Privacy Policy

What we collect

Merchant data: your name, email, hashed password, hashed API keys, product/offer configuration, and connected-service credentials (stored encrypted).
Buyer data (on behalf of merchants): name, email, order details. Card details never touch GoCushy — they go directly to Stripe (or the merchant's PayPal or Airwallex).
EU VAT location check: where a merchant collects EU VAT, we look up the country of the buyer's internet connection in a database that runs inside GoCushy (IP Geolocation by DB-IP, licensed CC BY 4.0). The merchant's tax record keeps that country, not the internet address.
Waitlist signups: email address and signup source.
Account activity log: a record of meaningful actions on a merchant account — taken in the dashboard, by the merchant's connected AI via the API, or automatically (e.g. an order being paid). Entries can include buyer emails on order events. The log exists so merchants can always see what happened on their account; it is visible only to that account and is deleted with it.

How it's used

To operate checkouts, deliver receipts and follow-up automation the merchant configures, show merchants their own sales data, and (for waitlist signups) send GoCushy launch updates. We do not sell personal data.

Processors we use

Stripe (payments), Fly.io (hosting, Sydney region), Resend (transactional email), and Anthropic (hosted AI generation for Pitch and other AI-assisted features). When you use Pitch, the relevant brief, instructions, and generated response are sent to Anthropic's commercial API. Anthropic states that standard API inputs and outputs are deleted from its backend within 30 days, subject to stated exceptions for legal compliance and usage-policy enforcement; its current commercial-data retention information and terms control its processing. Where a merchant connects them, data also flows to services the merchant chooses: PayPal (payments), Airwallex (payments), Xero (accounting), and their email platform (Kit, Mailchimp, ActiveCampaign, GetResponse, Drip, MailerLite, Klaviyo, Brevo, Beehiiv, Loops, Flodesk, HubSpot, or EmailOctopus). Each processes data under its own privacy terms; merchant-connected services act on the merchant's instructions.

Sending information overseas

Some processors are outside New Zealand: hosting is with Fly.io in Sydney, Australia; transactional email (Resend), payment processing (Stripe), and hosted AI generation (Anthropic) may process data in the United States or other locations described in their terms. Under Information Privacy Principle 12 of the Privacy Act 2020 we disclose personal information overseas only on a permitted basis — here, each provider is bound by contractual privacy and security obligations intended to provide comparable safeguards. Where a merchant connects their own services (PayPal, Airwallex, Xero, or an email platform), those transfers are made on the merchant's instructions under the merchant's own privacy terms. Where you consent to advertising cookies on our marketing pages, Meta, Google, and TikTok process that data under their own privacy terms. Information held overseas may be accessible to the courts and authorities of those countries.

Security & cards

Card numbers never touch gocushy's servers — buyers enter them directly into Stripe's (or PayPal's or Airwallex's) own embedded fields. Connected-service credentials are stored encrypted, passwords and API keys are stored hashed, and all traffic is HTTPS with HSTS.

Cookies

Essential cookies run the product: a session cookie for the dashboard, a CSRF token, a trusted-device cookie (if you enable device verification), and — where a checkout link carries a referral code — a first-party affiliate-attribution cookie set on the merchant's behalf.

Advertising & analytics cookies (Meta, Google, TikTok) are used on gocushy's own marketing pages only — the homepage, /founder, /webinar, the blog and docs — to measure our advertising and show our ads to people who visited. Where consent is required (EU/UK), nothing loads until you accept; you can change your choice any time via cookie preferences or by declining in the banner.

Merchant checkouts are different. GoCushy never places advertising or analytics trackers on merchants' checkout pages, the buyer portal, invoices, or the dashboard for gocushy's own marketing. Buyers on a merchant's checkout are the merchant's customers, and we do not track them for our benefit — the only exception is gocushy's own checkout when we sell GoCushy itself.

Trace, where a merchant has enabled it. Trace is gocushy's ad-attribution feature, which a merchant switches on for their own store. When it is on, a checkout link arriving with advertising parameters (a utm_* tag, or a click id such as fbclid or gclid) sets one first-party cookie, gc_attr_<account>, for 90 days, so the merchant can tell which of their own ads and emails produced which of their own sales. It is set on the merchant's behalf, for the merchant's reporting, under the merchant's own privacy policy — gocushy does not read it for our marketing, and it is never set on the checkouts of merchants who have not enabled Trace. A visit carrying no advertising parameters sets nothing. Buyers billed in the EU, UK or EEA — and any buyer whose country we cannot determine — are treated the same way: when the sale is recorded, the per-click advertising identifiers are dropped and only the campaign labels are kept against it, and no server-side advertising event is ever sent for that buyer. The identifiers are not used for advertising, and the cookie expires after 90 days.

Retention & deletion

Account data, order history, and the activity log are kept while the account exists (order and invoice records may be retained as long as tax law requires). Closing an account deletes its data; to close yours, email hello@gocushy.com.

Privacy breaches

If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner as soon as practicable and notify the affected individuals — or, where a merchant's buyers are affected, that merchant — as required by Part 6 of the Privacy Act 2020.

Your rights

Under the New Zealand Privacy Act 2020 (and GDPR where it applies), you can request access to or correction/deletion of your personal information: hello@gocushy.com. Buyers should contact the merchant they purchased from first, as the merchant controls their customer relationship.

Privacy Officer & complaints

Our Privacy Officer (Privacy Act 2020, s 201) is Dan Kung, reachable at privacy@communi.com for access and correction requests and any privacy concern. If we can't resolve your complaint, you can complain to the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909), which may refer unresolved matters to the Human Rights Review Tribunal.

Questions about any of this: hello@gocushy.com