Privacy
Last updated 17 September 2026.
This page describes what this system stores about people, who else sees it, and — just as importantly — what it cannot do. It is written against the code rather than from a template, so some of it is more blunt than a privacy policy usually is.
Two different relationships
For the people who sign in — staff of a business, and property owners invited to see their own units — this software holds the account and is responsible for it. For everyone else in the system, the business using the software decides what is collected and why; this software stores it on that business's behalf and acts on its instructions. If you are a guest, an owner, a cleaner, a contractor or a supplier, the business you dealt with is the one that holds your record, and this page tells you what it holds it in.
People who sign in
A name, an email address, an optional telephone number, and a password kept only as a one-way hash. Each sign-in also records the IP address and browser of the session. Signing in is not verified by email, because this system cannot send email at all. Whoever created, approved or changed a record is recorded against it, and that name stays visible on the record after the person leaves the organisation.
Guests, owners and other people a business records
A guest record holds a name and telephone number, which are required, and optionally an email address, nationality, an identity document type and number, and free-text notes written by staff. A guest may be marked as blocked, which requires a written reason and is kept indefinitely. Bookings hold the dates, the number of adults and children, the actual arrival and departure times, and any notes. Owners hold contact details and commission terms. Cleaners and contractors are recorded by name only — they have no account here. Suppliers appear as a name on an expense. None of these people has an account, and this system captures no consent from any of them: records are created about them by the business.
The public booking page
When a business switches on its public page, anyone can send an enquiry with a name, a telephone number, an optional email address and a message of up to 500 characters. That enquiry creates a guest record and a booking marked as an enquiry; the message is stored as a note on it. If the telephone number matches a guest the business had previously deleted, the enquiry brings that earlier record and its whole history back into use — so a person outside the business can undo a deletion inside it.
If a business connects a WhatsApp number, every message in either direction is stored permanently: the other party's telephone number, the text or the caption of an attachment, the template and the values merged into it, and the times the message was sent, delivered and read. This applies to anyone who messages the number, including a wrong number or someone with no relationship to the business, because the times of those messages decide what WhatsApp allows to be sent back. Attachments themselves are never downloaded. There is no way to opt out, and no control anywhere that deletes a message.
The calendar feed for booking channels
A business can publish a per-unit availability feed for Airbnb, Booking.com and Agoda. The feed carries dates and the words “Busy” or “Blocked” — never a guest's name, and nothing else about anyone. It does carry the unit's own code, and it distinguishes a direct booking from a block from a night another channel sold. The address is unguessable but needs no password, it does not expire on its own, and it works whether or not the business's public page is switched on. Anyone who obtains the address can see when that unit is occupied until the business rotates it.
What is never stored
No card numbers or any other payment credentials: payments are written down here, never taken. No images of identity documents — a number may be recorded, an image never. No location data, no advertising identifiers, no profiling. Photographs of units are stripped of camera metadata, including any location, when they are uploaded.
Cookies
Two, and both are necessary. One keeps you signed in. One remembers whether you chose Arabic or English, and lasts a year. There is no analytics, no advertising, no tracking script and no third-party code of any kind in these pages — which is why you are not asked to accept anything.
Where the data is held
The service runs on infrastructure operated by other companies, and they necessarily hold or pass through what is stored:
- Neon — the database, and therefore everything described above. Hosted in London.
- Vercel — hosting and server logs, in London. Logs record the addresses requested. Searching the guest directory puts what you typed into the address, so a name or telephone number you search for is written to those logs.
- Cloudflare R2 — photographs of units. These are served from addresses that need no password, so anyone given one can view the image.
- Meta — only where a business has connected WhatsApp. The recipient's telephone number and the contents of the message are sent to Meta so it can deliver them.
- GitHub — runs two scheduled jobs. Their logs can contain technical error text from those jobs.
How long it is kept
Indefinitely. There is no mechanism in this system that removes personal data after a period of time, for any record of any kind. Sign-in sessions, WhatsApp messages, guest records and bookings all remain until somebody removes them by hand, and for WhatsApp messages there is no way to do even that. If you need data removed, the business holding it has to arrange it directly with whoever operates the system.
What deleting a record actually does
It hides it. A deleted guest, booking, payment or owner is marked as deleted and disappears from every screen, but the record and everything in it stays in the database — deliberately, because the money and the history attached to it have to stay consistent. A deleted guest also keeps their telephone number reserved, and the record comes back into use if that number is entered again, whether by staff, by a message to the WhatsApp number, or by a stranger using the public booking page. There is no screen anywhere that lists what has been deleted, so the business cannot review it either. This is not erasure, and it would be wrong to describe it as erasure.
What this system cannot do
These are capabilities a privacy policy usually promises. They do not exist here, and are listed so that nobody relies on them:
- Erase a person. Nothing in the product permanently removes a guest, a staff account, a WhatsApp message or an organisation.
- Give one person a copy of their own records. Some reports export to Excel, but none is scoped to a single person, and a guest has no way to sign in and read their own record.
- Send you anything. No email is sent by this system at all, so a request cannot be acknowledged, and a change to this page cannot be announced.
- Expire, archive or anonymise anything on a schedule.
- Record consent. No agreement is captured from a guest at any point, and nothing in the database records one.
- Say who looked at a record. Changes to a booking's dates and status are recorded; reads are not recorded at all.
Getting in touch
If a business holds a record about you, ask that business first — they decide what happens to it. For anything about the software itself, write to the address shown on the site you were given this link from. Because nothing here can be answered automatically, expect a person rather than a confirmation email.