Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address, name, and optionally your company name. This information is necessary to provide you with access to our service. If you sign in using Google, we receive your name, email address, and profile picture from your Google account. This data is used solely for account creation and identification purposes.

Property Data

You provide us with property information including addresses, check-in instructions, house rules, photos, and local recommendations. This data is stored to create and host your guest guides.

Guest Interaction Data

When guests view your guides or use the AI concierge, we collect anonymised usage data including page views, questions asked, and interaction patterns. We do not collect personal data from your guests unless they voluntarily provide it (e.g., when reporting an issue).

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card details. We receive and store only the last four digits of your card, the card type, and billing address for record-keeping purposes.

Guest Verification Data

When guests complete identity verification through our Guest Verify feature, we collect:

• Photographs of identity documents (passport, driving licence, national ID card) captured via the device camera
• A selfie photograph for face-matching purposes
• Document metadata extracted via AI processing, including name, nationality, document number, and expiry date
• Verification status and review outcomes

Guest ID images are stored in a private, encrypted storage bucket. They are never publicly accessible and can only be viewed by the property host via time-limited secure links. Hosts can configure automatic deletion of ID documents after a set period (30 days to 1 year).

Security Deposit Data

When guests provide a security deposit, we collect payment information through Stripe. We do not store full card details. We receive and store only:

• A secure payment token (not the actual card number)
• The last four digits and card type for display purposes
• Deposit amount, currency, and hold/capture status

Rental Agreement Data

When guests sign a rental agreement through our platform, we collect:

• Digital signatures (typed name or drawn signature)
• A snapshot of the agreement text at the time of signing
• Signing metadata including IP address, browser user agent, and timestamp for legal enforceability

Usage Data

We automatically collect information about how you interact with our service, including pages visited, features used, and time spent on the platform. This helps us improve our service.

We use Google Analytics (via Google Tag Manager) to collect anonymous usage data including pages visited, time on site, traffic sources, device types, and geographic regions. This data is anonymised and aggregated to help us understand how our service is used and improve user experience. You can opt out of Google Analytics using Google's browser add-on.

On marketing pages, we also use the Meta (Facebook) Pixel to measure advertising effectiveness and build audiences for retargeting. The Meta Pixel is not loaded on guest guides or the dashboard, and is only activated after you consent to analytics and advertising cookies via our cookie banner.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our service
• Create and host your digital guest guides
• Process your payments through Stripe
• Verify guest identity on behalf of property hosts using submitted ID documents and selfies
• Process security deposit holds and captures via Stripe
• Generate and store signed rental agreements as legally enforceable records
• Perform AI-powered document screening for fraud prevention and name/face matching
• Send you transactional emails (account confirmations, billing receipts)
• Respond to your enquiries and support requests
• Analyse usage patterns to improve user experience
• Prevent fraud and ensure platform security
• Comply with legal obligations

3. Legal Basis for Processing (GDPR)

Under UK GDPR and the Data Protection Act 2018, we process your data based on:

• Contract Performance: Processing necessary to provide our service to you
• Legitimate Interests: Analytics, security, and service improvement
• Consent: Marketing communications, advertising cookies, and sharing hashed personal data with advertising partners (where applicable)
• Legal Obligations: Tax records, fraud prevention, and regulatory compliance

4. Data Sharing

We share your data with the following categories of recipients:

• Stripe: For payment processing (PCI DSS Level 1 compliant)
• Google (Analytics): Analytics and usage tracking via Google Analytics. Data is anonymised and used to understand site usage patterns. See Google's Privacy Policy.
• Google (Authentication): When you sign in with Google, we receive your name, email address, and profile picture. This data is used solely for account creation and identification. See Google's Privacy Policy.
• Meta Platforms, Inc. (Facebook): We use the Meta Pixel on our marketing pages to measure advertising effectiveness and build audiences for retargeting. When analytics cookies are accepted, Meta may receive hashed personal data (such as email address, name, or phone number) via Automatic Advanced Matching for ad attribution. No data is shared with Meta until you consent. See Meta's Privacy Policy.
• Stripe Identity: Where hosts enable automated KYC verification, guest identity data is processed by Stripe Identity, a PCI DSS Level 1 certified provider. See Stripe's Privacy Policy.
• Google Gemini AI: For document screening, text extraction, and face matching during Smart ID Verify+. Data is processed transiently and is not retained by Google after processing. See Google's Privacy Policy.
• AI Service Providers: For content generation and AI concierge functionality. Property data is anonymised where possible.
• Cloud Infrastructure: Our hosting providers who store and process data on our behalf
• Legal Requirements: We may disclose data if required by law or to protect our rights

We do not sell your personal data to third parties.

5. Data Retention

We retain your data as follows:

• Account Data: Until you delete your account, plus 7 years for financial records as required by law
• Property Data: Until you delete the property or your account
• Guest ID Documents: Retained according to the host's configured retention period (30 days, 60 days, 90 days, 6 months, or 1 year after check-out), then permanently and irreversibly deleted from storage
• Rental Agreements: Retained per the host's configured settings (default 12 months), then deleted
• Security Deposit Records: Retained while the hold is active, then for 12 months after release or capture to support dispute resolution
• Guest Interaction Logs: 90 days
• Analytics Data: 2 years in anonymised form. Google Analytics data retention is set to 14 months by default.

6. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Data Portability: Receive your data in a machine-readable format
• Object: Object to processing based on legitimate interests
• Restrict Processing: Request limitation of processing in certain circumstances
• Withdraw Consent: Where processing is based on consent

To exercise these rights, please contact us at support@checkinguide.app.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. International Transfers

Your data may be processed outside the UK and European Economic Area by our service providers. Where this occurs, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the UK ICO
• Adequacy decisions where applicable
• Binding corporate rules of our service providers

8. Marketing Communications

During account registration, you may opt-in to receive product updates, tips, and feature announcements from us. This consent is entirely optional and does not affect your ability to use our service.

What You'll Receive

If you opt-in, you may receive occasional emails about:

• New features and product improvements
• Tips for getting the most out of CheckinGuide
• Industry insights and best practices for short-term rental hosts

Email Service Provider

Marketing emails are sent using Resend, a GDPR-compliant email service provider. Your email address and name are shared with Resend solely for the purpose of delivering these communications.

Unsubscribing

You can unsubscribe from marketing emails at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email
• Updating your email preferences in your account settings
• Contacting us at support@checkinguide.app

Unsubscribing from marketing emails will not affect transactional emails (such as billing receipts, password resets, or important account notifications).

9. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email:support@checkinguide.app
• Company: THE SA RMAP LTD (trading as CheckinGuide)
• Company Number: 15764290
• Address: 1 Duffield Road, Derby, England, DE1 3BB, United Kingdom

This policy may be updated from time to time. We will notify you of any material changes by email or through a notice on our website.