Privacy Policy
Last updated: July 31, 2026
This policy explains what BuiltFor, Inc. (“BuiltFor,” “we,” “us”) collects when you use Stayfront, why we collect it, who we share it with, and what you can do about it. It covers both hosts — people with a Stayfront account — and guests who visit a published guest page.
We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined under California law.
1. What we collect
From hosts
- Account information — email address, password (stored only as a hash by our authentication provider), and optionally your name. If you sign in with Google we receive your email address, name and profile image from Google.
- Property information — the listing URL you provide, the public listing content we import from it (description, amenities, house rules, check-in details, photographs), plus anything you add or edit afterwards.
- Billing information — your plan, subscription status and billing history. Card numbers go directly to Stripe and are never stored on our systems.
- Connected accounts — if you connect a property management system, the access tokens needed to sync it.
- Support and correspondence — what you send us when you get in touch.
From guests
- Concierge conversations — the messages a guest sends the AI concierge and the replies it gives, held against an anonymous session identifier. Guest sessions are not tied to a Stayfront account and we do not ask guests to log in.
- Guestbook entries and photographs — where a host has enabled the guestbook.
- Language preference— so the page can be shown in a guest’s language.
- Approximate location, when asked for — some hosts require a guest to be near the property before the concierge will answer. If that is switched on, the browser asks the guest’s permission and sends coordinates with the request. We use those coordinates to compute a distance and then discard them — precise guest location is never written to our database. A guest can always decline; declining only blocks the gated feature.
Automatically, from everyone
- Usage and page analytics — pages viewed, sections opened, products clicked, searches run on a guest page, and similar interaction counts, used to give hosts statistics about their pages.
- Technical data — IP address, device and browser type, referring page and timestamps. IP addresses are used for security and rate limiting and are not used to build advertising profiles.
If you join the waitlist
During the private beta we collect the email address you submit and the page that referred you, solely to send you an invitation and occasional updates about the beta.
2. How we use it
- To create, operate and secure your account and your published guest pages.
- To generate guidebooks, recommendations and concierge answers using AI (see section 3).
- To answer guest questions and give hosts analytics about their pages.
- To take payment, manage subscriptions and send billing notices.
- To send service messages — confirmations, security alerts, changes to these policies. These are not marketing and you cannot opt out of them while you hold an account.
- To market Stayfront, including using property photographs and content as described in section 4.
- To detect abuse, enforce our Terms of Service, debug problems and meet legal obligations.
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (running your account); legitimate interests (securing the service, product analytics, marketing our own service); consent (browser location, marketing email where required); and legal obligation (tax and accounting records).
3. AI processing
Listing content, guidebook drafts and guest concierge messages are sent to our AI provider, OpenAI, to generate responses. This happens on our commercial API terms, under which the provider does not use the content to train its models. Some processing may instead run on models we host ourselves, in which case the content does not leave our infrastructure.
Please do not put sensitive personal information into concierge messages or guidebook content. AI output can be inaccurate; hosts review and approve what is published.
4. Property photographs and marketing
We use photographs and content from properties on Stayfront to advertise and promote Stayfront. That includes paid and organic advertising, marketing materials, and display on our own website — including the sign-in and sign-up pages and other logged-out pages. It applies to photographs you upload and to photographs imported from your connected listing.
The licence that permits this, the promises you make to us when you grant it, and how to have a specific image withdrawn are set out in section 6 of the Terms of Service. If you want a photograph excluded, email legal@stayfront.io.
If an image shows an identifiable person, it is the host’s responsibility to have that person’s consent before adding it to Stayfront. Tell us at legal@stayfront.io if you appear in an image on Stayfront and want it removed, and we will act on it.
7. How long we keep it
- Account and property data — while your account is open.
- After you delete your account — removed or anonymised within 30 days, except where we must keep records longer (billing and tax records, typically seven years).
- Guest concierge conversations — up to 12 months, then deleted.
- Analytics events — up to 24 months in identifiable form, then aggregated.
- Waitlist emails — until the beta ends or you ask us to remove you.
- Backups — overwritten on a rolling basis, normally within 90 days.
8. Security
Data is encrypted in transit and at rest. Access to production systems is limited to personnel who need it, database access is governed by row-level security, and administrative actions taken on another account are logged. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your information we will notify you and any regulator as the law requires. Report a vulnerability to security@stayfront.io.
9. Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, object to or restrict certain processing, withdraw consent, and not be discriminated against for exercising these rights. California residents have the rights to know, delete, correct and opt out of sale or sharing — we do not sell or share personal information as those terms are defined.
Hosts can update most information directly in the dashboard. For anything else, email privacy@stayfront.io and we will respond within the time the law allows (45 days in California, one month under the GDPR). We may need to verify your identity first. You may use an authorised agent, and you may complain to your local data protection authority.
Guests: because guest sessions are anonymous, we may need details — the property page and roughly when you used it — to locate your conversation before we can act on a request.
10. International transfers
We operate in the United States, and our service providers may process information in the United States and elsewhere. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses or another approved safeguard.
11. Children
Stayfront is not for children. Hosts must be 18 or older. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email privacy@stayfront.io and we will delete it.
12. Changes to this policy
We may update this policy. The date at the top always reflects the current version, and if a change materially affects how we handle your information we will give notice by email or in the product before it takes effect.
13. Contact us
Privacy questions and rights requests: privacy@stayfront.io. Legal and content removal: legal@stayfront.io. Security: security@stayfront.io.
BuiltFor, Inc.