What we do with your data, in plain language

Separation between accounts

• Database row-level security scopes every host to their own account and their own properties. It is enforced at the database, not only in application code.
• Guests are not database users. Guest reads and writes are explicitly scoped to one property and one stay, so a guest link cannot reach another property or another stay.
• The privileged service key is server-only and is never exposed to a browser.
• Security-relevant actions are written to an append-only audit log.

Guest data

• Guest contact identifiers are stored as hashes rather than in the clear.
• Our logger redacts secrets, tokens, email addresses, and long digit sequences before anything is written out. Access codes, phone numbers, and message bodies are kept out of error tracking and analytics by design.
• Automated abuse on guest verification is rate limited.
• All traffic is served over HTTPS. Data at rest is encrypted by our database and hosting providers.

AI routing, and what models are allowed to keep

This is the question hosts ask most, so it gets a direct answer.

• Personally identifiable information is redacted from content before it is sent to any external model router.
• Model requests are routed through a gateway where we request no data retention and opt out of provider model training. Your property documents are not training data.
• The current model-per-task register is published in the AI disclosure and use policy rather than left vague.
• Answers are generated only from material you approved for that property, and can cite the source. When confidence is low the question escalates to you. How it works covers the mechanism.

Payments

Card data is handled solely by Stripe, which is PCI-DSS compliant, and is never stored by us. We cannot see or update your card details, which is also why a billing fix has to be done by you rather than by support on your behalf.

Infrastructure and monitoring

• The platform runs on managed, patched infrastructure. Dependencies are tracked and updated.
• Application errors and traces are captured for debugging, with the redaction rules above applied first.

Your rights over your data

• Export. Download a JSON copy of your account, properties, and content from Dashboard, then Profile. Card data is not included because Stripe holds it, not us.
• Deletion. A two-step request and confirm flow removes personal and property data. Billing, legal-acceptance, and audit records are retained where tax and compliance law requires it.
• Breach notification. We commit to a 72-hour notification window, consistent with GDPR Article 33.
• Data rights requests are acknowledged promptly and fulfilled within statutory timeframes. The process is documented in the support policy.

What we do not claim

A trust page that lists only strengths is not a trust page. As of this review date:

• We do not hold SOC 2, ISO 27001, or any third-party security certification. Our controls are modeled on recognised frameworks, but modeled on is not audited against, and we will not blur the two. Current assurance status is stated in the Security Overview.
• We do not offer a paid bug bounty. We do read and act on responsible disclosures, and support has the reporting path.
• We do not claim the assistant cannot be wrong. It is constrained to your approved material and it escalates when unsure, which reduces the failure rate but does not make it zero.
• We do not claim to be an emergency service. Safety situations route to a human, and guests are directed to local emergency services.

Reporting a problem

If you find a vulnerability, report it privately with the affected endpoint, reproduction steps, and what you were able to access. Please do not test against another host’s property or a live guest stay. The reporting path is on the support page.