• From hosts and property managers: when they invite team members or guests, create reservations, provide property or supplier content, configure verification, or communicate through the Services.
• From PMSs, online travel agents and integration providers: through connections authorised by your host, including booking, property and message information.
• From service providers: including Didit verification results and evidence, Stripe transaction and payment-method details, communications delivery information, and security or fraud signals.
• Automatically: through servers, apps, cookies, software development kits and similar technologies when you visit or use the Services.
• From public or licensed sources: for local recommendations, maps, business listings and travel activities where those features are used.

If you provide personal information about another person, you should have authority to do so and, where appropriate, tell them about this policy. We may combine information from these sources where needed for the purposes below.

Anonymity and consequences of not providing information

You can generally browse the public website without identifying yourself, although technical data is still generated. We need certain information to create accounts, match a guest to a reservation, provide a property guide, process payments, support users or protect the Services. If required information is not provided, the relevant feature or service may not be available. Where a host has enabled guest verification, not completing the required check may leave access to the stay experience on hold; you can ask the host whether an alternative process is available.

5. DIDIT IDENTITY, BIOMETRIC AND LIVENESS DATA

If your host requires identity verification, you will be directed to Didit's verification service. We share the booking reference and relevant identity details. Didit may collect government identity documents, photos, selfies or video, biometric and liveness data, and device information to confirm your identity and detect fraud.

We receive verification results and relevant identity information and evidence. Authorised hosts or property managers may review this information, including ID or selfie images, to approve the check or request further review.

Facial biometric information used for identity verification is sensitive information. Didit presents a consent screen and its own privacy information before collection. Agreeing to this policy does not itself provide biometric consent. If you decline verification, contact your host to discuss an alternative or manual review. Your host decides case by case.

Automated checks assess document validity, liveness and facial similarity. Results may clear the check, require another attempt or go to host review, and may affect access to the digital stay experience. You can contact your host to provide context or request review.

Didit's own verification privacy notice also applies to its handling of verification data: https://didit.me/terms/verification-privacy-notice/

6. WHY WE COLLECT, HOLD, USE AND DISCLOSE INFORMATION

We handle personal information where reasonably needed to:

• provide, personalise and administer host and guest accounts, reservations, property guides, recommendations, purchases and other requested features;
• connect to authorised PMSs, import and synchronise listings and reservations, and support PMS or online travel agent messaging;
• enable communication between guests, hosts, property managers, team members, suppliers and support staff;
• perform optional ID, email, phone or payment-method verification, detect fraud or misuse, present evidence for host review, and control booking-related digital access;
• process subscriptions, purchases, refunds, commissions and payouts, and maintain financial and tax records;
• generate and improve AI-assisted replies, property content and recommendations when those features are used;
• send service, security, booking and support communications, push notifications and optional marketing;
• operate, troubleshoot, secure, monitor and improve the Services, understand feature use and investigate incidents;
• enforce agreements, resolve complaints and disputes, protect people and property, and establish, exercise or defend legal claims;
• comply with applicable laws, lawful requests and regulatory obligations; and
• carry out a corporate transaction, with appropriate confidentiality and legal steps.

We may use de-identified or aggregated information for analytics, planning and service improvement where it is no longer reasonably identifiable. We do not treat de-identification as complete while a practical means of re-identification remains available to us.

7. WHO WE DISCLOSE INFORMATION TO

We share personal information with the following recipients where reasonably needed to provide the relevant service or meet a legal obligation:

8. DATA LOCATION AND INTERNATIONAL DISCLOSURES

Personal information may be stored and processed in Australia and overseas through our service providers.

EvryStay is likely to disclose personal information to its service providers overseas, including Singapore, Ireland, Germany, Japan, the United States and United Kingdom. AI processing locations may vary with the provider selected for a request.

Privacy laws in other countries may differ from those in Australia. We take the steps required by applicable law when disclosing personal information overseas.

9. SECURITY

We take reasonable steps to protect personal information from loss, misuse, interference, unauthorised access, modification and disclosure through technical and organisational safeguards.

No system is completely secure. If we identify a data breach, we will investigate and take notification or other steps required by applicable law.

10. RETENTION AND DELETION

We do not apply one fixed retention period to every record. We retain information for the period reasonably needed for the purpose for which it was collected and take reasonable steps to delete or de-identify it when it is no longer needed, subject to account and contract status, the stay lifecycle, host operational needs, security and fraud prevention, dispute or chargeback periods, financial and tax obligations, legal claims and any lawful preservation requirement.

Verification evidence may expire under provider retention rules before a stay ends. Verification status and host-review records may remain where reasonably needed. Didit and Stripe apply their own retention settings and legal obligations.

