1. Introduction
Your privacy matters. This Privacy Policy explains how Escapaide Limited ("Escapaide", "we", "us", or "our") collects, uses, discloses, and protects personal information when you use our website, mobile application, and related services (collectively, the "Platform").
We designed the Platform to make planning and booking travel in New Zealand simpler. To do that well, we need certain information, such as your preferences, traveller details, and payment confirmation. We only use what we need, we share it only where necessary to deliver your journey, and we give you clear ways to access, correct, or delete your information.
This Policy should be read together with our Terms and Conditions. If there is any conflict between this Policy and the Terms regarding how personal information is handled, this Privacy Policy prevails.
2. Who We Are
Escapaide Limited (NZBN 9429052240775) is a company registered in New Zealand with its principal place of business in Christchurch, New Zealand. We are the agency that controls the purpose and means of processing personal information described in this Policy (the "agency" under the Privacy Act 2020).
For privacy questions or requests, contact us at [email protected].
3. Scope of This Policy
This Policy applies to personal information we collect when you:
- visit or browse the Platform;
- create or use a User Account (including signing in with Google);
- generate, customise, or share a travel itinerary;
- make or manage a Booking for Travel Services;
- contact us for support or other enquiries; or
- otherwise interact with us in connection with the Platform.
This Policy does not apply to the privacy practices of Third-Party Suppliers (for example, accommodation providers or activity operators) or other independent third parties. Those parties process information under their own privacy policies once it is shared with them for the purpose of delivering Travel Services you have booked.
4. Information We Collect
"Personal information" means information about an identifiable individual. Depending on how you use the Platform, we may collect the categories of information described below.
4.1 Identity and Account Information
Name, email address, password (when you register with us directly), profile details you choose to provide, and account settings. If you choose to sign in with Google, we access and store only your name and email address from your Google account, as described in detail in Section 8 (Google Sign-In and Google User Data).
4.2 Travel Preferences and Itinerary Information
Destinations, travel dates, number of travellers, interests, budget preferences, itinerary selections, custom edits, and other inputs you provide to generate or refine a personalised itinerary.
4.3 Booking and Traveller Information
Traveller names and other details required to complete a Booking, special requests, contact information for booking communications, and booking history. You are responsible for ensuring any information you provide about other travellers is accurate and that you have authority to share it with us.
4.4 Payment-Related Information
We use Stripe to process payments. Stripe collects and processes your payment card details directly. Escapaide does not store full card numbers on our servers. We may receive limited payment metadata from Stripe, such as payment status, last four digits of a card, card brand, billing country, transaction identifiers, and amounts charged or refunded.
4.5 Communications
Messages you send to us (for example support emails), feedback, and records of our responses. We may also send booking confirmations, account notices, and service-related messages to the email associated with your account or Booking.
4.6 Technical and Usage Information
Device and browser type, IP address, approximate location derived from IP, pages viewed, features used, referring URLs, timestamps, and performance or diagnostic data. We may also generate session identifiers used for analytics and service improvement.
4.7 Location and Maps Data
When you search for places, routes, or map-related features, we use Google Maps and Places services. Search terms, map interactions, and place selections you make may be processed to provide those features.
5. How We Collect Information
We collect personal information:
- Directly from you when you create an account, build an itinerary, complete a Booking, contact support, or otherwise submit information through the Platform;
- Automatically when you use the Platform, through cookies, local storage, session storage, logs, and similar technologies;
- From authentication providers such as Google, if you choose to sign in with those services;
- From payment providers such as Stripe, in connection with payment processing and fraud prevention; and
- From service providers that help us operate infrastructure, communications, maps, analytics, or customer support.
6. How We Use Your Information
We use personal information to:
- provide, operate, and improve the Platform;
- create and manage your User Account and authenticate sign-in (including Google sign-in);
- generate, store, and display personalised travel itineraries and recommendations;
- process, confirm, and administer Bookings with Third-Party Suppliers;
- process payments, refunds, and related financial records;
- send Booking Confirmations, service updates, and other transactional communications;
- respond to enquiries, provide customer support, and resolve disputes;
- detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms;
- analyse usage so we can improve reliability, product design, and user experience;
- comply with legal obligations and enforce our agreements; and
- with your consent where required, send marketing communications (you can opt out at any time).
We do not sell your personal information. We do not use personal information for automated decisions that produce legal or similarly significant effects without appropriate human involvement, other than as needed to operate core booking and payment workflows.
