MyStayPal
FeaturesFor OwnersFar North QueenslandContact
Get Started

Legal

Privacy Policy

Draft — not yet in force

This document is awaiting legal review and still contains unresolved placeholders. It does not yet apply. For anything that affects a current booking or account, contact us at hello@mystaypal.com.au.

Last updated: [TBC — publication date] Effective: [TBC — publication date]

MyStayPal is a property rental and hospitality management platform operated by Cape Bridge Pty Ltd (ABN [TBC]) trading as MyStayPal, of [TBC — registered business address], Australia.

In this policy, "we", "us" and "our" mean Cape Bridge Pty Ltd trading as MyStayPal. "you" means anyone whose personal information we handle — a website visitor, a portal account holder, a guest staying at a property, or a contact at a business that uses our software.

This policy covers:

  • mystaypal.com.au — our software marketing site
  • mystaypal.com.au/fnq — our Far North Queensland guest site
  • portal.mystaypal.com.au — the guest, owner and manager portals
  • any tenant site we host on a customer's behalf
  • email, phone and in-person dealings connected to those services

We have written the full detail below, but in plain terms:

  • We collect the information we need to run bookings, portal accounts and our software — nothing collected "just in case".
  • We do not sell your personal information, and we never will.
  • We do not run advertising, analytics or tracking cookies. The only cookies we set keep you signed in and remember which portal you were heading to.
  • Your booking and account records are stored in Australia, in Sydney. A small number of supporting services operate from overseas — Section 9 sets out exactly which, and what it means.
  • You can ask us what we hold about you, ask us to correct it, and ask us to delete it. Section 13 tells you how.

We handle personal information in two distinct capacities, and your rights work slightly differently in each.

When you visit our websites, create a MyStayPal account, contact us, or book a stay at one of the Far North Queensland properties we manage ourselves, we decide what happens to your information. This policy governs that handling in full, and you should direct any request or complaint to us.

About the FNQ properties. The properties listed under mystaypal.com.au/fnq are managed by Cape Bridge Pty Ltd — the same entity that builds MyStayPal. We run a small property management business in Far North Queensland and we use our own platform to run it. So for those bookings we are both the software provider and the property manager, and this policy applies to you in full.

When a property manager or owner licenses MyStayPal to run their business, they load their own guest and property records into the platform. That information belongs to their business, and they decide how it is used. We hold and process it on their instructions in order to provide the software.

If you are a guest of one of those businesses and you want to access, correct or delete your information, contact that business first — they control the record. If you cannot reach them, contact us at the address in Section 19 and we will help you find the right party and, where we are permitted to, act on your request.

We do not use customer-controlled data for our own purposes. We do not mine it, sell it, or use it to market to their guests.

We collect different information depending on how you deal with us.

You can browse our public pages, property listings and travel guides without telling us who you are. Our hosting provider records standard server logs — IP address, browser type, pages requested and timestamps — which are used for security, troubleshooting and load management, not to profile you.

When you create an account we collect your name, mobile number, email address and the role you hold (guest, property owner, or manager). Your mobile number is required at sign-up and is verified so it can receive a sign-in code: MyStayPal does not use passwords, so we need at least one verified way to reach you with one.

There is no password, and no separate multi-factor step — you authenticate with a single one-time code. You sign in with either your mobile number or your email address, and Clerk, our authentication provider, sends a one-time code to whichever one you used. Clerk delivers the code and confirms it matches; we never see, store or have access to a password, because none exists. SMS codes are sent to Australian numbers only — if your number cannot receive an Australian text message, sign in with your email address instead and we will send the code there.

Owner and manager access is not applied for through the site. As described in Section 6, it is granted by MyStayPal, by invitation, or set up on your behalf by your property manager, and we record who granted it and when — so that access to other people's property and guest data is deliberate rather than automatic. If you created an account before this change, a historical record of an application and its approval may still exist in our systems; we no longer create new ones.

For a reservation we collect and hold:

  • your name, email address and phone number
  • your check-in and check-out dates, and the number of guests staying
  • the amount payable and how the booking reached us (direct, or via a platform such as Airbnb or Booking.com, together with that platform's booking reference)
  • the door access code issued for your stay, and any notes relevant to your booking (for example accessibility requirements or arrival time)
  • your loyalty points balance and the history of how it was earned or redeemed

Door codes are treated as security-sensitive. They are visible only to you and to staff who need them to service your booking, and they are rotated per stay.

Our refer-a-friend feature lets an existing guest send you a personal link. If you follow that link, we place a cookie so that we can credit your friend if you later create an account. If your friend enters your email address to send the invitation, we collect your email address from them, not from you.

We use it only to send that invitation and to record the referral. If you take no action, we delete the address after 90 days. You can tell us to remove it at any time using the contact details in Section 19, and we will not contact you again.

