At StayFolio (accessible from stayfolio.co, a digital product and brand owned and operated by Shudbloom), protecting the privacy and personal data of our hosts and their guests is a cornerstone of our service. This Privacy Policy document explains what information is collected by StayFolio, how it is processed, and the measures we take to keep your data secure in compliance with global standards, including GDPR, CCPA, and CAN-SPAM.
If you have any questions or require additional information regarding this Privacy Policy, please contact our team at support@stayfolio.co.
1. Scope & Categories of Users
StayFolio provides a digital guidebook publishing platform. We process information for two distinct categories of users:
- Hosts (Account Holders): Property owners, co-hosts, and property managers who register an account, configure guidebook content, and manage guest requests.
- Guests (Guidebook Viewers): Arriving visitors who access published guidebooks via QR code scan or direct web links to view Wi-Fi details, check-in instructions, or submit extra time/issue requests.
2. Information We Collect
A. Information Collected from Hosts:
- Account Registration Data: When you create a StayFolio account, we collect your name, email address, password hash, and profile details managed securely through Firebase Authentication.
- Property Profile & Guidebook Content: Information you provide to generate digital guest guides, including property names, location/city, Wi-Fi credentials, check-in/checkout instructions, house rules, directions, appliance guides, emergency contacts, and local recommendations.
- In-App Purchase & Subscription Tokens: Premium subscription purchases are processed natively via the Apple App Store or Google Play Store. We receive entitlement verification tokens via RevenueCat, but we never collect, store, or process your raw credit card or banking details.
B. Information Collected from Guests:
- Guidebook Usage & Scan Analytics: When a guest opens a guidebook, we record aggregated, anonymous engagement metrics (e.g., page load timestamp, Wi-Fi copy events, and checklist progress). We do not track guests across third-party websites or build advertising profiles.
- Guest Requests & Support Submissions: If a guest submits an Extra Time request (Early Check-In / Late Checkout) or an In-Guide Issue Report, we collect the guest's provided name, contact details (email or phone), requested time slot, and issue description solely to transmit the request to the host.
- Device Session Tokens: A pseudonymous local session token (
sf_guest_token) is generated in the guest's browser localStorage to maintain request status and banner state without requiring guest account registration.
3. How We Use Your Information
We use collected data strictly for legitimate operational purposes, including to:
- Generate, host, and serve static digital guidebooks across our global Content Delivery Network (CDN);
- Deliver high-priority push notifications and alerts to hosts when guests request extra time or report issues;
- Validate subscription entitlements through RevenueCat;
- Send hosts automated weekly performance digests and account alerts;
- Protect our platform and users from spam, denial-of-service, and fraudulent activity;
- Comply with applicable legal obligations and enforce our Terms of Service.
4. Cloud Subprocessors & Data Sharing
We do not sell, rent, or monetize personal information. To provide the Service, we share data only with trusted, industry-leading cloud infrastructure providers:
- Google Firebase / Google Cloud Platform: Powers our database (Firestore), authentication (Firebase Auth), asset storage (Firebase Storage), and static hosting (Firebase Hosting).
- Google Gemini AI API: Processes user-submitted listing descriptions when hosts choose to utilize the "AI Listing Import" feature. Listing descriptions sent to the Gemini API are processed in-memory to generate structured draft fields and are not used to train Google's public AI models.
- RevenueCat: Validates mobile In-App Purchases and subscription statuses across iOS and Android.
- Brevo (Sendinblue): Dispatches transactional system emails and automated weekly performance summaries to registered hosts.
- Expo Push Notification Gateway: Delivers immediate mobile push alerts to host devices for new guest requests and urgent issues.
5. Email Communications & CAN-SPAM Compliance
StayFolio sends periodic performance digest emails to hosts (e.g., weekly scan totals, upsell revenue, and resolved issues summary). In full compliance with the CAN-SPAM Act and global regulations:
- All non-critical digest emails clearly identify StayFolio as the sender;
- Every summary email includes a direct, 1-click Unsubscribe Link at the footer;
- Hosts can manage email preferences directly in their app settings or by clicking the unsubscribe link to immediately cease digest mailings.
6. GDPR & CCPA Data Protection Rights
Under the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), users possess the following rights:
- Right to Access & Portability: You may request a summary of the personal information we hold about you.
- Right to Rectification: You may edit or update your account details and property information at any time directly in the mobile app.
- Right to Erasure (Account Deletion): You have the right to request permanent deletion of your account and all associated guidebooks. StayFolio provides a direct 1-tap "Delete Account" button in App Settings, which instantly and permanently purges your account, properties, issues, and guest request logs from our database.
7. Security & Data Protection
We implement industry-standard security safeguards to protect your information, including SSL/TLS encryption for all data in transit, strict Firestore Security Rules restricting database access to authenticated owners, and rate-limited Cloud Functions to protect public guest endpoints.
8. Children's Privacy (COPPA Compliance)
StayFolio is designed strictly for adult property hosts and vacation rental operators. We do not knowingly collect or solicit personal information from children under the age of 13. If we discover that a child under 13 has provided us with personal data, we will delete it immediately.
9. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect enhancements to our platform or regulatory changes. We will indicate revisions by updating the "Last updated" date at the top of this page. Continued use of StayFolio after any changes signifies acceptance of the revised policy.
10. Contact Us
If you have any questions, privacy requests, or concerns regarding this policy, please reach out to us at support@stayfolio.co.
StayFolio