Privacy Policy

Who we are

SortedStay is operated by Offer2Stay Ltd · Company no. 17248175 · Registered office: 128 City Road, London, EC1V 2NX, United Kingdom. SortedStay is part of the Offer2Stay group. Contact for anything in this policy: hello@sortedstay.com. We operate under UK data protection law (UK GDPR, the Data Protection Act 2018 and PECR).

The data we process

Hosts (our customers — we are the controller). Your name, email and password (or Google sign-in details if you use Google); your properties (descriptions, photos, prices, door codes and Wi-Fi details you choose to store); the connections you set up (calendar links, and keys for services such as PriceLabs or Channex); billing records and Stripe identifiers; messages you send us; and a log of emails we send you.

Guests (the host is the controller — we process on the host’s behalf). The booking details that reach SortedStay from a channel, a calendar or the host’s own website: name, email, phone, number of guests, stay dates, price paid, and messages exchanged with the host. Card details are entered on Stripe and never reach us.

Team members (the host is the controller). Name, email or phone, the jobs assigned to you, and the cleaning photos you upload.

Website visitors. Server and security logs (IP address, page, time) and rate-limit counters. sortedstay.com and host websites do not use analytics or advertising cookies.

Why, and on what lawful basis

• Contract — running your account, syncing calendars, sending the guest messages you set up, creating cleaning jobs, billing.
• Legitimate interests — keeping the service secure, preventing abuse, fixing faults, and service emails about your account (trial reminders, failed payments).
• Legal obligation — keeping billing records for tax purposes.

Who processes data for us

We do not sell personal data and do not use it for advertising. These providers process data on our instructions:

• Supabase — database, sign-in and file storage (property photos, cleaning photos) (EU (Ireland)).
• Vercel — hosting and content delivery for sortedstay.com and host websites (EU/US, standard contractual clauses).
• Stripe — SortedStay subscriptions, and — on a host’s own connected Stripe account — guest payments on that host’s website (card details never reach us) (EU/US, Stripe DPA).
• Resend — sending account emails and the guest emails a host switches on (US, standard contractual clauses).
• Anthropic — drafting replies to guest messages for the host to approve, the in-dashboard help assistant, and polishing message templates — not used to train models under the API terms (US, standard contractual clauses).
• Channex — channel manager connection to Airbnb, Booking.com and other channels, where the host connects it — bookings, availability, rates and, if switched on, guest messages (UK/EU, Channex data processing terms).
• Apify — importing a public Airbnb listing a host pastes in — the listing link only (EU).
• Twilio — SMS and WhatsApp guest messages, only where a host has switched them on (US, standard contractual clauses).
• Upstash — rate limiting to stop abuse (IP address and a counter, kept for minutes) (EU or US, standard contractual clauses).
• Apple and Google push services — delivering notifications to a host’s or team member’s device where they have allowed them (US).

Where a provider is outside the UK, transfers rely on the UK International Data Transfer Addendum, standard contractual clauses or an adequacy decision. Services a host connects with their own account — such as PriceLabs, Airbnb or Booking.com — receive or send data on the host’s instruction under that service’s own terms.

Host websites may also show a map (OpenStreetMap tiles, loaded by the visitor’s browser) and, if the host adds one, a video from YouTube or Vimeo, which load from those providers.

How long we keep things

• Cleaning photos — deleted automatically 30 days after they are taken.
• Cleaning videos — deleted automatically 7 days after they are recorded.
• Host account, properties and bookings — kept while your account is open. If you close it, we may delete it from 90 days afterwards; ask us and we will delete it sooner.
• Guest and team data — kept with the host’s account, so the host keeps their booking history. Guests and team members can ask their host, or us, to delete it.
• Rate-limit counters — minutes. Server logs expire on our hosting providers’ schedules.
• Billing records — as long as tax law requires (currently 6 years).

Apart from the cleaning photos and videos and the rate-limit counters, deletion is done by hand or at your request rather than by a timer.

Cookies and local storage

We only use what is strictly necessary, so there is no cookie banner: your sign-in session, a cookie that lets a host preview an unpublished website, and small settings saved in your browser (for example a dismissed notice). There are no analytics or advertising cookies on sortedstay.com or on host websites.

Your rights

You can ask for a copy of your personal data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Guests and team members should usually ask their host first, as the host is the controller — but you can also email us and we will help. Email hello@sortedstay.com and we will reply within a month. If you think we have handled your data badly, you can complain to the ICO (ico.org.uk).

Changes

If this policy changes materially we will tell hosts by email or in the dashboard. The date at the top is always the current version.

See also our Terms of Service.