Privacy Policy

1. Information We Collect

1.1 Property Owner Account Information

When you create an account, we collect:

• Full name
• Email address
• Password (stored in hashed form), if you sign up with email
• Subscription tier and account preferences

If you sign in or link your account using Google, we receive your name and email address from Google. We do not receive or store your Google password. Google authentication is handled via OAuth 2.0, and we only request the minimum scopes needed (email and profile).

1.2 Property Information

When you set up a property, we collect details you provide, including:

• Property name, location, and description
• Pricing details (nightly rates, cleaning fees, seasonal discounts, tax rates)
• Availability rules (minimum/maximum nights, check-in/out times, guest limits)
• iCal feed URLs from third-party platforms (Airbnb, VRBO, Booking.com, Google Calendar)
• Widget configuration (colors, fonts, logos, display preferences)

1.3 Guest Information (via Booking Widget)

When a guest submits a booking request through the embeddable widget, we collect:

• Full name
• Email address
• Phone number (optional)
• Number of guests
• Requested check-in and check-out dates
• Special requests or messages
• Whether they are traveling with pets
• Whether they chose to join the property owner's email list, if the owner offers one

The same information may reach us through our public booking API, when a guest asks an AI assistant or a partner website to check availability or request a booking for them.

1.4 Calendar Data

We import availability and booking data from third-party iCal feeds, which may include event summaries containing guest names or booking references from platforms such as Airbnb and VRBO.

1.5 Technical and Usage Data

We automatically collect certain technical information, including:

• Browser type, device information, and operating system
• IP address
• Pages visited and features used within the Service
• Error logs and performance data
• Session information for authentication purposes
• In the dashboard, if you allow analytics: which features you use and recordings of your session with all text and form inputs masked, linked to your account email (see Section 7)

1.6 Support Information

When you submit a support ticket, we collect your name, email, ticket type, subject, and description.

1.7 Visitors to Hosted Pages

Property owners can publish pages that we host for them at www.rentalcal.com: link-in-bio pages (a short list of links with a booking calendar) and offer pages (an email signup, sometimes with a discount). If you visit one of these pages, you are the property owner's guest and do not need a RentalCal account. On these pages:

• We count page views and taps on links as totals for each page. To count a visitor once a day and to limit automated abuse, the page stores a random identifier in your browser's local storage. It is not linked to your name, your email address, or your activity on other websites. Our servers keep it for up to two days, only to enforce those limits, and then delete it. Clearing your browser storage removes it.
• If your browser sends a Global Privacy Control or Do Not Track signal, we do not count your visit and do not create the identifier for that purpose.
• These pages do not load Google Analytics or any advertising tracker.
• If you join an email list on an offer page, we collect your email address, your name if you give it, the consent wording you agreed to, and the time. This is shared with the property owner whose list you joined, who is responsible for the emails they send you. Every email sent through RentalCal includes an unsubscribe link.
• If you check availability or request a booking, Section 1.3 applies.
• Links on these pages lead to websites we do not control, such as listing sites and social networks, which have their own privacy policies. Photos and text on the page are provided by the property owner.

1.8 Guest Chat

If a property owner turns on guest chat and you send them a message, we collect your messages, the page you wrote from, the dates and number of guests you checked in the chat, and your name and email address if you choose to give them. A random identifier kept in your browser lets you return to the conversation and limits automated abuse. If you give your email address, we send you a link to continue the conversation, which works for 7 days. Some common questions are answered automatically from details the property owner entered; these answers are labelled as coming from the listing.

1.9 Payments

Payments are handled by Stripe. When a guest pays a deposit or a booking, the payment is made to the property owner's own Stripe account on Stripe's pages, and we receive the status of the payment and the amount, not the card details. When a property owner pays for a subscription, Stripe collects the payment details and we keep the Stripe customer reference, plan, and billing history. Property owners who accept payments give Stripe the identity and bank details Stripe asks for, under Stripe's own privacy policy.

1.10 Host Verification

If you apply to be a verified host, we collect your legal name, business name, phone number, email address, property address, links to your listings, and any notes you add. A person at RentalCal reviews each application.

1.11 Team Members

If a property owner invites you to help manage their account, we collect your email address and the role they give you. The account owner and other members can see your name and email address.

1.12 Browser Extension

The RentalCal browser extension for Chrome ("RentalCal: Calendar sync") helps you connect calendar sync between your RentalCal account and Airbnb, Vrbo, and Booking.com. If you install it:

• Where it runs. It acts only on the calendar and listing settings pages of Airbnb, on Vrbo, and on the Booking.com extranet, and on app.rentalcal.com to connect your browser to your account. It never reads messages or inbox pages, and it does nothing on other websites.
• What it reads. On a calendar sync page, it reads the page to find that platform's calendar export link and its form for importing a calendar. If a platform does not show its link, you paste it into the extension yourself.
• What it sends us. Only the calendar link you choose to connect and the property you connect it to, plus a short label for your browser (for example, "Chrome on macOS") when you connect it. It does not send us the content of the pages you visit or your browsing history.
• What it stores. In Chrome's storage for the extension on your device, it keeps an access token that connects the browser to your account, and your account's name and email address to show who is connected. We store only a scrambled (hashed) copy of the token, the browser label, and when it was connected and last used, so you can see and disconnect it in Settings.
• It never acts on its own. It fills in a platform's form only when you click, and it never saves or submits anything on Airbnb, Vrbo, or Booking.com. You click the platform's own button.
• The extension contains no analytics or advertising trackers.

