Privacy Policy

Last updated: 2026-06-24

This is a starting template for a short-term-rental management service. Replace the bracketed placeholders and have it reviewed by a lawyer before you rely on it.

This Privacy Policy explains how [Operator / Company name] ("we", "us") collects and processes personal data when you use our short-term-rental management service (the "Service"). For data-protection questions, contact [privacy@yourdomain.com]. Data controller: [Operator legal name, address].

Data we collect

Account data — name, email and login, via our authentication provider (Clerk).
Property & operational data — units, prices, calendars, reservations and notes you enter.
Guest data — names, emails and booking details that hosts add or that guests submit on a direct-booking page.
Payment data — handled by Paddle; we store only a customer/subscription reference, never card numbers.
Technical data — IP, device/browser and basic usage needed to run and secure the Service.

How we use it

To provide and secure the Service, process subscriptions, send service and guest communications you trigger, and improve the product. We do not sell personal data.

Processors we use

We share data only with sub-processors needed to run the Service:

Clerk — authentication / accounts
Supabase — database & storage
Paddle — subscription payments and invoicing
Vercel — hosting
OpenRouter — optional AI text features
[Resend / email provider] — guest & service emails

Cookies

We use strictly necessary cookies for login/session and a small cookie to remember your theme and language. We do not use advertising cookies.

Retention

We keep data while your account is active and as required for legal/accounting purposes, then delete or anonymize it. You can request deletion at any time.

Your rights (GDPR)

If you are in the EU/EEA you have the right to access, correct, delete, restrict, port and object to processing of your personal data. To exercise these, email [privacy@yourdomain.com]. You may also lodge a complaint with your local data-protection authority.

Security & transfers

Access is protected by per-tenant isolation and encryption in transit. Some processors may process data outside your country under appropriate safeguards.

Changes & contact

We may update this policy; material changes will be posted here. Questions: [privacy@yourdomain.com].