Privacy Policy

This Privacy Policy explains how Daystaz Pty Ltd (ACN 701 746 465, ABN 74 701 746 465) (Daystaz, we, us or our) collects, holds, uses, discloses and protects your Personal Information.

It applies whenever you deal with us, including when you use our website (www.daystaz.com), the Daystaz app on the Apple App Store and Google Play, our customer support channels and chat assistant, our social media pages, and the Daystaz partner platform used by our hotel partners.

Daystaz is a Melbourne-based booking platform that lets guests reserve hotel rooms for part of the day, in set time blocks, without staying overnight. By using our services you acknowledge that your Personal Information will be handled in line with this policy.

We are committed to handling Personal Information in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth) (the Privacy Act). The APPs govern the way we collect, use, disclose, store, secure and dispose of your Personal Information.

A copy of the APPs is available from the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au/.

Personal Information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true or recorded in a material form.

Information you give us

• Booking details: your name, email address and mobile phone number, the hotel, date and time block you book, and any requests you pass on to the hotel.
• Account details: if you create a Daystaz account, your login details (your password is stored in encrypted form), saved favourites, preferences and booking history.
• Communications: messages you send us by email, in-app chat, social media or our chat assistant, and records of those conversations.
• Reviews and feedback: ratings, reviews, survey responses and other feedback about Daystaz or our partner hotels.
• Details about other people: if you book on behalf of someone else, you must have their permission to share their details with us and tell them about this policy.

Information we collect automatically

• Device and usage information such as IP address, device type and identifiers, operating system, browser type, app version, language settings, pages and screens viewed, searches, clicks, the date and time of your visit and crash reports.
• Approximate location based on your IP address and, if you allow it in your device settings, precise location from your device so we can show hotels near you.
• Information collected through cookies, pixels, software development kits (SDKs) and similar technologies (see section 10).

Information we receive from others

• Sign-in providers: if you choose to sign in with Google or Apple, we receive your name, email address and, where you allow it, your profile picture. Apple may give us a private relay email address instead of your real one.
• Partner hotels: confirmation of your arrival, check-out, no-shows, cancellations and any issue or dispute relating to your booking.
• Advertising and analytics partners: information about how you interacted with our ads and campaigns.

Hotel partners: when a hotel joins Daystaz, we collect the business contact details (name, role, email and phone number) of the staff who use our partner platform, together with the hotel's business information.

Payments: guests pay for their stay directly at the hotel. Daystaz does not collect or store your credit card or bank details when you make a booking. Payments made at the hotel are handled under that hotel's own privacy policy.

What we do not collect: we do not ask for sensitive information (such as information about your health, racial or ethnic origin, religious beliefs or political opinions). Please do not include sensitive information in reviews, special requests or messages to our chat assistant. If you do, we will only use it for the purpose for which you provided it, with your consent, or where required or authorised by law.

Where reasonable and practicable, we collect Personal Information directly from you: when you make a booking, create an account, contact us, leave a review, subscribe to our emails or use our website and app. We also collect it automatically as you use our services, and from third parties as described in section 3.

If we receive Personal Information about you from a third party, we will take reasonable steps to make sure you are aware of it. If we receive information we did not ask for and could not have collected under the APPs, we will destroy or de-identify it where it is lawful and reasonable to do so.

You can browse our website and app without telling us who you are. However, to make a booking we need your name, email address and phone number so the hotel can identify you on arrival and we can confirm and manage your booking. If you do not provide this information, we will not be able to complete your booking.

We collect and use your Personal Information to:

• process, confirm and manage your bookings, and pass your booking details to the hotel you have booked;
• send you booking confirmations, reminders, changes, cancellations and requests for feedback (by email, SMS or push notification);
• create and manage your account, including your favourites, preferences and booking history;
• provide customer support, including through our chat assistant, and verify your identity when you contact us about a booking;
• show you hotels near you when you have allowed location access;
• publish reviews to help other guests choose a hotel;
• send you news, offers and promotions about Daystaz (see section 7);
• show you relevant Daystaz ads on other websites and social media, and measure how well our marketing works;
• analyse and improve our website, app and services, including through testing and research;
• onboard and manage our relationships with partner hotels;
• detect and prevent fraud, misuse and security incidents, resolve disputes and enforce our terms; and
• comply with our legal obligations.

We may also use your Personal Information for other purposes that are related to these purposes, where you would reasonably expect us to, or where you have consented or the law requires or authorises it.

With your consent, or where the law otherwise allows, we may send you newsletters, special offers and other marketing about Daystaz by email, SMS or push notification. Every marketing email and SMS includes a way to unsubscribe. You can also opt out at any time by changing your account or device notification settings, or by contacting us at admin@daystaz.com. We will still send you messages about bookings you have made.

We do not sell your Personal Information.

