Privacy Policy

BoardMyBoat is operated by Board My Boat Ltd, a New Zealand company. We are the agency responsible for the personal information collected through this website and our booking, messaging and listing tools.

We handle personal information in accordance with the Information Privacy Principles of the New Zealand Privacy Act 2020.

• Enquiry and booking details — your name, contact details, the vessel or experience you selected, dates, start time, duration, party size and any add-ons or notes you provide.
• Messages — the content and metadata of messages exchanged with operators through our relay, so we can deliver them and resolve disputes.
• Operator and host information — listing content, profile photos and business contact details supplied by owners, captains and experience providers.
• Payment information — handled by our payment provider. Card numbers are never stored on our systems; we retain the amount, status and a booking reference.
• Technical and usage data — pages viewed, searches and device/browser information. Analytics-based usage data is only collected if you accept analytics cookies.

• To take, confirm and service your booking, including reminders and confirmations.
• To relay messages between you and the operator without exposing either party's contact details.
• To process payments, including split-payment arrangements you choose.
• To keep the marketplace safe: preventing fraud and misuse, and handling incidents or disputes.
• To improve the site — only with aggregated analytics, and only where you have consented.

We do not sell your personal information, and we do not use your messages for advertising.

Messaging between guests and operators runs through an encrypted SMS relay operated by our communications provider. Each side is shown a relay number rather than the other party's real number. Phone numbers and email addresses are not displayed in the app until a booking is confirmed, and even then only to the parties on that booking.

By opting in to messaging you agree to receive booking-related SMS at the number you provide. You can opt out at any time by replying STOP; we will then contact you by email about your booking instead.

We share only what is needed, with parties who help us run the service:

• The operator of your booking — your name, trip details and (once the booking is confirmed) the contact details needed to meet you on the day.
• Our communications provider — to deliver relayed SMS.
• Our payment provider — to take payment and manage split payments.
• Our hosting, database and email providers — to store data and send transactional email.
• Our analytics provider — only after you accept analytics cookies.

Some of these providers store data outside New Zealand. Where that happens we rely on contractual protections that require comparable safeguards to the Privacy Act 2020. We may also disclose information where the law requires it, or to protect someone's safety.

Essential cookies and local storage keep the site working — remembering your language and currency, your search view, your consent choice and your session. These are always on.

Analytics cookies load only after you select “Accept analytics” in the consent banner. Until then, measurement is denied by default. You can change your mind at any time by clearing this site's data in your browser, which brings the banner back.

Access to guest and operator data is restricted by row-level database rules so people and services can only reach the records they are entitled to. Administrative tools are behind separate authentication. Traffic to the site is encrypted in transit over HTTPS, and contact details are masked in the product surfaces described above.

No system is perfectly secure, so we do not promise that a breach can never happen. If a privacy breach occurs that is likely to cause serious harm, we will notify affected people and the Office of the Privacy Commissioner as required by the Privacy Act 2020.

Under the Privacy Act 2020 you can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. You can also:

• Opt out of relay SMS at any time (reply STOP).
• Decline analytics cookies, or withdraw that consent later.
• Ask us to delete information we no longer need to keep.
• Unsubscribe from marketing email using the link in any such email.

We will respond to a request within 20 working days. If you are not satisfied with how we handle it, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

BoardMyBoat is intended for adults. We do not knowingly collect information from anyone under 18 making their own booking; minors travel as guests on a booking made by an adult.

To make a privacy request, ask a question, or report a security or privacy concern, use the enquiry form on a listing or reply in your existing booking conversation, addressed to the Privacy Officer, Board My Boat Ltd, Aotearoa New Zealand. We will acknowledge your request and confirm the best channel for anything that needs to be handled off-platform.

If you believe you have found a security vulnerability, please report it to us privately and give us a reasonable opportunity to fix it before disclosing it publicly.

We update this page when our practices change. The version you are reading is the current one; material changes will be highlighted on the site or notified to you directly where required.