You can disconnect a browser at any time from the extension ("Disconnect this browser") or from Settings in the dashboard, which revokes its token. Removing the extension from Chrome deletes what it stored on your device; the connection stays listed in Settings until you disconnect it there. Calendars you connected stay in your account until you remove them.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including calendar synchronization, booking request management, and the embeddable widget.
• Send transactional emails, including booking request confirmations, booking status updates, sync alerts, and account-related notifications.
• Send marketing and promotional emails about RentalCal features, updates, and offers (you may opt out at any time).
• Process and respond to support requests.
• Review host verification applications, to protect guests from fraudulent listings.
• Generate suggested text and images for booking sites from the property details you provide, using AI services. We do not send guest information to these services.
• Monitor and improve the performance, reliability, and security of the Service.
• Enforce our Terms of Service and protect against fraud or abuse.

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

3.1 Between Owners and Guests

When a guest submits a booking request, the guest's contact information and booking details are shared with the property owner. Owner property details (name, location, pricing) are displayed to guests through the booking widget.

3.2 Service Providers

We use the following providers to run the Service. Each processes personal information only on our instructions and under a written agreement that requires them to protect it. We will update this list before adding a provider that handles personal information.

• Convex (United States) — database and backend, where all Service data is stored.
• Vercel (United States) — hosting and delivery of our websites.
• Resend (United States) — sending email. Resend also keeps our list of account holders (name, email address, plan, and marketing preference) so that owners who have opted out of marketing are never sent it. Guest email addresses are never added to that list.
• Stripe (United States and elsewhere) — subscription billing, and guest payments to property owners who connect a Stripe account.
• Sentry (United States) — error reports, and, if you allow analytics in the dashboard, replays of sessions in which an error occurred, with all text masked.
• PostHog (United States) — product analytics in the dashboard, only if you allow it.
• Google (United States) — Google Analytics on our marketing website, subject to your choice (see Section 7), and sign-in with Google if you choose it. Google's use of data is governed by the Google Privacy Policy.
• Anthropic and OpenAI (United States) — AI-generated suggestions for booking sites, from property details only.

3.3 Calendar Platforms

When you connect iCal feeds, availability data is exchanged with third-party platforms (such as Airbnb, VRBO, Booking.com, and Google Calendar) through iCal imports and exports. These platforms are governed by their own privacy policies.

3.4 Team Members and Account Transfers

People a property owner invites into their account can see the account's data according to the role the owner gives them. If an account is transferred to a new owner at the previous owner's request, its data moves with it.

3.5 Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of RentalCal, our users, or the public.

4. Data Retention

We keep personal information only as long as we need it for the purpose we collected it for:

• Account, property, and team information: while the account exists.
• Booking requests, guest chat conversations, and email list signups: while the property owner's account exists, unless the owner deletes them sooner.
• Billing and payment records: as long as tax and accounting law requires.
• Visitor identifiers on pages we host: two days on our servers.
• Support tickets: while the account exists.
• Browser extension connections: until you disconnect the browser or delete the account. Transferring an account to a new owner disconnects every browser.

When an account is deleted, we delete or anonymize its personal information within a reasonable period, except where the law requires us to keep it or we need it to resolve a dispute or enforce our Terms.

5. Data Security

We implement commercially reasonable technical and organizational measures to protect your information, including encrypted data transmission (TLS/HTTPS), hashed passwords, access controls, and secure infrastructure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Your Rights and Choices

• Access and Correction: You may access and update your account information at any time through the dashboard.
• Account Deletion: You may delete your account and all associated data at any time through the Settings page in your dashboard, or by contacting us at hello@rentalcal.com.
• Marketing Opt-Out: You may unsubscribe from marketing emails at any time using the unsubscribe link included in those emails, or through the Email Preferences toggle in your dashboard Settings.
• Data Portability: You may download a copy of your data in JSON format at any time through the Settings page in your dashboard.

7. Cookies and Tracking

We keep cookies and similar storage to what each part of the Service needs:

