Privacy Policy

We only ask for the details we need to host you well, and we look after them. This page explains what we collect, why, where it is kept and what your rights are. It follows the Australian Privacy Principles in the Privacy Act 1988.

01Who we are

Illaroo House is a holiday rental in Shoal Bay, New South Wales (STRA registration PID-STRA-83589). When this policy says "we" or "us", it means the owners and managers of Illaroo House. You can reach us any time at [email protected].

02What we collect

• Your name, email address and phone number
• Your booking details, such as dates, the number of guests and whether you are bringing a dog
• Anything you tell us in an enquiry, message or email, for example that you need a cot
• Payment information, which is collected and held by our payment provider (see section 05)
• Identification, only if we need it to verify a booking

We collect this directly from you when you enquire, book or message us. If you book through Airbnb, Booking.com or Stayz, that platform passes your booking details on to us. You are welcome to make a general enquiry without telling us who you are, but we can't take a booking without your details.

03Why we collect it

• To answer your enquiry, and to take and manage your booking
• To process payments, and to keep your card on file as the security bond under our booking terms
• To send you what you need for your stay, such as check-in details and the guest book
• To meet our legal obligations, including the NSW rules for short-term rental accommodation, tax and record keeping
• To sort out any problems, damage claims or disputes
• To stay in touch after your stay, including letting you know about the 10% discount we offer returning guests

We don't sell your information, and we never pass it to anyone else for their marketing. If you have stayed with us, we may email you now and then with your returning guest discount or news about the house. We keep these emails occasional. If you would rather not receive them, just reply or email us at [email protected] and we will take you off the list.

04Where your information is kept

We don't keep paper files or our own customer database. Your information is stored securely with three established providers:

• Stripe, which processes payments and stores saved cards
• Hospitable, which manages our bookings, calendar and guest messaging
• Microsoft 365, which hosts our email

Access to these accounts is limited to the people who run Illaroo House, and is protected by strong passwords and, where available, multi-factor authentication.

05Your card details

We never see or store your full card number ourselves. Card details are entered on Stripe's secure payment page and held by Stripe, which is certified to the payment card industry's security standard (PCI DSS). All we can see is the card type, the last four digits and the expiry date. A saved card is only ever charged in line with the booking terms you agreed to.

06Who we share it with

Only the people and services needed to run your stay: the providers listed above, the booking platform you used (if any), and our onsite contact, who may be given your name, dates and phone number. We may also share information with our professional advisers or insurers if there is a claim, or where the law requires it.

07Information held overseas

Stripe, Hospitable and Microsoft may store or process information on servers outside Australia, including in the United States and Europe. We use reputable providers with strong security and privacy commitments, and we take reasonable steps to make sure your information is handled in line with the Australian Privacy Principles.

08Security cameras

For guest and property safety, outdoor security cameras cover the entry points and driveway at the house. There are no cameras inside the house, and the front deck seating area is deliberately kept out of view. Footage is stored securely by the camera provider and is only reviewed if there is a security or safety reason to do so.

09This website

This website doesn't use advertising trackers or analytics cookies. The enquiry form simply opens your own email app, so nothing is sent to us until you press send. The site does load fonts and a map from Google, which means Google receives basic technical information such as your IP address when you visit.

10How long we keep it

We keep booking and payment records for as long as the law requires, which is generally five to seven years for tax and business records. When we no longer need your information, we delete it or remove anything that identifies you. If you would like your saved card removed after your stay, just ask and we will remove it once your bond period has ended.

11Seeing or correcting your information

You can ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We will respond within 30 days, and there is no charge.