OwnStay Privacy Notice

Owner account information

Supabase Auth processes your email address, password credential, email-verification state, password-recovery state, and basic profile metadata such as your name. The application receives authentication tokens from Supabase and stores active session tokens in secure HttpOnly cookies so browser scripts cannot read them.

After email verification, OwnStay may store organization membership, role, organization name, property name, property URL slug, invitation records, property settings, integration configuration, domain records, verification state, and related audit metadata needed to provide the service.

OwnStay subscription billing

OwnStay software subscriptions are billed through Stripe Checkout and Stripe Billing. Stripe may process your billing name, email, payment method, billing address, tax-related information, and subscription state. OwnStay does not receive or store your full payment-card number.

Your OwnStay subscription is separate from guest booking revenue. Subscription metadata is scoped to your OwnStay organization so billing can be associated with the correct owner workspace.

Guest payments and Stripe Connect

Properties may connect a Stripe merchant account for guest payments and payouts. Stripe handles merchant onboarding and identity requirements. OwnStay does not ask you for your Stripe password and does not use your OwnStay subscription payment method as a guest-payout account.

Guest payment processing is separate from the OwnStay software subscription. Standard Stripe processing fees may apply to guest payments. OwnStay does not charge an OwnStay booking commission.

Property authorization and verification

OwnStay may collect property address information, your relationship to the property, verification status, evidence-category metadata, reviewer decisions, and related audit records. Verification documents, when used, are treated as private evidence and are not intended for public display.

New properties are designed to fail closed for publication and guest payments until the required authorization and payment-readiness checks are satisfied.

Connected services and operational data

If you connect supported services, OwnStay may process provider account labels, configuration, encrypted credentials or OAuth token material, calendar data, domain records, cleaner or task data, guest communications, and other property-scoped operational information needed for the features you enable.

Secrets are not displayed back to the browser after storage. Provider credentials are kept separate from public property content and are scoped to the property or organization that owns them.

Service providers and access

The application is hosted on Vercel. Supabase provides database storage and owner authentication. Stripe provides software subscription billing and connected-account payment infrastructure. Other providers are used only when you connect or enable the related feature.

Access to tenant data is restricted through authenticated owner paths, organization membership, property scoping, Row Level Security, server-only privileged credentials, and related application controls.

Retention, export, and deletion

Account, organization, property, billing metadata, audit records, and operational data are retained while reasonably needed to provide the service, protect users, meet business or legal obligations, and preserve security integrity. Some records may be retained after deletion where required for fraud prevention, accounting, dispute handling, or legal compliance.

You may request access, correction, export, or deletion by emailing mattclockel@gmail.com.

Security

Reasonable technical and organizational safeguards are used, including verified-email authentication, tenant membership checks, Row Level Security, server-only privileged credentials, HttpOnly session cookies, expiring invitations, encrypted credential storage, cross-site mutation checks, and audit records. No internet service can guarantee absolute security.

Changes and contact

This notice may be updated as OwnStay changes. Material updates will be reflected on this page. Questions or privacy requests can be sent to mattclockel@gmail.com.