If you are the person sending an invitation: only send one to someone who you reasonably believe would welcome it. You are responsible for having their consent.

Our contact forms collect different information for each type of enquiry:

  • Guest enquiry — name, email, phone, travel dates, party size and your message
  • List your property — name, email, phone, the property's address, and details about the property such as bedroom count, current occupancy and existing bookings
  • Join the team — name, email, phone, and the work history and background you choose to give us

For job enquiries, please do not send us sensitive information — health details, racial or ethnic origin, or similar — unless we specifically ask for it and explain why.

4.6 Content you upload

Property managers and owners upload photographs, descriptions and documents. We record who uploaded each file and when, and we keep previous versions so changes can be rolled back. If a photograph shows an identifiable person, that image is personal information — please do not upload one without that person's consent.

We do not collect payment card numbers. We do not run advertising or analytics tracking. We do not buy personal information from data brokers, and we do not build profiles of you from third-party sources.

We collect information directly from you wherever we can — when you fill in a form, create an account, make a booking, or contact us.

We also receive information from other people, specifically:

  • from booking platforms such as Airbnb or Booking.com, when you book one of our properties through them, and
  • from a friend who refers you, as described in Section 4.4, and
  • from a property manager or owner who adds your reservation to the system on your behalf.

Where we collect your information from someone other than you and you would not otherwise expect it, we will tell you as soon as reasonably practicable.

We use personal information only for the purpose it was collected for, purposes you would reasonably expect, or purposes you have consented to. Specifically:

Purpose What this looks like in practice
Providing accommodation Confirming your booking, issuing your door code, giving you check-in instructions, wifi details and property information
Running your account Authenticating you, showing your current and past reservations, applying role-based access
Loyalty and referrals Awarding points when a stay completes, issuing referral discount codes, showing your balance
Service communication Booking confirmations, changes, access instructions, and anything needed for your stay
Providing the software Operating, supporting and troubleshooting the platform for our business customers
Safety and security Preventing fraudulent bookings, unauthorised account access and property misuse
Improving the service Understanding which features are used so we can fix and improve them
Legal obligations Meeting tax, accounting, and other record-keeping requirements
Marketing Sending you offers or updates, only where you have opted in (see Section 10)

Automated decision-making. We do not use automated processing to make decisions that have a legal or similarly significant effect on you. Owner and manager access is not applied for through the site — it is granted by MyStayPal, by invitation, or set up on your behalf by your property manager. If this changes, we will update this policy before the change takes effect.

We use a small number of cookies, and all of them are strictly functional. We do not use advertising cookies, analytics cookies, tracking pixels or third-party trackers.

Cookie Purpose Lifetime
Clerk session cookies Keeps you signed in and secures your session Session / as set by Clerk
msp-active-portal Remembers which portal you are currently using Until you close your browser
msp-ref Credits the friend who referred you, if you sign up later 30 days

You can block or delete cookies in your browser settings. If you block the session cookies you will not be able to sign in to the portal.

We disclose personal information only as set out below. We do not sell personal information, and we do not disclose it to third parties for their own marketing.

Service providers who help us run the platform:

Provider What they do Where data is held
Supabase Database and file storage — your account records, reservations, door codes, loyalty points and uploaded files Sydney, Australia
Clerk Authentication — verifying your identity and delivering one-time sign-in codes by SMS or email United States
Vercel Website and application hosting, server logs United States and global edge network
Resend Sending transactional email such as booking confirmations Tokyo, Japan

Each is engaged under terms requiring them to protect the information and to use it only to provide services to us.

Others we may share with:

  • Property owners and managers — where you have booked one of their properties, so that they can host you
  • Booking platforms — where your reservation came through them, to keep the booking synchronised
  • Service providers at the property — cleaners, maintenance and similar, limited to what they need (for example, that a property is occupied on certain dates)
  • Professional advisers — lawyers, accountants and insurers, where needed
  • Law enforcement and regulators — where we are required or authorised by law, or where we reasonably believe it is necessary to prevent a serious threat to someone's life, health or safety
  • A buyer — if we sell or restructure our business, in which case the buyer would be bound to handle your information in accordance with this policy

Your booking and account records stay in Australia. Our database and file storage run in Supabase's Sydney region, which means your reservation history, contact details, door codes, loyalty points balance and any files uploaded about your property are held onshore and are subject to Australian law.

Three supporting services operate overseas, and a limited amount of personal information reaches each of them:

Service Where What reaches it
Clerk (authentication) United States Your name, email address, mobile number and the one-time codes used to sign you in
Vercel (hosting) United States Server logs including your IP address, and page data in transit
Resend (email) Tokyo, Japan Your name, email address and the contents of emails we send you — which for a booking includes your stay dates and door code

Your mobile number reaches Clerk in the United States, and Clerk in turn uses a further subprocessor to deliver the SMS itself to Australian numbers. [TBC — confirm the identity and region of Clerk's SMS delivery subprocessor; until this is confirmed, treat this cross-border disclosure as unverified].

