Privacy Policy.

SmartStay BnB Limited(“we”, “us”, “our”) is the data controller for the personal information described in this policy. We are a company registered in England and Wales. You can reach our data protection lead at accounts@smartstaybnb.co.uk.

If you are in the UK or EEA, the relevant supervisory authority is the Information Commissioner’s Office (ICO). EU residents may also raise a complaint with their national supervisory authority.

We collect only what we need to run the service — no advertising profiles, no third-party data brokers, no resale.

• •Account data. Your name, email, business name and address, billing details, and the listings you add. Used to set up your account, accept payment, and operate the service.
• •Listing & channel data. Property addresses, calendars, photos, house rules, and pricing pulled from official channel APIs (Airbnb, Vrbo, Booking.com, Stripe, your PMS). Used to run the AI co-host on your behalf.
• •Guest message data. Message threads and guest contact details needed to reply to inquiries, schedule turnovers, and chase cancellations. Used to deliver the messaging service.
• •Usage data. Pages visited, features used, anonymised device and browser info. Used to keep the product reliable and improve the experience.
• •Support data. Anything you send us when you contact support (email, form, screenshot). Used to resolve your request and improve the service.
• •Payment data. Handled by Stripe under their own privacy notice — we never see or store full card numbers. We store the last four digits, brand, and expiry to display in the billing page.

We rely on the following bases under the UK General Data Protection Regulation:

• Contract. Processing your account, listing, and message data is necessary to deliver the service you signed up for.
• Legitimate interests. Keeping the service secure, preventing fraud, and improving product quality — balanced against your rights and freedoms.
• Legal obligation. Retaining billing records for tax and accounting rules, and responding to lawful requests from authorities.
• Consent. For anything optional — marketing email, non-essential cookies — which you can withdraw at any time without affecting the service.

We use a small set of vetted processors to run the service. Each is bound by a data-processing agreement and only receives the minimum data needed for its role.

• •Stripe. Processes subscription payments and one-off invoices. Card data never reaches our servers.
• •Channel APIs (Airbnb, Vrbo, Booking.com). Receive read-write calls from the AI co-host to manage your listings, messaging, and pricing on the official APIs only — no scraping, no shared logins.
• •Cloud hosting & email. Host our application and send transactional email (receipts, alerts, security notices).
• •Analytics. Privacy-friendly product analytics — aggregated page views and feature usage, no advertising identifiers.

Some processors may store or process data outside the UK. Where that happens we rely either on UK adequacy regulations or the international data transfer agreement (IDTA) / standard contractual clauses (SCCs), plus supplementary measures such as encryption at rest and in transit, least-privilege access, and periodic review of sub-processors.

We keep your account data while your account is active and for a maximum of seven years after closure, in line with tax and accounting rules. Backups are deleted on a rolling 30-day window. Guest message data is retained only as long as needed to deliver and improve the service, and is purged within 24 months of the relevant stay.

Under UK GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased (the “right to be forgotten”) where it no longer needs to be processed; restrict or object to processing in defined circumstances; port your data in a machine-readable format; and withdraw consent where we rely on it. To exercise any of these, email accounts@smartstaybnb.co.uk — we respond within one month.

We protect data with TLS in transit, encryption at rest, role-based access controls, audit logging on critical paths, and least-privilege defaults. No system is perfectly secure, but we hold ourselves to a standard appropriate for the sensitivity of the data entrusted to us and review controls quarterly.

The service is built for adult short-term rental operators. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it promptly.

We may update this policy as the service evolves. We will post the revised version here with a new “Last updated” date, and — where the change is material — notify active subscribers by email at least 30 days before it takes effect.

Questions, requests, or concerns? Email accounts@smartstaybnb.co.uk and a Head of Department responds within one business day.