Privacy policy

Withinstay (“we”, “us”) provides hosted pre-arrival forms and guest email automation for hotels, retreats and short-stay operators. The service is available at withinstays.com.

For guest data, the property using Withinstay is the data controller and we act as their processor. For host account data, we are the controller. If you are a guest and want your details changed or removed, contact the property you booked with first — they can action it directly, and we will help if needed.

Host account data. Name, email address, password hash, company name, property details and the settings you choose in your workspace.

Guest data submitted through arrival forms. Whatever the property asks for on its form — typically guest name, email address, phone number, arrival date and time, booking channel, any add-on or service requests, and consent selections.

Email activity.Records of the messages sent on a property's behalf and their delivery status, so hosts can see what a guest was told and when.

Integration credentials. If a host connects a booking system or mailbox, we store the credentials or access tokens needed to operate that connection. These are encrypted before storage — see Security below.

Connecting a Google account is optional and serves two separate purposes, each requesting only what it needs:

• Signing in. We request openid, email and profile to identify you and create your Withinstay session. We store your email address, name and Google account identifier.
• Sending guest email as you. If you connect Gmail, we request the https://www.googleapis.com/auth/gmail.send scope. This permission allows sending only. It does not allow us to read, search, download or delete anything in your mailbox, and we do not do so.

We store an encrypted refresh token so we can send on your behalf without asking you to sign in each time. You can disconnect Gmail at any time from Settings → Connections, which deletes the stored token and revokes our access at Google.

Withinstay's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the features you have explicitly asked for.
• We do not transfer Google user data to third parties except as needed to provide the service, for security purposes, or to comply with applicable law.
• We do not use Google user data for advertising, and we do not sell it.
• We do not allow humans to read your Google user data, except where you have given explicit consent for specific messages, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised.

We use a small number of service providers to run Withinstay. They process data on our instructions only:

• Vercel — application hosting and delivery.
• Neon — the managed Postgres database where guest and host records are stored.
• Resend — delivery of transactional guest email sent by Withinstay.
• Google — sign-in, and Gmail delivery when a host has connected their mailbox.
• Booking and property systems such as Hostaway — only when a host connects one, and only to read booking details that pre-fill arrival forms.

We do not sell personal information, and we do not share it for advertising.

• Integration credentials and access tokens are encrypted with AES-256-GCM before they are written to the database.
• Connection tests and third-party API calls run server-side. Secrets are never sent to the browser.
• Access to production data is limited to personnel who need it to operate the service.
• Inbound delivery webhooks are signature-verified before they are trusted.

Guest records are kept for as long as the property using Withinstay needs them to run its operation, and are deleted when the property deletes them or closes its workspace.

Disconnecting an integration deletes the stored credentials for it immediately. Closing a host account removes the workspace and the guest records within it.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or restrict certain processing. Contact us using the details below and we will respond within the timeframe required by applicable law. Guests should contact the property they booked with in the first instance.

If we make material changes we will update the date at the top of this page and, where the change materially affects how we handle your data, notify account holders by email.

Questions about this policy or your data can go to hello@withinstays.com.