Privacy policy

WOWSTAY is committed to protecting your privacy and managing your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy outlines how we collect, use, store, and protect your personal information. By using our services or providing your personal information, you agree to these practices. Please review this policy carefully.

What Information We Collect

We collect personal information, such as your name, contact details, payment information, or booking preferences, which is any information that can identify you. This may be collected:

• Through our website, social media, or booking systems.
• In person during check-in or over the phone.
• Through our online check-in, where you upload a photo of your identification (e.g., driver licence or passport), take a selfie, and save a card for your bond.
• Via ChargeAutomation, our other contactless check-in service, where guests upload identification documents.
• When you enter competitions or complete surveys.

We also collect non-personal information, such as browser type or pages visited, to improve our website experience.

Selfie check

We use your photo ID and selfie to check your identity and help match you to the booking and payment details. Software reads relevant ID details and compares the face in your selfie with the face on your ID. Clear checks may be approved automatically under our check-in rules; checks that are flagged are referred to our team. We also use age and locality information read from your ID when applying our existing damage-waiver eligibility rules. ID reading uses Anthropic, which may process information outside Australia. Face comparison uses Amazon Rekognition in Sydney. Contact our team if you need help with the check or its outcome.

Our AWS account is opted out of using this content for AWS AI service improvement. That opt-out is separate from our responsibility to retain and delete records.

How We Use Your Information

We use your personal information to:

• Process bookings and payments.
• Confirm your identity before you arrive.
• Hold and release your refundable bond.
• Communicate about your stay or service updates.
• Maintain records for legal and accounting purposes.
• Respond to inquiries or improve services.

We may use your information for related purposes you would reasonably expect, such as keeping email correspondence records.

We will not use or share your information beyond these purposes unless:

• You consent to it.
• It's needed to prevent a serious threat to health or safety.
• We suspect unlawful activity and must investigate or report.
• It's required or authorised by law (e.g., court orders or legal processes).

Your Bond

Your card details are handled by Stripe, our payment provider. We never see or store your full card number. Your refundable A$250 bond is a hold on your card, not a charge. It is released 3 days after you check out, unless there is damage or an amount owing.

Sharing Your Information

We may share your personal information with trusted providers who help us run our services, such as Stripe (payments), ChargeAutomation (check-in), Anthropic (reading the details on your photo ID, processed in the United States and other countries), Amazon Web Services (comparing your selfie with your ID photo, processed in Sydney, Australia), our booking system and the booking platforms you book through. Some of these providers store information overseas, including in the United States and other countries. Our own guest records are stored in Sydney, Australia. We take reasonable steps to make sure these providers protect your information in line with the Australian Privacy Principles.

We won't share your information for marketing without your consent. You can opt out of marketing emails by clicking "unsubscribe" or emailing bookings@wowstay.com.au.

We never sell your personal information.

Security and Storage

We protect your personal information from loss, misuse, or unauthorised access by:

• Using SSL encryption for data transmission (e.g., card details or ID uploads).
• Storing data on secure servers, accessible only by authorised staff under confidentiality agreements.
• Securely deleting or de-identifying information when no longer needed, except for legal requirements.

While we strive to secure your data, no internet transmission is 100% secure. We safeguard your information once received.

Retention of Identification Documents

For ID images and selfies held in Guest Hubs, our daily cleanup is scheduled for 3:40 am Brisbane time. Images become eligible after 130 full calendar days following the checkout date. Images linked to a recorded active incident in Guest Hubs are held; once that hold is released, otherwise eligible images enter the next daily cleanup. A failed cleanup can delay deletion.

Deleting the images does not delete every record of the check. Verification outcomes, consent and decision records remain, and some document details, age bands, expiry years, decision reasons and damage-waiver indicators can remain. We have not yet established one deletion period covering all these remaining records.

Copies may also exist in ChargeAutomation, Guesty, emails, exports or backups. We have not verified that all those copies are automatically deleted on the same schedule. This explains the deletion coverage currently verified; it does not establish that copies covered by an earlier notice have been deleted.

Children's Privacy

Our services, including our online check-in, are not intended for children under 16. We do not knowingly collect their information without parental consent. If collected inadvertently, it will be deleted. Children under 16 should not use our website or check-in services without supervision.

Accessing and Correcting Your Information

You can request access to or correction of your personal information by emailing bookings@wowstay.com.au. We'll verify your identity and respond within 30 days.

Data Breach Notification

In case of a data breach, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

Guest Hub Records

When you use your WOWSTAY Guest Hub, we keep a record of each visit (the time and the type of device), which pages, guides and terms you opened and for how long, when your key code, Wi-Fi details or check-out steps were shown to you, and the requests and messages you sent through it. This record cannot be changed by our staff. It is kept for 6 months after your stay, or until any open dispute is resolved, and is then deleted automatically.