Privacy policy

What we collect

• Booking details. Name, email address, phone number, party size and travel dates you give us when you request or complete a booking. Phone numbers are normalised to a single international format so we can reach you on the number you gave us.
• Payment information — not card numbers. Card and payment details are entered directly into Stripe or PayPal's own secure, PCI-DSS compliant checkout and never reach Kalena's servers. We retain only the outcome of a payment (amount, currency, status, a processor reference) — never the card number, CVV or full account details.
• Messages. If you message our concierge, an operator, or Kalena support (including by WhatsApp or SMS), we keep a record of that conversation to answer it, hand it to the right person, and resolve any dispute about what was said.
• Account information. If you create an account, we hold your email address and the authentication record needed to sign you back in.
• Analytics — guest-only, no personal identifiers. We record anonymous, aggregate browsing events (pages viewed, searches run, buttons clicked) to understand which pages and listings are useful. This feed deliberately excludes staff and internal-tool traffic, and does not knowingly collect names, emails or payment details as part of an analytics event.
• Cookies. We use functional cookies needed to keep you signed in and to remember basic preferences (currency, country). We do not run third-party advertising pixels without your consent where local law requires it.

Information we receive from someone else

Sometimes we hold information about you that you did not give us yourself. This is the notice that New Zealand's Privacy Act 2020 asks us to give you in that case.

• Where it comes from. A tour, transfer or accommodation operator who takes a booking on your behalf through its own Kalena page; a friend, family member, colleague or travel agent who books for a group you are part of; or an operator forwarding an enquiry you sent them.
• What it is. Typically your name, and as much of your email address, phone number, travel dates, party size and special requests as the person booking chose to pass on.
• Why we hold it. To confirm and deliver the booking, to contact you about it (for example a pick-up time), to handle payment, refunds and disputes, and to meet our accounting and tax obligations. We do not use it to market to you.
• Who else receives it. The operator delivering the service, our payment processors (Stripe, PayPal) where a payment is involved, and Navicaters Limited staff — the same recipients listed under “Who we share it with” below.
• Your rights. You can ask to see the information we hold about you, ask us to correct it, or ask us to delete it, as described under “Your choices” and “Contact” below. If you think someone gave us your details without good reason, tell us and we will look into it.

How we use it

• To process and confirm your booking, and to pass the details the operator needs to deliver it — no more than that.
• To send booking confirmations, itinerary updates and, where you have opted in, WhatsApp/SMS reminders (for example, transfer pickup times).
• To respond to enquiries sent through the concierge, WhatsApp, email or a contact form.
• To detect and prevent fraud, abuse and payment disputes.
• To understand, in aggregate, how the site is used, so we can fix what is broken and build what is missing.
• To meet our accounting, tax and legal obligations.

We do not sell your personal data, and we do not share it with anyone beyond what is needed to deliver your booking (see below).

Who we share it with

• The operator you booked with — the hotel, tour company or transfer company — receives what it needs to provide the service: your name, contact details, dates, party size and any special requests.
• Payment processors (Stripe, PayPal) handle the transaction directly; see their own privacy policies for how they handle payment data.
• Navicaters Limited staff operating Kalena, on a need-to-know basis, to run bookings, support and payouts.
• We disclose data to a third party beyond the above only where required by law, or with your consent.

AI features

Kalena's trip-planning concierge is an AI assistant and identifies itself as such when you chat with it. Messages you send it are processed to generate a response and are not used to place a booking without your action. Kalena also operates a read-only interface (MCP) that lets third-party AI assistants search our public catalogue and price — see llms.txt. That interface never receives your personal data; it answers questions about published listings and prices, nothing about any individual guest.

How long we keep it

We keep booking and payment records for as long as needed for accounting, tax and dispute-resolution purposes, which means for seven years after the booking — the period New Zealand tax law requires us to keep business records. Message history is kept for as long as your account or an open booking exists, or as needed to resolve a dispute. Aggregate analytics events are not tied to your identity and are kept for trend reporting. You can ask us to delete personal data we hold about you at any time — see Contact below — and we will do so unless we are required to keep it (for example, a completed transaction record).

Security

Card payments are handled entirely by Stripe and PayPal — Kalena never stores your card number. Access to the systems that hold booking and account data is restricted to authorised staff and enforced at the database level. No system is perfectly secure, and we cannot guarantee absolute security of information transmitted over the internet.

Your choices

• You can ask us what personal data we hold about you, correct it, or ask us to delete it, by emailing us (see Contact) or through Delete your account.
• You can opt out of non-essential messages (marketing, non-booking WhatsApp/SMS) at any time; we will still send booking-critical messages (confirmations, pickup times) for a booking you have made.
• You can decline non-essential cookies in your browser; the site remains usable without them.

Children

Kalena is not directed at children, and we do not knowingly collect personal data from anyone under 16.

Changes to this policy

We may update this policy as Kalena changes. We will update the "Last updated" date above when we do; continued use of the site after a change means you accept the updated policy.

The Kalena Operator app

Kalena Operator is the app hosts, tour and transfer operators and their staff use to run bookings. It is the same service as kalena.fun/host, whether opened in a browser, installed to a home screen, or installed from Google Play.

• What it collects about you: the name and email address from the Google account you sign in with, the phone number and business details you or Kalena add to your operator profile, and when you sign in (kept in our audit log).
• What it shows you: the booking details of guests who have booked with your business — name, contact details, party size, dates, pickup and payment status. You handle that information on our behalf and under our operator terms; it stays inside the app and is not to be copied elsewhere.
• On your device: the app keeps a read-only copy of the screens you have opened so they can be read without a connection. That copy is deleted when you sign out.
• What it does not do: it does not read your location, contacts, photos or files, does not show advertising, and does not use an advertising identifier. Usage is measured with cookieless, aggregate analytics only.
• Who processes it: our hosting and database providers (Vercel, Supabase) and our email provider (Resend), each under their own data-processing terms. We do not sell or share it with anyone for their own purposes.
• Deleting your account: from the app's Property & staff screen, or at kalena.fun/account/delete.

Contact

Questions about this policy, or a request about your data, go to contact@kalena.fun.