Email is the most sensitive of these, because a booking confirmation carries your door code. Our email provider offers no Australian region; we have chosen Tokyo as the closest available, so that this information stays within the Asia-Pacific region rather than crossing to the United States or Europe. Japan regulates personal information under its Act on the Protection of Personal Information.

Before disclosing personal information to an overseas recipient we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, including engaging established providers under contractual terms that require appropriate protection.

You should be aware that overseas recipients are subject to the laws of their own country, and those laws may permit access by foreign authorities in ways Australian law would not. Australian privacy law may not be enforceable against them directly.

By using MyStayPal you acknowledge this disclosure.

Service messages — booking confirmations, door codes, check-in instructions, account and security notices — are part of providing the service and are sent to you regardless of marketing preferences. You cannot opt out of these while you hold a booking or an account.

Marketing messages — offers, property announcements and newsletters — are sent only where you have opted in, or where the law otherwise permits us to send them to an existing customer. Every marketing message includes a functional unsubscribe link, and we will action your unsubscribe promptly. We comply with the Spam Act 2003 (Cth).

If you do not want to receive marketing at all, tell us using the details in Section 19 and we will suppress your address.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Those steps include:

  • storing your records in Australia, in a managed database with encryption at rest
  • encryption of data in transit (HTTPS across every page and API)
  • authentication handled by a specialist provider using one-time codes rather than passwords, so there is no password to be guessed, reused or leaked
  • role-based access control enforced in the database queries themselves, not just hidden in the interface, so a property manager can only reach records belonging to their own properties
  • access to production systems limited to people who need it
  • managed infrastructure that receives security patching from our providers
  • automated tests that specifically verify access boundaries hold

No system is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately.

Please protect your door code. Treat it like a key — do not post it, photograph it publicly, or share it with anyone not staying with you.

We keep personal information only as long as we need it, then destroy it or de-identify it.

Information How long we keep it
Reservation records 7 years after the stay, to meet tax and accounting obligations
Account records While your account is open, then 12 months after closure
Loyalty points ledger While your account is open, as it is your balance history
Referral invitations never accepted 90 days
Contact form enquiries 24 months
Job enquiries 12 months, or sooner if you ask us to delete them
Server logs As retained by our hosting provider, typically 30 days
Customer-controlled data (Part B) For the term of that customer's agreement, then as set out in that agreement

Where we are required by law to keep a record for longer, we will.

You can ask us for a copy of the personal information we hold about you, and you can ask us to correct it if it is wrong.

To make a request, email privacy@mystaypal.com.au with enough detail to identify the information you want. We may need to verify your identity first — that protects you.

We will respond within 30 days. Access is free; if a request is unusually large we may charge a reasonable cost-based fee and will tell you before proceeding.

We may refuse access in the limited circumstances the law allows — for example where giving access would unreasonably affect someone else's privacy. If we refuse, we will tell you why in writing and how to complain.

Deletion. You can ask us to delete your information and we will do so unless we are required to keep it — most commonly a reservation record we must retain for tax purposes. If we cannot delete something, we will tell you what and why.

If your request relates to a booking with a business that uses our software (Part B), that business controls the record — see Section 3.

If you think we have mishandled your personal information or breached the Australian Privacy Principles, tell us. We would rather fix it.

  1. Contact us at privacy@mystaypal.com.au, describing what happened.
  2. We will acknowledge your complaint within 5 business days and give you a written response within 30 days.
  3. If you are not satisfied, you can refer the matter to the Office of the Australian Information Commissioner:
    • Website: oaic.gov.au
    • Phone: 1300 363 992
    • Post: GPO Box 5218, Sydney NSW 2001

We maintain a data breach response plan. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and we will tell you what happened, what information was involved, and what you should do about it.

MyStayPal is not directed at children, and portal accounts are for people aged 18 and over. We may hold the first name and age of a child included in a booking, provided by the adult making it. If you believe a child has given us information directly, contact us and we will delete it.

Our sites link to third-party websites — booking platforms, maps, tourism operators and similar. We are not responsible for their privacy practices. Read their policies before giving them your information.

We may update this policy. The current version is always at mystaypal.com.au/privacy, with the "last updated" date at the top. If we make a change that materially affects how we handle your information, we will tell you — by email if you hold an account, or by a prominent notice on the site.

Privacy enquiries, access requests and complaints

Cape Bridge Pty Ltd trading as MyStayPal ABN [TBC]