We may disclose your Personal Information to:

• The hotel you book: your name, email address, phone number, booking details and any special requests, so the hotel can welcome you and provide your stay. Once the hotel receives your details, it handles them under its own privacy policy.
• Our service providers: companies that help us run Daystaz, including our website and app developer, hosting and cloud storage providers, email and SMS providers, push notification services, customer support and chat assistant (AI) providers, and analytics providers such as Google Analytics. They may only use your information to provide services to us.
• Sign-in providers: Google and Apple, when you choose to sign in with them.
• Advertising partners: platforms such as Meta (Facebook and Instagram) and Google Ads, which receive information from our cookies, pixels and SDKs and, in some cases, hashed (scrambled) email addresses, so we can show you relevant ads and measure our campaigns. You can opt out as described in section 10.
• Professional advisers: our lawyers, accountants and insurers, where necessary.
• Government and law enforcement bodies: where required or authorised by law, or where we reasonably believe it is necessary to prevent fraud or other unlawful activity.
• A purchaser of our business: if Daystaz or its assets are sold or restructured, subject to confidentiality obligations.
• Anyone else you consent to.

Some of our service providers store or access Personal Information outside Australia. Countries where your information is likely to be disclosed or stored include the United States (for example, Google, Apple, Meta and our email marketing provider) and Malaysia, where our servers are hosted by our hosting provider, Hostinger.

Before we disclose Personal Information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs, including through contractual obligations.

Cookies are small files placed on your device when you visit a website. Our website and app use cookies, pixels (such as the Meta Pixel), tracking links and SDKs to:

• Make the site and app work (essential): keep you logged in, remember your search and booking progress, and keep the service secure.
• Remember your preferences: for example, your language and recent searches.
• Analyse usage (analytics): understand how visitors use Daystaz, including through Google Analytics, so we can improve it.
• Advertise (marketing): show you Daystaz ads on other sites and social media based on the hotels and pages you have viewed, and measure the results, including through the Meta Pixel and Google Ads.

You can manage or delete cookies through your browser settings, although blocking essential cookies may stop parts of the site from working. You can also:

• opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout;
• manage Google ad personalisation at https://myadcenter.google.com;
• manage Meta ad preferences in your Facebook or Instagram account settings; and
• limit ad tracking in your device settings (on iPhone, Settings > Privacy & Security > Tracking; on Android, Settings > Privacy > Ads > Delete advertising ID).

Our app will ask your permission before it accesses your device's location or sends you push notifications. You can change these permissions at any time in your device settings. If you turn off location access, you can still search for hotels by entering a suburb or area.

If you post a review, it may be published on our website, app and social media together with your first name or display name and the date of your stay. Please do not include personal details in your review. We may moderate or remove reviews that breach our guidelines.

We use an AI-powered chat assistant to answer questions, help you find hotels and help you manage your bookings. The assistant will identify itself as automated, and you can ask to speak with a member of our team. To help with a booking, it may need your name, email address and booking reference.

Chat conversations are processed by our AI service provider on our behalf. Where the provider offers the option, we use settings that stop your conversations being used to train its AI models. We keep chat logs for up to 30 days for quality and security purposes, unless they form part of a support request or complaint. The assistant does not make decisions that have a legal or similarly significant effect on you without human review. Please do not share sensitive information with the chat assistant.

Daystaz is intended for people aged 18 and over, and our partner hotels generally require the person checking in to be at least 18. We do not knowingly collect Personal Information from children. If you believe a child has given us Personal Information, please contact us and we will delete it.

We take reasonable steps to protect your Personal Information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include encrypted connections (HTTPS), encrypted password storage, restricted staff access on a need-to-know basis, and confidentiality obligations on our service providers.

No method of transmitting or storing data over the internet is completely secure. Please keep your account password confidential and let us know straight away if you think your account has been compromised.

If a data breach is likely to result in serious harm to you, we will notify you and the OAIC as required under the Notifiable Data Breaches scheme.

We keep Personal Information only for as long as we need it for the purposes described in this policy, or as required by law. In general:

• Booking records are kept for 7 years to meet our tax and legal obligations.
• Account information is deleted or de-identified if your account has been inactive for 2 years, or when you ask us to delete your account (subject to the booking-record requirement above).
• Marketing preferences are kept until you unsubscribe, after which we keep a record of your opt-out so we do not contact you again.
• Chat assistant logs are kept for up to 30 days, unless they form part of a support request or complaint.
• Cookies expire at different times depending on their type; most analytics and advertising cookies last no more than 2 years.

When we no longer need your Personal Information, we take reasonable steps to destroy it or permanently de-identify it.

You can view and update most of your account details at any time in the My Account section of our website or app. You can also delete your account from within the app or by contacting us.

You may ask us for access to the Personal Information we hold about you, or ask us to correct it, by contacting us at admin@daystaz.com. We will respond within 30 days. We will not charge a fee for your request, but we may charge a reasonable administrative fee for providing copies of large amounts of information. We will tell you about any fee in advance.

To protect your privacy, we may need to verify your identity before we act on your request. In limited circumstances allowed by the Privacy Act, we may refuse access or correction. If we do, we will tell you why in writing and explain how you can complain.

It is important to us that your Personal Information is accurate, complete and up to date. If you find that any information we hold about you is inaccurate or out of date, please update it in your account or let us know so we can correct it.

We may update this Privacy Policy from time to time to reflect changes in our services or the law. The current version will always be available on our website and in our app, with the "Last updated" date shown at the top. If we make a significant change, we will let you know by email or through the app.

If you have a question or a complaint about how we have handled your Personal Information, please contact our Privacy Officer using the details below. Please give us enough detail to investigate. We will acknowledge your complaint promptly and aim to respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Website: https://www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

Privacy Officer, Daystaz
Daystaz Pty Ltd
Email: admin@daystaz.com
Website: www.daystaz.com