Privacy Policy

When you create an account we collect your email address, password (stored as a salted hash by our authentication provider), full name, and the role you sign up under (Guest or Host).

You may optionally add a phone number to your profile.

If you apply to host, we collect the information you submit in the application form, which may include your full name, email, phone, business name, property title, property address, general area, property type, bedrooms, bathrooms, square footage, maximum guest count, current listing URL, nightly rate, minimum stay, booking type, and any notes you provide.

If you become a Host, we store the listing content you submit, including descriptions, photos, amenities, sleeping arrangements, house rules, your Home Health Profile responses, the private street address of the property, latitude/longitude, and an optional Local Emergency Contact (name, phone, email, distance, notes). The Local Emergency Contact is stored in a separate, access-restricted table and is only released to (a) administrators, (b) the Host who owns the listing, and (c) Guests with a confirmed paid booking for that listing.

When you create an account we record the version of the Terms of Service and Privacy Policy you accepted, the timestamp of acceptance, and a confirmation that you stated you are 18 or older. This record is used for dispute resolution and compliance.

When you make or receive a booking we store the listing, dates, guest count, pricing breakdown, payment status, and any agreements you accepted at checkout (including the version and timestamp).

All payments are processed by Stripe. We do not store full card numbers or bank account numbers on our servers. We do store Stripe identifiers (payment intent ID, session ID, refund ID) and, for Hosts, a Stripe Connect account ID along with the boolean status flags Stripe returns to us (charges enabled, payouts enabled, details submitted).

Messages you send through the in-platform messaging feature are stored so that you and the other participant can read them. Administrators can access messages where required to investigate abuse, fraud, or platform-policy violations.

If you leave a review or save a listing as a favorite, we store that activity linked to your account. Reviews may be moderated, approved, removed, or withheld where reasonably necessary to prevent fraud, abuse, retaliation, extortion, harassment, false claims, or violations of platform policy.

If you connect an external iCal feed (e.g., Airbnb, VRBO) to your listing, we store the iCal URL you provide and the resulting availability blocks. We import only date ranges and event identifiers — we do not import guest names or contact information from external platforms.

Like most websites, our hosting and backend providers automatically log basic technical data such as IP address, browser/user-agent, and request timestamps for security, abuse prevention, and debugging purposes.

If you participate in our referral program, we collect and store the referral identifier (code or link) you share or arrive through, the source of the referral click where available, the account that was attributed as the referrer, signups and bookings tied to that attribution, promotional credit balances, and records of any discounts or credits applied to your bookings. This information is used to operate the program and prevent abuse.

If you join our newsletter or waitlist, we collect the email address you submit, the source page or campaign where you signed up, and a timestamp. We use this information solely to send you the communications you opted in to and to operate the waitlist. You can unsubscribe at any time using the link in any email or by contacting us.

If a Guest or Host submits property photos or supporting documentation (for example, photos uploaded to support a Host listing or to complete a guest photo submission), we store those images in access-restricted file storage. These photos are visible only to the submitting user, designated Purestay administrators reviewing the submission, and — in limited cases — the other party to a confirmed booking where strictly necessary to resolve a dispute.

create accounts, publish listings, process bookings, route payouts to Hosts via Stripe, send transactional emails (booking confirmations, password resets, message notifications), and enable guest-host communication.

investigate suspected fraud, abuse, or violations of our Terms; enforce our House Rules and Host Conduct Policy.

respond to lawful requests from authorities and meet tax or recordkeeping obligations that apply to us or our payment processor.

attribute referrals to the correct accounts, track eligibility for promotional credits and first-stay discounts, apply travel credits and referral discounts to qualifying bookings, and detect and prevent promotional abuse (including self-referrals, duplicate accounts, and fraudulent activity).

When a booking is made, the relevant Host receives the guest's name, contact details captured at booking, dates, and any messages sent through the Platform. Once revealed at the appropriate point in the booking flow, Guests with a confirmed booking may also see the Host's Local Emergency Contact for that property.

We rely on third-party providers to run the Platform. The current providers and what they receive are listed in Section 5.

We may disclose information when required by valid legal process or to protect the rights, property, or safety of Purestay, our users, or the public.

Referral attribution data and promotional credit activity may be processed through our payment processor (to apply discounts at checkout and reconcile payouts), our backend and email infrastructure (to record signups, bookings, and notifications tied to a referral), and internal promotional and abuse-prevention systems. We do not share referral data with advertising networks or third-party marketers.

Provides our managed database, authentication, file storage (listing photos), and serverless functions. Personal data is stored on infrastructure managed by Supabase.

Processes Guest payments and Host payouts via Stripe Connect. Stripe collects payment, identity, and tax information directly from users under its own privacy policy.

If you choose to connect an iCal URL from another platform (e.g., Airbnb, VRBO, Booking.com), we fetch that feed to import blocked dates only.

Transactional emails (account, booking, and message notifications) are sent via the email infrastructure provided by Lovable Cloud.

Guests may share their referral code or a referral link (a Platform URL that includes a tracking parameter identifying the referrer) with friends. You are responsible for the channels you use to share your code or link and should only share with people who would reasonably expect to hear from you.

To operate the program, we may record: clicks on referral links (including the referral code and, where available, a general source such as the page the link was used on); signups attributed to a referral; bookings tied to a referral; promotional credit balances and eligibility; discounts applied to qualifying bookings; and signals used to detect referral abuse or fraud (such as duplicate accounts, self-referrals, or unusual patterns).

Eligible referral credits and promotional discounts may be applied automatically to your account or to a qualifying booking at checkout. You may also have the option to choose whether to apply available travel credit to a specific booking.

Travel credits and referral rewards are promotional only. They have no cash value, are non-transferable, and are not redeemable for cash, refunds, or withdrawals. Referral discounts and credits may be subject to limits, expiration dates, minimum booking requirements, single-use restrictions, geographic eligibility, or other conditions disclosed at the time of the offer.

Purestay reserves the right to withhold, reduce, or revoke referral credits, promotional discounts, or program eligibility — and to reverse associated bookings or charges where appropriate — in cases of suspected abuse, fraud, self-referrals, duplicate or coordinated accounts, manipulation of attribution, chargeback abuse, or violations of our Terms of Service or related policies.

We may modify, suspend, or end the referral program at any time. Reasonable notice will be given for material changes that affect credits already earned.

If we become aware of a breach of personal data that is likely to result in significant harm, we will notify affected users and any required regulators without undue delay and, where applicable, within timeframes required by law.