Privacy Policy

01Introduction

Between Guests (“we”, “us”, or “our”) operates the Between Guests platform at betweenguests.com (the “Service”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Service.

We are committed to protecting your privacy in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the European Union's General Data Protection Regulation (GDPR).

For the purposes of GDPR, Between Guests is the data controller. Our contact email is legal@betweenguests.com.

02Information We Collect

Account Information

When you create an account, we collect your name and email address. Your password is hashed by our authentication provider and is never stored in plain text.

Phone Number

If you choose to receive SMS notifications, we collect and verify your phone number. Your phone number is used solely to deliver transactional SMS notifications related to your cleaning activity (e.g., new assignments, schedule changes, completions, and urgent alerts). We do not use your phone number for marketing or promotional messages.

Property and Cleaning Data

If you are a host, we collect property names, addresses, calendar feed URLs, cleaning checklists, and related configuration. If you are a cleaner, we collect your cleaning activity — assignments, completion status, uploaded photos, and notes.

Payment Information

Paid subscriptions are processed by Stripe. We do not collect or store your payment card details. Stripe may collect payment information in accordance with their own privacy policy.

Usage Data

We use Vercel Analytics to collect anonymised usage data such as page views, device type, and browser information. Vercel Analytics is privacy-friendly and does not use cookies for tracking. No personally identifiable information is collected through analytics.

Cookies

We use essential cookies only, for authentication session management. We do not use advertising cookies or cross-site tracking cookies.

03How We Use Your Information

We use the information we collect to:

• Operate and provide the Service, including calendar synchronisation, cleaning scheduling, and notifications
• Send you transactional emails, SMS messages, and in-app notifications related to your cleanings
• Process subscription payments through Stripe
• Improve the Service through anonymised usage analytics
• Respond to support requests and communicate with you about your account
• Comply with legal obligations

04Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, we process your data on the following bases:

• Contract performance: Processing necessary to provide the Service you signed up for (account management, calendar sync, cleaning coordination, notifications)
• Legitimate interests: Anonymised analytics to improve the Service, fraud prevention, and security
• Legal obligation: Where we are required to retain or disclose data by law
• Consent: Where required, such as for optional marketing communications (you may withdraw consent at any time)

05Data Sharing and Third Parties

We share your data only with the following service providers, solely to operate the Service:

• Supabase: Database hosting and authentication (your account data, property data, and cleaning data are stored on Supabase infrastructure)
• Stripe: Payment processing for paid subscriptions
• Vercel: Application hosting and anonymised web analytics
• Twilio: SMS delivery for transactional cleaning notifications. Your phone number is shared with Twilio solely for the purpose of delivering SMS messages. Twilio processes this data in accordance with their own privacy policy.
• Resend: Transactional email notifications related to your cleanings

We do not sell, rent, or trade your personal information to any third party. We may disclose your information if required by law, court order, or governmental authority.

06Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law (e.g., financial records for tax purposes).

Anonymised analytics data, which cannot be used to identify you, may be retained indefinitely.

07Your Rights

Under PIPEDA (Canada)

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Withdraw consent to the collection, use, or disclosure of your information (subject to legal or contractual restrictions)
• File a complaint with the Office of the Privacy Commissioner of Canada

Under GDPR (European Economic Area)

You have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate or incomplete data
• Request erasure of your data (“right to be forgotten”)
• Restrict or object to certain processing
• Data portability — receive your data in a structured, machine-readable format
• Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at legal@betweenguests.com. We will respond within 30 days.

08International Data Transfers

Your data may be processed and stored in Canada and the United States, where our infrastructure providers (Supabase, Vercel) maintain their servers. If you are located in the EEA, we ensure appropriate safeguards are in place for international transfers, including reliance on the service providers' data processing agreements and standard contractual clauses where applicable.

09Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.

10Data Security

We take reasonable measures to protect your personal information, including:

• Encryption in transit using TLS (HTTPS)
• Hashed passwords (never stored in plain text)
• Row-level security at the database level, ensuring users can only access their own data
• Regular security reviews of our infrastructure and code

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

12Contact and Complaints

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Email: legal@betweenguests.com

For PIPEDA complaints, you may also contact:

Office of the Privacy Commissioner of Canada
www.priv.gc.ca

For GDPR complaints, you may contact your local data protection supervisory authority.