What we collect, who else touches it, where in the world it goes, and what you can require of us under the Privacy Act 2020.
GoCushy is software operated by Daom Limited, a New Zealand registered company.
| Legal entity | Daom Limited |
|---|---|
| NZ company number | 9403442 |
| Registered office | 25 Broderick Road, Johnsonville, Wellington 6037, New Zealand |
| Governing law | New Zealand |
| Contact | hello@gocushy.com |
You can verify the company independently and for free on the New Zealand Companies Register at companies-register.companiesoffice.govt.nz. We publish the number so you can check it rather than take our word for it — the register records that the company exists and who its directors are, which is a different thing from any government approval of the product, and we do not claim the latter.
We collect what is needed to run your account and your checkouts, and nothing else. We do not sell personal information. We do not use your data, or your buyers’ data, to train or improve any AI model.
Card numbers never touch our servers — buyers type them directly into Stripe’s, PayPal’s or Airwallex’s own embedded fields.
To operate checkouts, deliver receipts and the follow-up you configure, show you your own sales data, and — for waitlist signups — send GoCushy updates. That is the complete list.
Stripe (payments), Fly.io (hosting, Sydney region) and Resend (transactional email). Where you connect them, data also flows to services you choose: PayPal, Airwallex, Xero, and your email platform. Each processes data under its own privacy terms, and services you connect act on your instructions rather than ours.
Some processors are outside New Zealand: hosting is with Fly.io in Sydney, Australia; transactional email and payment processing are in the United States.
Under Information Privacy Principle 12 of the Privacy Act 2020 we disclose personal information overseas only on a permitted basis. Each provider is bound by a data-processing agreement incorporating Standard Contractual Clauses, or equivalent, requiring safeguards comparable to the Privacy Act — IPP 12(1)(f).
Information held overseas may be accessible to the courts and authorities of those countries. We say so because IPP 12 is about informed disclosure, not reassurance.
Card numbers never reach our servers. Connected-service credentials are stored encrypted; passwords and API keys are stored hashed. All traffic is HTTPS with HSTS.
Essential cookies run the product: a dashboard session cookie, a CSRF token, a trusted-device cookie if you enable device verification, and — where a checkout link carries a referral code — a first-party affiliate-attribution cookie set on the merchant’s behalf.
Advertising and analytics cookies are used on our own marketing pages only, to measure our advertising.
Your buyers are not our audience. GoCushy never places advertising or analytics trackers on merchants’ checkout pages, the buyer portal, invoices, or the dashboard for our own marketing. Buyers on your checkout are your customers, and we do not track them for our benefit.
Account data, order history and the activity log are kept while the account exists. Order and invoice records may be retained as long as tax law requires — in New Zealand that is seven years. Closing an account deletes its data; to close yours, email hello@gocushy.com.
If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner as soon as practicable and notify the affected individuals — or, where a merchant’s buyers are affected, that merchant — as required by Part 6 of the Privacy Act 2020.
We notify you, not your buyers. They are your customers and that notice is yours to give. We will help you give it.
Under the Privacy Act 2020 you may request access to, or correction of, your personal information, and we must respond within 20 working days. Write to hello@gocushy.com.
If you bought something from a merchant using GoCushy, contact that merchant first — they control the customer relationship and we hold their buyer data on their instructions.
If we cannot resolve your complaint, you can complain to the Office of the Privacy Commissioner — privacy.org.nz, 0800 803 909 — which may refer unresolved matters to the Human Rights Review Tribunal.
Last updated 19 August 2026.
This policy has not been reviewed by a lawyer. If anything here is wrong or unclear, please tell us at hello@gocushy.com.
Tell us what's happening and we'll email you back. A real person reads every message.
We'll reply to . If it's urgent you can also email support@gocushy.com.