7. Legal Bases and Authorisations
We collect and handle personal information in accordance with the Privacy Act 2020 (New Zealand), including the Information Privacy Principles. In general, we handle your information because:
- You provide it for a clear purpose, for example to create an account, generate an itinerary, or complete a Booking;
- It is necessary to perform our contract with you , including payment processing and facilitating Travel Services;
- We have a legitimate interest, such as securing the Platform, preventing fraud, improving features, and understanding aggregate usage patterns in a privacy-respecting way; or
- We need to comply with a legal obligation , for example tax, accounting, or law-enforcement requirements.
Where consent is required (for example certain marketing uses or optional cookies), we will ask for it and you may withdraw it without affecting the lawfulness of processing that already occurred.
8. Google Sign-In and Google User Data
This section comprehensively describes how Escapaide accesses, uses, stores, and shares Google user data when you use Google to create an account or sign in to the Platform.
8.1 What Google User Data We Access
When you choose "Sign in with Google" (or an equivalent Sign up / Continue with Google option), you authorise Google to share limited account information with Escapaide through Google's OAuth consent process. We request only the basic identity information needed to create and authenticate your Escapaide account.
Google user data we access and store:
- Name (your Google account display name); and
- Email address (your Google account email address).
- Profile picture (your Google account profile picture).
We do not access, request, or store other Google user data for Sign-In purposes. In particular, we do not access your Gmail, Google Drive, Google Calendar, Contacts, photos, location history, or other Google content. We do not store your Google account password, or full Google profile payload beyond the name, email address, and profile picture for your Escapaide account.
OAuth tokens issued by Google (if any) are used solely to complete authentication during the sign-in flow. We do not use Google APIs to read, modify, or monitor other Google user data associated with your account.
8.2 How We Use Google User Data
We use your Google name, email address, and profile picture only to:
- create and identify your Escapaide User Account;
- display your profile picture in the Platform (for example in your account or trip context);
- authenticate your sign-in and keep you logged in securely;
- display your name in the Platform (for example in your account or trip context);
- send service-related communications (such as account notices, Booking Confirmations, and support responses) to your email address; and
- prevent fraud, abuse, and duplicate or unauthorised accounts.
We do not use Google user data to train third-party AI/ML models, build advertising profiles for third parties, sell personal information, or determine creditworthiness. We do not use Google user data for purposes that are unrelated to providing or improving the user-facing features of the Escapaide Platform that you use.
8.3 How We Store Google User Data
After a successful Google sign-in, we store your name, email address, and profile picture on our systems as part of your Escapaide User Account record—the same type of account fields we maintain for users who register with email and password. We store this information while your account remains active, and for a reasonable period afterwards if needed for security, legal, tax, accounting, or dispute-resolution purposes (see also Section 14).
Your Google name, email address, and profile picture are protected using the same technical and organisational security measures described in Section 15, including access controls and encryption of data in transit.
8.4 How We Share Google User Data
We do not sell Google user data. We do not share Google-issued access or refresh tokens with Third-Party Suppliers or advertisers for their independent use.
We may share your name, email address, and profile picture (including when those details originally came from Google Sign-In) only as follows:
- Service providers that help us host the Platform, operate infrastructure, send email, authenticate users, or provide security and support, and who process data only on our instructions;
- Third-Party Suppliers when required to fulfil a Booking you make (for example traveller or contact details on a reservation)—the same sharing that applies to any Escapaide account holder, described in Section 10;
- Legal and safety disclosures where required by law or necessary to protect rights, safety, or the integrity of the Platform; and
- Business transfers in connection with a merger, acquisition, or similar transaction, subject to continued protection consistent with this Policy.
Google itself processes sign-in under Google's own policies. Escapaide does not control Google's independent processing of your Google account. You can review Google's privacy practices at https://policies.google.com/privacy.
8.5 Limited Use and User Control
Google user data obtained through Google Sign-In is used only to provide or improve user-facing features that are prominent in the Platform's user interface (account creation, authentication, personalisation of your account experience, and related service communications). Our use of Google user data complies with Google's API Services User Data Policy, including the Limited Use requirements where applicable.
You can control Google Sign-In as follows:
- revoke Escapaide's access to your Google account at any time via your Google Account permissions (https://myaccount.google.com/permissions);
- request access to, correction of, or deletion of your Escapaide account information (including name and email) as described in Section 16; and
- contact us at [email protected] to close your account or ask privacy questions about Google Sign-In.
Revoking Google access or deleting your Escapaide account may prevent you from signing in with Google until you reconnect or create a new account. Revocation does not delete booking or legal records we are required or permitted to retain.
