Privacy Policy

Who we are

Stayem (the website stayem.com and the Stayem apps) is operated by IncubIQ Solutions Ltd, a company registered in England and Wales under number 08788612, based in Cardiff, United Kingdom (“we”, “us”). Contact: hello [at] stayem.com.

Our role depends on whose data it is:

• For owners (people with a Stayem account), for website visitors and for people who use our free tools, we decide how the data is used: we are the controller.
• For the guests, team members (cleaners, co-hosts and other helpers) and booking enquirers of an owner, the owner is the controller and we process the data on the owner's behalf, to run the service for them. If you are a guest, the owner you are staying with is your first point of contact; we will help them answer you.

We do not sell personal data, and we do not use it for advertising.

If you have a Stayem account

• Account: your email address, and your name and language if you add them. Your email is how you sign in: we send a one-time code to it.
• Sign-in: one-time codes and sessions, stored only as one-way hashes, never the code or token itself.
• Activity: when your account was created, when it was last used, and whether that was on the website or the iPhone or Android app.
• How you found us: recorded once, at your first sign-in, and never updated: the first page of our website you visited, the site that linked to it (its address without the rest of the link), any campaign tag in that link, your browser's language, the country your connection came from (from Cloudflare, not your precise location), and the kind of device.
• Screen usage: which screens of the app you open and which actions you take, counted per day. Not what you type or see on them.
• Surveys: if you answer one of our short in-app surveys (always optional), your answers, how long each question took, and a few facts about your account in broad ranges: single or multi-unit, how many properties and rooms, country, currency, how often you use Stayem, roughly how many bookings, and whether you connect a channel. We note that you were asked, so we do not ask twice, but your answers are stored separately and are not linked to your account.
• Notifications: if you turn them on in the app, the device's push token, so we can send them.
• What you put into Stayem: your properties (including any address and photo), calendars and the channel links you connect, bookings, payments, expenses and figures, guides, notes, and the bank details you choose to show on pro-forma invoices. Booking calendars imported from Airbnb and other channels can carry a guest's name or the last digits of their phone number; we store what the channel publishes.

We use this to provide the service and sign you in (contract), to keep it secure and prevent abuse, to understand how it is used so we can improve it and set fair prices, and to send you a few emails that help you get set up (legitimate interests). Set-up emails are sent from getstayem.com; each has an unsubscribe link, and Profile has a switch for them. Sign-in codes and messages about your bookings are part of the service and are always sent.

If you are a guest or a team member

An owner who uses Stayem may record your details and share a personal link with you (stayem.com/v/…). Depending on what the owner asks and what you choose to enter, Stayem holds:

• your name, email address, phone number, country of residence and year of birth;
• the first name of a companion you forward your link to, if you give one;
• for a stay: the dates, the number of guests, the number of cars and your flight number, if the owner asks for them;
• whether you have confirmed the documents the owner requires (for example “I have sent my ID”). Stayem never receives or stores the documents themselves: you send them to the owner directly;
• when your link was opened and when sensitive items (such as a door code) were revealed, which the owner can see;
• for team members: your name, contact details and languages, and the visits and notes the owner assigns to you.

The owner sees what you enter. Team members see a guest's name, email or phone only if the owner chooses to show them. If you give a flight number, we send the flight number and date (never your name) to our flight-data provider to follow the arrival. If you use the Stayem app with your link and allow notifications, we keep your device's push token to send reminders, until your link is deleted. We may email you an access code for your link, sent on the owner's behalf.

If you send a booking request or a message to an owner

The form on an owner's Stayem page sends your name, email, phone number, dates and message to that owner, by email and in their app, and we email you an acknowledgement. The owner may reply or, unless you opt out, contact you later with an offer. A message through a property's contact form is emailed to the owner and not stored by us.

Free tools

Our free tools work without an account. When you check a website, we read a few of its public pages and keep only the results, never a copy of the pages, with the address you entered and a one-way hash of your IP address, used only to limit how many checks come from one place. If you ask for the report by email, we keep your address to send it. Follow-up emails are a separate, optional tick box, sent from getstayem.com.

Website statistics, cookies and your device

• Google Analytics runs on our public website only (the marketing pages), never in the app, on the owner pages, on sign-in, on guest and team links, on invoices or on owners' property pages and calendars. It runs only if you press “Accept” on our cookie banner: until then, and if you press “Reject”, it is not loaded at all. Once accepted, it uses cookies to count visits and pages viewed, and sends Google your IP address and browser details. Google keeps this data for at most 14 months. You can change your choice at any time with “Cookie settings” at the bottom of our pages, or here: Cookie settings. Withdrawing removes the analytics cookies from your browser.
• Sign-in cookies: stayem_session keeps an owner signed in on the website and stayem_portal keeps a guest or team link open, each for up to 28 days without use. In the app, the same is stored on the device.
• Trusted-device cookie: after an owner signs in, stayem_td remembers the browser so that a stranger typing wrong codes for the same email cannot lock it out. It holds a random token (we store only a one-way hash of it) and lapses 180 days after its last sign-in. In the app, the same is stored on the device.
• On your device (browser storage): your language, display choices such as the theme, your cookie choice, and dismissed messages, which stay on the device. On our website we also keep the first page you visited and any campaign tag, which we receive only if you create an account (see “How you found us”).
• Bot check: our contact, booking-request and free-tool forms use Cloudflare Turnstile, which checks that a person is sending them.
• Maps and videos: a property's address can be shown on a Google Maps map, which loads from Google with the page. On our explainer videos, the preview image comes from YouTube's image server; the player itself (youtube-nocookie.com) loads only when you press play.

