Privacy Policy

Last updated: September 25, 2026

HomestAI builds direct-booking websites for vacation-rental hosts. This policy explains what personal data we process, why, and what rights you have. It covers two groups of people: hosts who create an account, and guests who visit or book on a host's site.

Who is responsible

For host accounts, HomestAI is the data controller. For guest bookings made on a host's site, the host is the controller and HomestAI processes the data on the host's behalf to run the site and the booking. Contact: support@homestai.com.

Data we collect from hosts

Account data: email address, name, and the sign-in links we send you (we don't use passwords).
Property content: the listing URL you import (Airbnb, Booking.com, Google Maps), and the text, photos, address, prices and availability we import or that you enter.
Billing: your subscription plan and status. Card details are collected and stored by Stripe, never by HomestAI.
Payouts: if you accept payments, Stripe collects your identity and bank details for its Connect service. We only receive your Stripe account ID and its status.
Notification settings: phone number (SMS / WhatsApp) and browser push subscriptions, if you turn them on.
Technical data: server logs (IP address, browser, pages requested) kept by our hosting provider for security and debugging.

Data we process for guests

Booking details: name, email, phone number, dates, number of guests, message to the host and the amount paid.
Payment: card details go directly to Stripe. We only receive the payment status.
Technical data: server logs, as above.

Why we use it

To provide the service: build and host your site, take bookings, send confirmation and reminder emails (performance of a contract).
To bill subscriptions and booking fees (performance of a contract, legal accounting obligations).
To keep the service secure and fix problems (legitimate interest).
To answer your support requests (legitimate interest).

We don't sell personal data, and we don't use advertising or tracking cookies.

Service providers

We share data only with the providers needed to run HomestAI:

Vercel — hosting, file storage and domain registration.
Supabase — database.
Stripe — subscription billing, guest payments and host payouts.
Resend — transactional emails (sign-in links, booking emails).
Twilio — SMS and WhatsApp notifications, if you enable them.
Google Maps Platform and ScraperAPI — importing public listing information and locating the property.

Some of these providers are based in the United States. Transfers outside the European Economic Area rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

Cookies

We use only the cookies the service needs: a session cookie that keeps you signed in, and a language cookie that remembers whether you chose English or French. Stripe sets its own cookies on payment pages to prevent fraud.

How long we keep it

Host account and site content: while your account is active. Deleting a site deletes its content and photos.
Bookings and invoices: up to 10 years, as required by accounting law.
Server logs: a few weeks at most, as set by our hosting provider.

Your rights

You can ask to access, correct, delete or export your personal data, or object to or restrict its use. Email support@homestai.com. Guests should contact the host first; we'll help the host answer. You can also complain to your data-protection authority (in France, the CNIL — cnil.fr).

Changes

If we change this policy in a way that matters, we'll update the date above and tell account holders by email.