Privacy Policy
Last updated: 25 September 2026
1. Who we are and what this covers
Threshld ("we", "us") runs the guest-automation platform at threshld.app. Threshld is part of Humble Abode and operates from Queensland, Australia. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This policy covers two groups of people:
- Hosts: the short-stay operators and their staff who use Threshld.
- Guests: the people who stay at a host's property and use the TV, guest WiFi, guidebook or check-in page.
2. Information about hosts
- Account details: name, email, phone, business name, login details and team members you invite.
- Property details: property names and addresses, check-in and check-out times, WiFi names, guidebook content, photos and branding you upload.
- Connections: the access tokens or API keys you give us for your booking system, locks, climate devices, TV, email and marketing tools. We use these only to act on your behalf.
- Usage and logs: what automations ran, device status, errors and an audit log of changes made in the dashboard.
- Billing: your plan, invoices and payment status. Card details are handled by our payment provider; we don't store full card numbers.
3. Information about guests
We handle guest information on behalf of the host whose property the guest is staying at. Depending on the features the host uses, this can include:
| Where it comes from | What we receive |
|---|---|
| The host's booking system or booking channels (for example Hostfully, Airbnb, Booking.com, Vrbo, direct bookings) | Name, email, phone, booking reference, channel, stay dates, number of guests, payment status, and any updated email or phone the guest later gives. |
| Guest WiFi sign-in page | Name, email, phone and country (the fields the host chooses), the marketing and "book direct" choices the guest ticks, and the device's network (MAC) address so it can be let onto the WiFi. |
| The guest's own check-in page and pre-check-in | Confirmed name, email and mobile, expected arrival time, number of guests and car registration (if the host asks for them), and whether the guest agreed to the house rules. |
| The TV | Issue reports and requests the guest sends from the TV, and any contact details they add. |
| Offers and add-ons | Enquiries or purchases for extras such as late checkout. Card payments are processed by Stripe; we don't see or store card numbers. |
| Locks | The door code for the stay, and lock events such as the first unlock (used to trigger the welcome). |
4. How we use information
- To run the stay: create and remove door codes, show the right welcome and guidebook, let guests onto the WiFi, and time automations such as climate and lighting.
- To show each guest their own details: the door code and address only appear after the checks the host sets (for example, the booking is paid, pre-check-in is done, or the guest confirms their surname).
- To send messages the host has set up (for example, check-in details), under the property's name, with replies going to the host.
- To pass guest contact details to the marketing or CRM tools the host has switched on (see section 6).
- To keep the service working: alerts when a code fails or a booking system stops sending guest details, troubleshooting, security and fraud prevention.
- To bill hosts and to meet our legal obligations.
We don't sell personal information, we don't use it for advertising, and we don't use guest or host data to train AI models.
5. The host's role
For guest information, the host decides what is collected and why. We act as the host's service provider. Hosts must tell their guests how their information is handled, for example through the terms and privacy pages linked from the WiFi sign-in page, and must have a lawful basis for anything they do with it. If you're a guest with a question about your stay, it's usually quickest to contact the host first. You can also contact us (section 14).
6. Marketing
Threshld doesn't send marketing to guests on its own behalf. A host can choose to send guest contact details to their own tools (Mailchimp, GoHighLevel or a webhook). When they do:
- Guests who ticked "keep me updated" are added as subscribers. Others are added only as transactional contacts, or not at all if the host chooses that option.
- We never re-subscribe someone who has unsubscribed.
- We never pass on the platform relay email addresses that booking sites use (for example @guest.booking.com).
- The host is responsible for following the Spam Act 2003 (Cth), including consent and a working unsubscribe.
7. Who we share information with
We share information only with service providers that help us run Threshld, and with the services the host connects:
| Who | Why |
|---|---|
| Hosting provider | Runs the Threshld servers and databases. |
| Amazon Web Services (Sydney region) | Sends emails for the host. |
| Booking systems and a booking-sync provider | Bring bookings and guest details in from the host's PMS and channels (Airbnb, Booking.com, Vrbo, direct). |
| Lock and device makers (for example Schlage, TTLock, Sensibo, Tuya, Google) | Program door codes and control devices at the property. |
| Ubiquiti UniFi | Runs the guest WiFi. Threshld hosts its own UniFi controller. |
| Mailchimp, GoHighLevel, webhooks | Only when the host switches them on (section 6). |
| Stripe | Takes payments for offers and add-ons. |
| Microsoft 365 | Our own business email and support. |
We may also disclose information if the law requires it, or to protect someone's safety.
8. Information sent overseas
Some of these providers store or process data outside Australia, mainly in the United States (for example Mailchimp, GoHighLevel, Google, Stripe and some device makers' clouds). Where we use them, we take reasonable steps to make sure they protect the information in line with the APPs.
9. Google user data
If a host connects Google Home, Threshld may read the structures, rooms and devices the host authorises, and send the commands the host sets up (for example announcements or device actions linked to a booking). We request only the permissions needed for the features the host uses. Threshld's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
10. Security
- All traffic to Threshld is encrypted in transit (HTTPS).
- Passwords, API keys and tokens are kept in a restricted store on the server. They are never shown back in full in the dashboard.
- Door codes and addresses are shown only to the right guest, after the checks the host sets. Guessable booking links also need the guest to confirm their surname or phone.
- Access to production systems is limited to the people who need it to run and support the service.
If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.
11. How long we keep it
We keep host and guest information while the host's account is active, unless the host deletes it sooner. When a host closes their account, we delete their data within 30 days, except where the law requires us to keep it (for example, tax records). Hosts can ask us for an export first.
12. Cookies
We only use cookies we need to run the service:
- a login session for the dashboard;
- on a guest's check-in page, a cookie that remembers the guest has confirmed their booking on that device;
- on the WiFi sign-in page, what is needed to keep the device connected.
We don't use advertising or cross-site tracking cookies. Our public pages load fonts from Google Fonts, which means Google receives your IP address when the page loads.
13. Your rights and complaints
You can ask to access or correct the personal information we hold about you, or ask us to delete it. Email us (section 14) and we'll respond within 30 days. For guest information, we may need to check with the host, because it's their booking record.
If you have a complaint, contact us first and we'll try to fix it. If you're not satisfied, you can contact the Office of the Australian Information Commissioner.
Threshld is not directed at children. Hosts must be 18 or older.
14. Changes and contact
If we make a significant change to this policy, we'll let hosts know by email or in the dashboard at least 14 days before it applies. The date at the top shows the current version.
Privacy contact: colby@humbleabode.com.au
Threshld, part of Humble Abode, Queensland, Australia.