Privacy Policy

Introduction

STR Squad LLC (“we,” “us,” or “our”) operates STR Squad. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform, website, and related services (the “Service”).

By using the Service you agree to the handling of information described here. If you do not agree, please do not use the Service. This policy forms part of our Terms of Service.

Two Kinds of Data — and Two Different Roles

Most personal data flowing through STR Squad does not belong to our customers. It belongs to their guests. That distinction determines who is answerable for it, so we state it plainly:

Your data — we are the controller

Information about you as our customer — your account, your billing, your use of the Service, your support conversations with us. We decide how this is handled, and this policy governs it directly.

Your guests’ data — you are the controller, we are your processor

Information about your guests, property owners, and vendors that you bring into the Service or that arrives through a channel you connect — names, contact details, reservation and stay history, messages, payment status, and anything else in a booking record. You are the controller of that data. We process it on your instructions to deliver the Service to you, and for no independent purpose of our own.

That means you are responsible for having a lawful basis to collect and use it, for any privacy notice or consent your guests are owed, and for answering their privacy requests. If a guest contacts us directly about data we hold for you, we will refer them to you and support you in responding. We do not sell it, mine it for our own purposes, or use it to build products for anyone else.

Information We Collect

Account Data

When you create an account we collect your name, email address, and any profile information you provide. Authentication is handled by Clerk — we do not store passwords directly.

Property and Operations Data

Listing details, calendar availability, pricing rules, reservations, guest communications, maintenance and turnover records, vendor details, and financial records that you submit or that sync from systems you connect. This is used solely to provide the Service to you.

Connected System Data

When you connect a booking channel, property management system, or other tool, we receive data from it under the authorization you grant — and we store the access tokens needed to maintain that connection. You can disconnect any system at any time, which revokes our access going forward.

Payment Information

Payment card details are collected and processed by Stripe. We do not store full card numbers or CVV codes on our servers. We retain billing history and subscription status for account management and tax purposes.

Usage Analytics

Anonymized usage data — pages visited, features used, session duration — collected via Vercel Analytics to understand how the Service is used and improve it. It does not include directly identifying information.

Technical Data

IP address, browser type, device information, and referring URLs, collected as part of standard server and security logging. Retained for a limited period and used for security, abuse prevention, and debugging.

How We Use Information

• Provide, operate, secure, and maintain the Service
• Synchronize data with the systems you connect
• Generate the drafts, summaries, and signals that AI-assisted features produce for you
• Process transactions and manage your subscription
• Respond to your support requests
• Send transactional email — receipts, security notices, service notices
• Analyze aggregated usage to improve features and performance
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms

We do not sell personal information. We do not use it for targeted advertising, and we do not share it with data brokers.

Who Processes Data on Our Behalf

We share information only with providers who help us deliver the Service, and only as far as they need it. Each is bound by contract to protect it and to use it only on our instructions.

Clerk — Authentication

Handles sign-in, sessions, and multi-factor authentication. See Clerk’s Privacy Policy.

Vercel — Hosting and Analytics

Hosts the platform, processes request logs, serves static assets, and provides anonymized page-view analytics. See Vercel’s Privacy Policy.

Stripe — Payments

Payment information is transmitted directly to Stripe and governed by Stripe’s Privacy Policy.

AI Model Providers

AI-assisted features send the content needed to fulfill a request — such as a guest message thread being replied to — to third-party model providers. We contract with these providers on terms that prohibit training their models on our customers’ data, and content sent for processing is not retained by them beyond what is needed to return a result and meet their own abuse-monitoring obligations.

Systems You Connect

When you connect a booking channel or other tool, data flows both ways under the authorization you grant. Those providers are independent controllers of the data they hold, under their own privacy policies — not ours.

We may also disclose information where required by law, court order, or governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of STR Squad LLC, our users, or the public. If we are involved in a merger, acquisition, or sale of assets, information may transfer as part of it — we will give notice before it becomes subject to a different policy.

Cookies and Similar Technologies

We use cookies and similar technologies that are strictly necessary to run the Service — keeping you signed in, maintaining your session, and securing requests — along with limited analytics cookies that help us understand aggregate usage.

We do not use advertising or cross-site tracking cookies. You can control cookies through the consent notice shown on first visit and through your browser settings; blocking strictly necessary cookies will prevent parts of the Service from working.

Data Retention

We retain account and operational data for as long as your account is active or as needed to provide the Service. If you delete your account we will delete or anonymize personal data within 30 days, except where we must retain it for legal or compliance reasons — billing and tax records are retained for 7 years as required by applicable law.

Anonymized, aggregated data that cannot be linked back to an individual may be retained indefinitely. Backups are cycled on a rolling schedule, so deleted data may persist in encrypted backups for a short period after deletion from live systems.

Your Rights

Depending on where you live you may have rights over your personal data. We honor the rights granted by the General Data Protection Regulation (GDPR) for users in the European Economic Area and the United Kingdom, and by the California Consumer Privacy Act as amended (CCPA/CPRA) for California residents, including:

• The right to access the personal data we hold about you
• The right to correct inaccurate or incomplete data
• The right to request deletion of your personal data
• The right to restrict or object to processing
• The right to data portability in a machine-readable format
• The right to opt out of the sale or sharing of personal information — we do not sell or share it
• The right not to be discriminated against for exercising these rights
• The right to withdraw consent where processing relies on it

Exercise any of these by contacting legal@strsquad.com. We respond to verified requests within 30 days. You may also lodge a complaint with your local supervisory authority.

If your request concerns data held by one of our customers about you as their guest, we will refer you to that customer — they are the controller of it, and we cannot act on it without their instruction.

International Transfers

We operate in the United States, and our providers may process data in the United States and other countries. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards — including the European Commission’s Standard Contractual Clauses — to protect it to the standard required by applicable law.

Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact legal@strsquad.com and we will delete it.

Security

We implement industry-standard technical and organizational measures to protect data, including encryption in transit (TLS), encryption at rest, access controls, least-privilege internal access, and regular security review. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a breach affecting personal data, we will notify affected customers and the relevant authorities as required by applicable law and without undue delay. Where the breach affects data you control, we will give you the information you need to meet your own notification obligations.

Changes to This Policy

We may update this policy as the Service evolves. We will post the revised version with an updated date and, where changes are material, notify you by email or in-app notice before they take effect.

Contact Us

Questions about this policy, or to exercise your data rights: legal@strsquad.com.

© 2026 STR Squad LLC. All rights reserved.