• The dashboard (app.rentalcal.com) uses essential cookies and local storage for authentication and session management, including session tokens for both email-based and Google OAuth sign-in. It also offers optional analytics (PostHog product analytics and Sentry error replays), which follow the same regional rules as the marketing website below. You can change your choice from Settings in the dashboard. Error reports without replays, and performance timings for a sample of page loads, are always sent, and keep nothing in your browser.
• The marketing website (www.rentalcal.com) uses Google Analytics. Whether it runs before you choose depends on where you are. In the European Economic Area (including the EU's outermost regions), the United Kingdom, the Channel Islands, the Isle of Man, Gibraltar, Switzerland, and Quebec, or if we cannot tell where you are, it is not loaded and sets no cookies until you choose Accept in the cookie notice. Everywhere else it is on by default, and you can turn it off. Wherever you are, you can change your choice at any time from "Your privacy choices" at the bottom of any page on that site, and a Global Privacy Control or Do Not Track signal from your browser turns it off. We use your approximate location, as reported by our hosting provider, only to decide which of these applies, and we do not store it. We remember your choice in your browser's local storage: a "yes" for 12 months, after which we ask again, and a "no" until you change it. Google signals and ad personalization are switched off, and Google Analytics data is processed by Google in the United States.
• Pages we host for property owners (link-in-bio pages and offer pages) and booking sites do not use Google Analytics or any other analytics or advertising tracker. Hosted pages use the local storage identifier described in Section 1.7. Booking sites count visits with a code worked out from general browser details that changes every day and does not tell us who you are; they skip the count if your browser sends Global Privacy Control or Do Not Track.
• The browser extension uses no cookies. It keeps its connection to your account in Chrome's storage for the extension, as described in Section 1.12.

We do not use third-party advertising trackers, and we do not sell personal information. Our Cookie Notice lists each item we keep in your browser, why, and for how long.

8. Embeddable Widget, Hosted Pages, and Guest Data

The RentalCal booking widget may be embedded on third-party websites owned by property owners. When a guest interacts with the widget, guest data is transmitted directly to RentalCal servers and shared with the property owner. Property owners who embed the widget are responsible for disclosing the collection of guest data in their own website privacy policies. When the widget loads, it also sends RentalCal the address of the page it is on (without any query string), which we keep so the property owner can confirm where their widget runs and so booking assistants can find the listing by that address. That is the owner's page address, not information about you.

The same applies to link-in-bio pages and offer pages we host for a property owner, to booking sites, and to guest chat. For booking requests, chat messages, and email list signups, the property owner decides why and how your information is used, and RentalCal handles it on their behalf under the data processing terms in our Terms of Service. To access, correct, or delete that information, you can contact the property owner directly, or contact us and we will pass your request on and help them respond. For the visit counts described in Section 1.7, RentalCal is responsible.

9. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete it promptly.

10. International Data Transfers

RentalCal is operated from British Columbia, Canada. Your information is processed and stored in Canada, the United States, and other countries where the providers in Section 3.2 operate, which may have different data protection laws from yours.

Canada is recognised by the European Commission as providing adequate protection. When personal information from the European Economic Area, the United Kingdom, or Switzerland goes on to a provider in a country without such recognition, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, or otherwise on the European Commission's standard contractual clauses with the UK and Swiss amendments. Before personal information about people in Quebec is sent outside Quebec, we assess whether it will be adequately protected, as Quebec law requires.

11. Canadian Privacy Law

RentalCal is operated from British Columbia, Canada, and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). Under these laws, you have the right to:

• Know what personal information we hold about you and why.
• Access your personal information and request corrections if it is inaccurate.
• Withdraw consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.
• File a complaint if you believe your privacy rights have been violated: with the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or, in Quebec, the Commission d'accès à l'information du Québec.

People in Quebec also have the rights given by Quebec's Act respecting the protection of personal information in the private sector, including the right to receive personal information they provided in a structured, commonly used technological format.

Privacy Officer. Our Privacy Officer is responsible for how we protect personal information and for answering requests under this policy. You can reach them at hello@rentalcal.com with "Privacy Officer" in the subject line.

We collect, use, and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances, and we obtain meaningful consent for collection and use of personal information.

12. Marketing Emails (CASL Compliance)

In accordance with Canada's Anti-Spam Legislation (CASL), we will only send you commercial electronic messages (marketing emails) where we have your express or implied consent. You may withdraw consent and unsubscribe from marketing emails at any time using the unsubscribe link in those emails. Unsubscribe requests are processed promptly, and no later than 10 business days. Transactional emails related to your account and bookings are not considered commercial messages and will continue to be sent as necessary to operate the Service.

13. Information for Users in the European Economic Area, the United Kingdom, and Switzerland (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and its UK and Swiss equivalents. For property owners, website visitors, and the visit counts on hosted pages, the controller is Cole WebCraft Services Inc. For guests of a property owner, see Section 8. Your rights include:

• Legal basis: We process your data based on: (a) your consent; (b) performance of a contract (providing the Service); (c) our legitimate interests (improving and securing the Service); or (d) compliance with legal obligations.
• Right to withdraw consent: Where we rely on your consent, such as for analytics, you may withdraw it at any time, as easily as you gave it. This does not affect processing that happened before.
• Right to erasure: You may request that we delete your personal data.
• Right to restrict processing: You may request that we limit how we use your data.
• Right to object: You may object to processing based on our legitimate interests.
• Data portability: You may request your data in a structured, machine-readable format.
• Supervisory authority: You have the right to lodge a complaint with your local data protection authority.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Host verification applications are reviewed by a person.

To exercise any of these rights, contact us at hello@rentalcal.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice within the Service. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.

15. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact our Privacy Officer at Cole WebCraft Services Inc., British Columbia, Canada, at hello@rentalcal.com.