What we collect, who else touches it, where in the world it goes, and what you can require of us under the Privacy Act 2020.
GoCushy is software operated by Daom Limited, a New Zealand registered company. This policy covers GoCushy however you use it: the GoCushy app on your phone, or GoCushy on the web.
| Legal entity | Daom Limited |
|---|---|
| NZ company number | 9403442 |
| Registered office | Flat 6, 25 Broderick Road, Johnsonville, Wellington 6037, New Zealand |
| Governing law | New Zealand |
| Contact | support@gocushy.co.nz |
You can verify the company independently and for free on the New Zealand Companies Register at companies-register.companiesoffice.govt.nz. We publish the number so you can check it rather than take our word for it — the register records that the company exists and who its directors are, which is a different thing from any government approval of the product, and we do not claim the latter.
We collect what is needed to run your account and your checkouts, and nothing else. We do not sell personal information. We do not use your data, or your buyers’ data, to train or improve any AI model.
Card numbers never touch our servers — buyers type them directly into Stripe’s, PayPal’s or Airwallex’s own embedded fields.
The GoCushy app contains no advertising, analytics or crash-reporting software.
To operate checkouts, deliver receipts and the follow-up you configure, show you your own sales data, send the app notifications you switch on, keep your account secure, prepare and email your requested worksheets, and — for waitlist signups — send GoCushy updates. That is the complete list.
When you use these worksheets, we store your email address, which tool you used, your answers and when you submitted them, so we can show and email your result. If you completed an avatar in the same browser session with the same email address, we can use its customer description to fill your StoryBrand worksheet.
We check daily and delete worksheet entries older than 365 days. To ask for access, correction or earlier deletion, email support@gocushy.co.nz from the address you used for the worksheet. We verify that you control that address before acting.
Worksheet entries are separate from GoCushy accounts: deleting your GoCushy account does not remove your worksheet entries unless you ask us to delete those too. Otherwise, the retention period above applies. Copies already delivered to your inbox remain there.
We add your email address to our email provider, Kit (ConvertKit), tagged nz-tools, so we can send GoCushy tips and workshop invites. Every email has an unsubscribe link. Our hosting and transactional email providers also process the information needed to provide the worksheets.
Stripe (payments), Fly.io (hosting, Sydney region) and Resend (transactional email). Where you connect them, data also flows to services you choose: PayPal, Airwallex, Xero, and your email platform. Each processes data under its own privacy terms, and services you connect act on your instructions rather than ours.
If you allow push notifications in the app, the push token and the notification text go to Expo, which runs the app’s push service, and from Expo to Apple (iPhone) or Google (Android), which deliver the notification to your phone.
Some processors are outside New Zealand: hosting is with Fly.io in Sydney, Australia; transactional email and payment processing are in the United States. Expo, Apple and Google, which carry push notifications, are also outside New Zealand.
Under Information Privacy Principle 12 of the Privacy Act 2020 we disclose personal information overseas only on a permitted basis. Our hosting, email and payment providers are each bound by a data-processing agreement incorporating Standard Contractual Clauses, or equivalent, requiring safeguards comparable to the Privacy Act — IPP 12(1)(f).
Push notifications are optional. You choose whether to allow them, and you can switch them off at any time in the app or in your phone’s settings.
Information held overseas may be accessible to the courts and authorities of those countries. We say so because IPP 12 is about informed disclosure, not reassurance.
Card numbers never reach our servers. Connected-service credentials are stored encrypted; passwords and API keys are stored hashed. All traffic is HTTPS with HSTS. On your phone, the app keeps its sign-in token in the phone’s secure storage.
Essential cookies run the product: a dashboard or worksheet session cookie, a CSRF token, a trusted-device cookie if you enable device verification, and — where a checkout link carries a referral code — a first-party affiliate-attribution cookie set on the merchant’s behalf.
Advertising and analytics cookies are used on our own marketing pages only, to measure our advertising.
Your buyers are not our audience. GoCushy never places advertising or analytics trackers on merchants’ checkout pages, the buyer portal, invoices, or the dashboard for our own marketing. Buyers on your checkout are your customers, and we do not track them for our benefit.
Account data, order history and the activity log are kept while your account exists. When you sign out of the app, it asks us to delete that phone’s push registration.
You can delete your account in the GoCushy app under Settings, then Delete account, or on the web under Settings, or by emailing support@gocushy.co.nz from the email address you sign in with. When you do:
Delete your GoCushy account sets out what is deleted, what is switched off and what is kept.
If a privacy breach occurs that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner as soon as practicable and notify the affected individuals — or, where a merchant’s buyers are affected, that merchant — as required by Part 6 of the Privacy Act 2020.
We notify you, not your buyers. They are your customers and that notice is yours to give. We will help you give it.
Under the Privacy Act 2020 you may request access to, or correction of, your personal information, and we must respond within 20 working days. Write to support@gocushy.co.nz.
If you bought something from a merchant using GoCushy, contact that merchant first — they control the customer relationship and we hold their buyer data on their instructions.
If we cannot resolve your complaint, you can complain to the Office of the Privacy Commissioner — privacy.org.nz, 0800 803 909 — which may refer unresolved matters to the Human Rights Review Tribunal.
Last updated 26 September 2026.
If anything here is wrong or unclear, please tell us at support@gocushy.co.nz.
Tell us what's happening and we'll email you back. A real person reads every message.
We'll reply to . If it's urgent you can also email hello@gocushy.com.