Who else processes it

These providers receive personal data to run Stayem:

• Cloudflare, Inc.: hosting of the website, the app back end and the database; the bot check on our forms (Turnstile) and sign-in rate limits, which use your IP address (sign-in keeps only a one-way hash of your network, see How long we keep it).
• Brevo (Sendinblue SAS, France): sending emails: sign-in codes, booking-request messages and service emails.
• Amazon Web Services EMEA SARL (Amazon SES, Ireland): sending the same emails when Brevo is unavailable.
• Google Firebase Cloud Messaging: delivering notifications to the app when you turn them on; a notification can name a guest or a property.
• AeroDataBox (via RapidAPI): flight status, when a guest gives a flight number; only the flight number and date are sent, never who is travelling.
• Google Analytics: statistics about visits to our public website (see Website statistics below).

Our own internal dashboard (operated by IncubIQ Solutions Ltd) receives account facts such as an owner's email, first name, language, sign-up date and how far they have got with setting up, and alerts such as a new sign-up or a deleted account, to send set-up emails and to follow how the service is used. Alerts about sign-in attempts (a code voided after wrong tries, or a network or address paused for the day) show the email address masked, such as a***@example.com, never in full. It also receives survey answers with their account facts in broad ranges, without anything that identifies you, and deletes them 2 years after the last answer. Some providers may process data outside the UK and the European Economic Area. Where they do, the transfer is covered by safeguards such as an adequacy decision or the standard contractual clauses.

How long we keep it

• Your account and everything in it (properties, bookings, guests, payments, notes): until you delete it, or until you delete the item. Deleting your account deletes all of it at once.
• Sessions: deleted once they expire (28 days without use).
• One-time codes: valid for 10 minutes, deleted 1 day after they expire.
• Sign-in attempts: each code request and each code typed keeps a one-way, keyed hash of the network it came from (never the IP address itself), so that a stranger's wrong attempts lock only their own network, not yours. Deleted after 48 hours.
• Unused sign-ups: asking for a sign-in code creates an account record before the address is confirmed. If it is never used (no sign-in, no property), it is deleted after 7 days.
• Guest links: a guest's link stops working 7 days after check-out and is deleted 30 days after check-out, with its access records, personal flight numbers and push token. The guest's details on the booking stay in the owner's records until the owner deletes them. A team member's link lasts until the owner removes it.
• Invoice links: the link to a pro-forma invoice is deleted 30 days after check-out. The invoice itself stays in the owner's records.
• Booking requests: the enquirer's name, email, phone and message are erased 30 days after the request becomes a booking (the details then live on the booking), 30 days after the requested check-out if the enquirer opted out of follow-up, and otherwise 2 years after the requested check-out.
• Screen usage counts: 180 days.
• Survey answers: 2 years after your last answer. Because they are not linked to your account, deleting your account does not remove them.
• Free-tool checks: 7 days, or 90 days if you gave an email address. If you ticked the box for follow-up emails, until you unsubscribe, then 90 days.
• Our admin access log (which account our staff viewed or deleted, and when): 2 years, including after the account is deleted, so we can show that a deletion was done.
• Our internal dashboard keeps the alerts it receives about accounts (such as a sign-up or a deleted account), which can include an owner's email address. We delete them on request.
• Hosting and email logs: kept by Cloudflare, Brevo and Amazon for a limited period under their own policies.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable format. Write to hello [at] stayem.com. If you have an account, you can do much of this yourself, in Profile: download a copy of your data (“Download my data”, a file you can keep or move to another service), correct your details, and delete your account (see Account & Data Deletion). If you are a guest, team member or enquirer of an owner, ask the owner first; you can also write to us and we will help them. The owner can erase a guest or team member from Stayem: their name and contact details are removed and their links are deleted, while the bookings and payments stay in the owner's records without them. Pro-forma invoices already issued are the owner's financial records and are not changed.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk), or, if you live in the European Union, to the data protection authority of your country. We would appreciate the chance to put it right first.

Security

All traffic is encrypted (HTTPS). Sign-in codes, access codes and session tokens are stored only as one-way hashes. Sign-in is protected by attempt limits and rate limits. Access to personal data is limited to the people who need it to run the service.

Children

Stayem accounts are for adults running a rental. A booking may record how many children are in a party; we ask for no other information about them.

Changes

We will post any change to this policy on this page and update the date above. If a change is significant, we will tell account holders by email before it applies.