Security Policy

This page explains how NURI TECHNOLOGY LIMITED (“we”, “us”), which operates NURISTAY, protects the information that properties and their guests put into NURISTAY. It goes with our Privacy Policy, which describes how we handle personal information.

1. Where your data is kept

NURISTAY runs on Microsoft Azure in the New Zealand North region. Enquiries from this website are also stored in NURISTAY, in New Zealand.

This website is delivered by Cloudflare, which also runs the spam check on our forms. It holds no booking or guest data.

2. Signing in and access

• NURISTAY signs in with a password and then a PIN. Passwords are stored in protected form.
• Each login is for one person and one business. Owners add and remove team logins and choose each person’s role, so staff see only what their role needs.
• Sign-ins and key actions are logged, so a property can see who did what.
• Data is encrypted in transit between your device and NURISTAY.

3. Guest documents and card payments

Photos of identification uploaded at online check-in are encrypted, shown to staff only after they enter their PIN, and deleted 7 days after check-out. They are not included in emails, PDFs or backups.

NURISTAY does not store card numbers. Card payments, security deposits and bonds are taken through Stripe, a PCI DSS Level 1 service provider: guests enter their card on Stripe’s secure page, and the card details stay with Stripe. Because the property does not keep card numbers either, there is less risk and less staff training, and card payments taken this way usually need only the simplest PCI DSS check (SAQ A).

Guests can also pay from their bank account through POLi, or pay at the property.

4. Email

When a property connects its Microsoft 365 mailbox, NURISTAY reads booking emails live and does not store them. Card numbers in an email are masked on screen.

5. Backups and recovery

Each property’s data is backed up automatically, and owners can restore it from NURISTAY. The database is also backed up by our hosting provider, Microsoft Azure.

6. Service providers

We use a small number of providers to run NURISTAY: Microsoft (hosting and email), Stripe (online card payments, security deposits and bonds, where a property uses them), POLi (bank account payments, where a property uses them), our channel connection provider (to exchange availability, rates and bookings with channels such as Booking.com and Expedia, where a property uses them) and Cloudflare (this website). They are listed with their purposes in our Privacy Policy.

7. What you can do

• Keep passwords and PINs private and never share a login.
• Remove the login of anyone who leaves your team.
• Tell us straight away if you think a login has been misused.

8. Reporting a security concern

If you find a security problem or think your data has been exposed, email [email protected] with what you saw. We will look into it and reply. If a privacy breach is likely to cause serious harm, we will notify the people affected and the Office of the Privacy Commissioner as the law requires.

No system is perfectly secure, and we keep improving. We will update this page when what we do changes.

9. Contact

NURI TECHNOLOGY LIMITED. Email: [email protected]. Phone: +64 21 262 3483.