8.6 Other Google Services Used by the Platform
Separately from Google Sign-In, the Platform may use other Google products (for example Google Maps / Places for trip maps and place search, Google Analytics for product usage measurement, or reCAPTCHA where enabled). Those products process data under their own terms and are described elsewhere in this Policy. They do not expand the Google Sign-In data we store beyond your name, email address and profile picture.
9. AI Features and Personalised Itineraries
How AI uses your inputs: When you generate or refine an itinerary, we process the preferences and constraints you provide (and related account or trip context) to produce recommendations. Those outputs are suggestions only and may not be perfect for your circumstances,please review them before booking.
We use your inputs and itinerary activity to deliver the AI-assisted planning experience you request. We may also use de-identified or aggregated insights from itinerary generation to improve model quality, recommendation relevance, and Platform performance, provided we do not use personal information in ways that undermine your rights under this Policy.
We do not require you to provide sensitive personal information (such as health details) to use the Platform. If you choose to include special notes that may reveal sensitive traits in free-text fields, we will only use that information as needed to support your request.
11. Payments
Payments on the Platform are processed by Stripe. Card details are entered into Stripe's secure payment forms and processed under Stripe's security and privacy standards (including PCI DSS). Escapaide receives confirmation of payment and related transaction records so we can complete your Booking and handle refunds where applicable.
For more detail on how Stripe handles payment data, please review Stripe's privacy documentation at https://stripe.com/privacy.
12. International Transfers
Escapaide is based in New Zealand. Some of our service providers (including payment, cloud, authentication, and maps providers) may store or process information in other countries. Where personal information is disclosed overseas, we take steps consistent with the Privacy Act 2020 so that the information is protected by safeguards comparable to those expected under New Zealand law, or we ensure another permitted basis for disclosure applies.
14. How Long We Keep Information
We keep personal information only for as long as reasonably necessary for the purposes set out in this Policy, including to provide services, meet legal, tax, and accounting requirements, resolve disputes, and enforce agreements. Retention periods vary by information type. For example:
- Account information is retained while your account is active and for a reasonable period afterwards if needed for security, legal claims, or residual bookkeeping;
- Booking and payment records are retained for the period required by commercial and legal recordkeeping obligations; and
- Support correspondence is retained for as long as needed to complete your request and improve our support quality.
When information is no longer required, we take reasonable steps to securely delete it or de-identify it so it can no longer be linked to you.
15. Security
We implement commercially reasonable technical and organisational measures designed to protect personal information against loss, misuse, and unauthorised access, disclosure, alteration, or destruction. These measures include encryption in transit, access controls, secure payment processing through Stripe, and operational practices appropriate to the sensitivity of the information.
No method of transmission or storage is completely secure. While we work hard to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at [email protected].
16. Your Privacy Rights
Under the Privacy Act 2020, you generally have the right to request access to the personal information we hold about you, and to request correction of that information if it is inaccurate, incomplete, or out of date. You may also have additional rights depending on where you live.
In practical terms, you can usually:
- access or update certain account details through your profile settings;
- request a copy of personal information we hold about you;
- request correction of inaccurate information;
- ask us to delete information where we no longer need it (subject to legal retention requirements);
- withdraw consents you have given (for example marketing); and
- opt out of non-essential analytics or marketing where available.
To make a privacy request, email [email protected] with enough detail for us to identify you and understand your request. We may need to verify your identity before responding. We will respond within a reasonable time, and in any event in accordance with applicable law.
Some requests may be limited where permitted by law,for example where fulfilment would unreasonably impact another person's privacy, or where we must retain records for legal or fraud-prevention reasons. If we decline a request, we will explain why where we are able to do so.
17. Children's Privacy
The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information to us, contact us and we will take reasonable steps to delete it.
18. Third-Party Sites and Services
The Platform may link to third-party websites, supplier pages, or services we do not control. This Policy does not cover those third parties. We encourage you to review their privacy notices before providing personal information.
19. Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will post the updated Policy on the Platform and revise the "Last Updated" date above. If changes are material, we will take additional steps that are reasonable in the circumstances,such as a notice on the Platform or an email to account holders,before the changes take effect.
Your continued use of the Platform after an update becomes effective means you acknowledge the revised Policy.
20. Complaints
If you have a concern about how we handle personal information, please contact us first so we can try to resolve it. Email [email protected] with the details of your complaint and we will investigate promptly and fairly.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner in New Zealand: https://www.privacy.org.nz.
21. Contact Us
For privacy questions, access or correction requests, or complaints, contact:
Escapaide Limited
Privacy enquiries
Christchurch, New Zealand
Email: [email protected]
Website: https://www.escapaide.com