Privacy Policy

Last updated: 26 April 2026

BnB Kiosk is operated by Webfootprint, New Zealand. We take your privacy seriously. This policy explains what information we collect, why we collect it, and how we use it.

1. Who We Are

Webfootprint is a New Zealand business operating the BnB Kiosk platform, accessible at bnbkiosk.net. BnB Direct is a brand of Webfootprint. For privacy enquiries contact us at info@bnbdirect.co.

2. What Information We Collect

Data	Why we collect it	How long we keep it
Your name and email address	Account creation and communication	Duration of account + 90 days after deletion
Property name and location	To display on your TV kiosk	Duration of licence
Property content (Wi-Fi, house rules, etc.)	To power the guest kiosk display	Duration of licence + 90 days
Cleaner names and hashed PINs	Cleaner portal authentication	Until you delete them
Clean logs and timestamps	Cleaning history and management	2 years or until you delete
Booking calendar data	Property calendar management	Duration of licence
Payment information	Processed by Stripe — we store transaction reference only, not card details	7 years (legal requirement)
IP address and device token	TV device enrollment and security	90 days after device revocation
Support messages	Customer support	3 years

3. What We Do NOT Collect

We do not collect any personal information from your guests. The TV kiosk is a display-only device — guests do not log in, register, or submit any data.
We do not use tracking cookies or third-party advertising.
We do not use analytics tools that profile individual users.
We do not sell your data to any third party under any circumstances.

4. How We Use Your Information

To provide the service — storing and displaying your property content on your kiosk TV.
To process payments — via Stripe, our payment processor. Stripe's privacy policy governs their handling of payment data.
To communicate with you — licence renewal reminders, support replies, and service announcements.
To improve the service — aggregate, anonymised usage patterns only. No individual profiling.
For security — rate limiting, device enrollment verification, and fraud prevention.

5. Sharing of Information

We do not sell, rent, or share your personal information with third parties except:

Stripe — for payment processing. Stripe is PCI DSS compliant.
Hosting providers — our servers are hosted in New Zealand / Australia. Data does not leave this region except where you explicitly use features like iCal sync with overseas platforms (Airbnb, Booking.com etc.).
Legal requirement — if required by law, court order, or to protect the safety of others.

6. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

Request access to the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your account and associated data.
Withdraw consent for marketing communications at any time.

To exercise any of these rights, contact us at info@bnbdirect.co. We will respond within 20 working days as required by the Privacy Act.

7. Data Security

All data is transmitted over HTTPS (TLS encryption).
Passwords and PINs are stored as one-way bcrypt hashes — never in plain text.
Database access is restricted to authorised systems only.
Session tokens are cryptographically random and expire automatically.
TV device enrollment uses one-time tokens with short expiry windows.

While we implement strong security measures, no system is completely impenetrable. If you discover a security vulnerability, please contact us immediately at info@bnbdirect.co.

8. Cookies

We use a single session cookie to keep you logged in to your dashboard. This cookie contains no personal information — only an encrypted session identifier. We do not use tracking, advertising, or analytics cookies. No cookie consent banner is required as we use only essential cookies.

9. Data Retention & Deletion

When you stop using BnB Kiosk, your data is retained for 90 days to allow recovery in case of accidental cancellation. After 90 days, all property content, cleaner data, and account information is permanently deleted. Payment transaction records are retained for 7 years as required by New Zealand law.

To request immediate deletion of your account and data, contact us at info@bnbdirect.co.

10. Changes to This Policy

We may update this policy from time to time. The current version is always available at this URL. We will notify active users of material changes by email at least 14 days before they take effect.

11. Complaints

If you have a complaint about how we handle your personal information, please contact us first at info@bnbdirect.co. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner New Zealand at privacy.org.nz.

12. Contact

Webfootprint · BnB Direct
New Zealand
info@bnbdirect.co