11. ACCESS, CORRECTION AND DELETION REQUESTS

You may ask us to give you access to personal information we hold about you, correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, or delete information where applicable. Guests and hosts can change some account information in the Services, and account deletion is available through supported account settings. You can also email team@evrystay.com.au

Please describe the information and request clearly. We may ask for enough information to verify your identity and authority without collecting more than reasonably needed. We will respond within a reasonable period and act in accordance with the law that applies. If we cannot provide access, make a correction or complete deletion, we will explain why where required and identify available complaint steps. Legal exceptions and the retention principles above may limit a request.

12. PRIVACY COMPLAINTS

Send a privacy complaint to team@evrystay.com.au and include enough detail for us to understand what happened, the information involved and the outcome you seek. We will acknowledge the complaint, investigate it with the relevant product owner or provider, and respond within a reasonable period. We may ask for further information and will explain the outcome and any steps we propose.

If the Privacy Act applies to the matter and you are not satisfied after first raising it with us, you may complain to the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/privacy/privacy-complaints

13. MARKETING, COOKIES AND YOUR CHOICES

Marketing consent is optional and separate from communications needed to provide an account, booking, purchase, security alert or support response. Where we or a host sends electronic marketing using information handled through EvryStay, the sender must have the consent or other permission required by applicable law. You can opt out using the unsubscribe link in a message, changing an available preference, contacting the sender, or emailing us. An opt-out does not stop necessary service communications.

The Services use cookies, local storage, software development kits and similar technologies for authentication, preferences, security, analytics and service operation. Browser or device settings can block or remove some technologies, but this may affect functionality. More information about the public website is available at https://evrystay.com/cookies

You can withdraw a consent for future processing by contacting us or using the relevant control. Withdrawal does not undo processing that was lawful before withdrawal and may mean a consent-dependent feature can no longer be provided.

14. GDPR AND UK GDPR WHERE LEGALLY APPLICABLE

The EU General Data Protection Regulation (GDPR) or UK GDPR applies only where its territorial and other legal requirements are met for a particular processing activity. EvryStay does not state that those laws apply to every user or every activity merely because the Services can be accessed from Europe or the United Kingdom.

Where the GDPR or UK GDPR applies, the following explains our processing roles and lawful bases. For booking details, PMS messages, guest guides, check-in information and crew operations that we handle on a host’s instructions, the host determines the purposes and lawful basis. EvryStay processes that information to provide the instructed service.

For processing where EvryStay determines the purposes, we use the following bases:

• Accounts and payments: contractual necessity where the processing is necessary to our agreement with the individual; legitimate interests in administering business accounts and transactions where the individual acts for a business.
• Security, support and enquiries: legitimate interests in protecting the Services, resolving problems and responding to requests, with proportionate collection and safeguards.
• Optional identifiable analytics and diagnostic replay: separate consent where required. Refusing or withdrawing this consent does not prevent access to the core service.
• Legal duties and privacy requests: compliance with an applicable legal obligation where that obligation requires the processing.

Biometric identity verification requires a separate applicable legal condition. Agreeing to these Terms or acknowledging this Privacy Policy does not itself provide biometric consent.

Subject to applicable conditions and exceptions, a person may have rights of access, correction, erasure, restriction, objection, portability, withdrawal of consent and complaint to their local supervisory authority. They may also have rights concerning a decision based solely on automated processing that produces legal or similarly significant effects. The verification process and human-review route are described in section 5. Contact us to exercise a right. Where those laws restrict an international transfer, the legally required transfer assessment and mechanism must be addressed for that transfer; this policy does not claim that standard contractual clauses or another mechanism have been executed unless confirmed.

15. CHANGES TO THIS POLICY

We may update this policy when our products, providers, data flows or legal coverage change. The date at the top identifies the current version. Material changes should be brought to affected users' attention in a manner appropriate to the change.

16. ACCOUNT AND PERSONAL INFORMATION DELETION

To request deletion of your guest account and personal information, email team@evrystay.com.au. You do not need to use a settings page or a special form. Please provide enough information for us to locate your account or stay, but do not email passwords, identity documents or payment-card details. We may request proportionate additional information if needed to verify your identity.

We handle requests without undue delay and normally free of charge. Where the GDPR or UK GDPR applies, we will respond within one month of receiving your request. If a permitted extension is necessary because of the complexity or number of requests, we will tell you within that month, explain why, and may take up to two additional months.

We will delete personal information where the applicable right to erasure requires it and explain any information we retain and the reason, such as a legal record-keeping obligation or the establishment, exercise or defence of legal claims. If we cannot fulfil all or part of your request, we will explain why and how you can complain. Deleting an EvryStay account does not itself cancel a reservation or delete records independently held by your host, booking provider or other organisations. Where we process information on a host's behalf, we will assist with referring your request to the relevant host.