Privacy Policy

Who you are dealing with

GoCushy is software operated by Daom Limited, a New Zealand registered company. This policy covers GoCushy however you use it: the GoCushy app on your phone, or GoCushy on the web.

You can verify the company independently and for free on the New Zealand Companies Register at companies-register.companiesoffice.govt.nz. We publish the number so you can check it rather than take our word for it — the register records that the company exists and who its directors are, which is a different thing from any government approval of the product, and we do not claim the latter.

The short version

We collect what is needed to run your account and your checkouts, and nothing else. We do not sell personal information. We do not use your data, or your buyers’ data, to train or improve any AI model.

Card numbers never touch our servers — buyers type them directly into Stripe’s, PayPal’s or Airwallex’s own embedded fields.

The GoCushy app contains no advertising, analytics or crash-reporting software.

What we collect

• Merchant data: your name, email, hashed password, hashed API keys, product and offer configuration, and connected-service credentials, stored encrypted.
• Buyer data, on your behalf: name, email and order details, and the IP address an order was placed from. Never card numbers.
• Waitlist signups: email address and signup source.
• Account activity log: a record of meaningful actions on your account — taken in the dashboard, by your connected AI, or automatically. It exists so you can always see what happened; it is visible only to your account.
• Sign-in records: when you sign in, we record the IP address and the type of browser or device, and we email you when a sign-in comes from a device we have not seen before.

From the GoCushy app

• Device details: when you sign in, the app sends your phone’s device name (the name set on the phone), whether it is an iPhone or an Android phone, its operating-system version and the app version. We store the device name, the phone type and the app version with that sign-in.
• Push notifications, only if you allow them: the app asks your permission first. If you allow notifications, the app sends us your phone’s push token and phone type, and we use them only to send the notifications you have switched on: new sales, refunds and paid requests. A notification can show the amount, what was bought and the buyer’s first name. You can switch each kind off, or hide amounts on the lock screen, in the app’s notification settings.
• Staying signed in: the app keeps its sign-in token in your phone’s secure storage.
• Face ID or fingerprint: when you confirm a refund with Face ID or a fingerprint, the check happens on your phone. We never receive your face or fingerprint data.

How it is used

To operate checkouts, deliver receipts and the follow-up you configure, show you your own sales data, send the app notifications you switch on, keep your account secure, and — for waitlist signups — send GoCushy updates. That is the complete list.

Who else processes it

Stripe (payments), Fly.io (hosting, Sydney region) and Resend (transactional email). Where you connect them, data also flows to services you choose: PayPal, Airwallex, Xero, and your email platform. Each processes data under its own privacy terms, and services you connect act on your instructions rather than ours.

If you allow push notifications in the app, the push token and the notification text go to Expo, which runs the app’s push service, and from Expo to Apple (iPhone) or Google (Android), which deliver the notification to your phone.

Sending information overseas

Some processors are outside New Zealand: hosting is with Fly.io in Sydney, Australia; transactional email and payment processing are in the United States. Expo, Apple and Google, which carry push notifications, are also outside New Zealand.

Under Information Privacy Principle 12 of the Privacy Act 2020 we disclose personal information overseas only on a permitted basis. Our hosting, email and payment providers are each bound by a data-processing agreement incorporating Standard Contractual Clauses, or equivalent, requiring safeguards comparable to the Privacy Act — IPP 12(1)(f).

Push notifications are optional. You choose whether to allow them, and you can switch them off at any time in the app or in your phone’s settings.

Information held overseas may be accessible to the courts and authorities of those countries. We say so because IPP 12 is about informed disclosure, not reassurance.

Security

Card numbers never reach our servers. Connected-service credentials are stored encrypted; passwords and API keys are stored hashed. All traffic is HTTPS with HSTS. On your phone, the app keeps its sign-in token in the phone’s secure storage.

Cookies

Essential cookies run the product: a dashboard session cookie, a CSRF token, a trusted-device cookie if you enable device verification, and — where a checkout link carries a referral code — a first-party affiliate-attribution cookie set on the merchant’s behalf.

Advertising and analytics cookies are used on our own marketing pages only, to measure our advertising.

How long we keep it

Account data, order history and the activity log are kept while your account exists. When you sign out of the app, it asks us to delete that phone’s push registration.

You can delete your account in the GoCushy app under Settings, then Delete account, or on the web under Settings, or by emailing support@gocushy.com from the email address you sign in with. When you do:

• your sign-in email, name, password, phone number, remembered devices and push registrations are deleted straight away, and every signed-in device is signed out;
• your business records — sales, orders and tax invoices, including the buyer details on them — are kept for 7 years from the date you delete your account, because New Zealand tax law requires sales and invoice records to be kept.

Delete your GoCushy account sets out what is deleted, what is switched off and what is kept.

If something goes wrong

If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner as soon as practicable and notify the affected individuals — or, where a merchant’s buyers are affected, that merchant — as required by Part 6 of the Privacy Act 2020.

We notify you, not your buyers. They are your customers and that notice is yours to give. We will help you give it.

Your rights

Under the Privacy Act 2020 you may request access to, or correction of, your personal information, and we must respond within 20 working days. Write to support@gocushy.com.

If you bought something from a merchant using GoCushy, contact that merchant first — they control the customer relationship and we hold their buyer data on their instructions.

Complaints

If we cannot resolve your complaint, you can complain to the Office of the Privacy Commissioner — privacy.org.nz, 0800 803 909 — which may refer unresolved matters to the Human Rights Review Tribunal.

Last updated 26 September 2026.

If anything here is wrong or unclear, please tell us at support@gocushy.com.