Queenstown.com (“we”, “us”, “the site”), operated by HeadQuarters NDC, is committed to protecting your privacy. This policy explains what personal information we collect, how we use it, and the choices you have. We handle personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs).
Information we collect
- Account information — if you sign in with Google, we receive your name, email address, and profile image from your Google account.
- Usage information — pages visited, searches, and interactions with features such as the AI Concierge and Trip Planner. See Analytics below for how this is measured.
- Affiliate click data — when you click a booking link we record the click with a truncated, hashed IP address (last octet removed) for fraud prevention and commission attribution. We do not store your full IP against these clicks.
- Content you submit — messages to the AI Concierge, trip-planner inputs, and any forms you complete.
- Cookies — see our Cookie Policy.
How we use your information
- To provide and personalise the site’s features (recommendations, trip plans, saved preferences).
- To operate accounts and authenticate sign-in.
- To measure and attribute affiliate referrals so partners can pay any commission owed.
- To improve the site, fix problems, and keep it secure.
- To measure how the site and its features are used (see Analytics).
We do not sell your personal information.
Analytics
We measure how the site is used with Google Analytics 4, operated by Google as our processor. This replaced our previous self-hosted, cookieless analytics on 11 August 2026. Because GA4 stores identifiers on your device, we ask for your consent first and set nothing for analytics until you accept — see our Cookie Policy.
We ask about two separate purposes, and you can agree to one, both, or neither:
- Analytics — measuring pages viewed and in-app actions so we can improve the site.
- Advertising and audience — we use Google signals, which lets Google associate your visit with your signed-in Google account where you have allowed Ads Personalisation. This enables recognising you across devices, aggregate demographic and interest reporting, and building remarketing audiences so we can show you Queenstown.com advertising elsewhere.
Advertising is off unless you switch it on. Unlike analytics, it is never enabled by default anywhere in the world, and it is not pre-ticked. Choosing “Reject all” is one click and leaves it off.
We do not sell your personal information or your analytics data. Google processes this data on our instructions and may transfer it outside New Zealand — including to the United States — under its standard contractual clauses. Aggregate demographic and interest reporting is shown to us in groups, never as a profile of you individually.
If you decline, we still count your visit in an aggregate, cookie-free way: no identifiers are stored on your device, and you are not recognised between visits or across devices.
What we collect for analytics:
- Pages viewed and referrers.
- In-app events — for example starting a chat with Will, submitting or claiming a listing, starting a checkout, and completing a purchase (including the amount, so we can measure revenue).
- Derived, non-identifying session information (such as approximate device type, browser, and country, inferred at collection time — we do not store your full IP address for analytics).
Logged-in users. If you are signed in, we associate this analytics activity with your account using an internal account identifier plus your role and plan/membership tier. We do not attach your name or email address to analytics. This lets us understand how members (versus anonymous visitors) use the site so we can improve it. Anonymous visitors are never identified. You can turn this association off at any time — see Your choices below.
Purpose. Product analytics and improvement only: understanding which features are used, finding and fixing problems, and prioritising what to build next.
Legal basis. For New Zealand users, we process this information for a lawful purpose connected with our functions and activities, and disclose it here, in line with the Privacy Act 2020 and its Information Privacy Principles (transparency, purpose limitation, and use limitation). For visitors in the EU and UK, we rely on your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on storing information on your device). Advertising relies on consent everywhere, not only in the EU and UK.
Withdrawing consent. You can change or withdraw either choice at any time, and it is as easy as giving it — use Manage cookie preferences on our Cookie Policy. Data already collected before you withdrew is not undone by withdrawing, but collection stops and the relevant cookies are removed from your device. To control what Google itself associates with your Google account, see My Ad Center and your Google account’s data controls.
Retention. Analytics records are retained for up to 24 months, after which they are deleted or aggregated into non-identifying summaries.
Your choices. Signed-in members can opt out of identified analytics at any time under Account → Profile & preferences → Privacy. Opting out stops us associating analytics with your account; anonymous, aggregate usage measurement continues, as it does for any visitor. You can also request access to, correction of, or deletion of your data, or raise a concern — see Your rights below.
Third parties we share data with
We use trusted service providers to run the site. Your information may be processed by:
- Supabase — database, authentication, and hosting of account data.
- Google — sign-in (OAuth) and mapping/places data.
- Anthropic (Claude) — powers the AI Concierge and Trip Planner. Messages you send to these features are processed to generate responses.
- Affiliate networks — Viator/Tripadvisor and Awin (Expedia, Trivago, and others). When you follow a booking link you are subject to that partner’s own privacy policy.
AI features
The Concierge and Trip Planner send your inputs to Anthropic’s Claude API to generate responses. Do not share sensitive personal information in these features. Conversations are not used to identify you and are processed only to produce a reply. We also log concierge questions and answers briefly (a rolling window, currently 30 days) to measure answer quality and improve the service; these logs are then deleted, with only anonymous aggregate statistics retained.
Retention
We keep personal information only as long as needed for the purposes above or as required by law. You can ask us to delete your account data at any time (see below).
Your rights
Under the Privacy Act 2020 you have the right to access and request correction of the personal information we hold about you. To exercise these rights, or to ask us to delete your data, contact us at privacy@queenstown.com. You may also raise concerns with the Office of the Privacy Commissioner.
Security
We use industry-standard measures to protect your information, including encrypted connections and access controls. No method of transmission or storage is completely secure, but we take reasonable steps to protect your data.
Changes
We may update this policy from time to time. Material changes will be posted on this page with a new “last updated” date.
Contact
Questions about this policy? Email privacy@queenstown.com.