Stayful Ltd — Privacy Policy

Last updated: [date of publication]

1. Who we are

This service is operated by Stayful Ltd, a company registered in England and Wales.

• Company number: 14791583
• Registered office: 20–22 Wenlock Road, London, England, N1 7GU
• ICO registration number: ZA00016946040
• Contact for privacy and data protection matters: info@stayful.co.uk

Stayful Ltd is the data controller for the personal data described in this policy.

2. Who this policy applies to

This policy covers two distinct groups, because Stayful processes personal data about both:

• Landlords who submit a property management enquiry through Stayful's website, some of whom are later referred to a subscriber operator via the Lead Marketplace.
• Subscribers — short-term rental (STR) management operators who hold an account on the Lead Marketplace platform to receive and manage those referred leads.

Where something applies to only one group, this is stated explicitly.

3. The personal data we collect

3.1 If you are a landlord who has submitted an enquiry

• Name
• Property address
• Phone number
• Email address
• Number of bedrooms
• Date of enquiry
• Estimated monthly income for the property, and other details from your enquiry (referred to internally as your "lead profile")

3.2 If you are a subscriber using the Lead Marketplace

• Business name and contact name
• Email address and phone number
• Billing and payment details (processed by our payment provider, Stripe — Stayful does not store your card details directly)
• Account activity: which leads you've been assigned, status updates you make on those leads, notes you add, and your subscription and payment history

4. How we collect your data

• Landlords: directly from you, when you complete an enquiry form on our website.
• Subscribers: directly from you, when you create an account, and automatically as you use the platform (e.g. updating a lead's status).

5. Why we process your data, and how we use it

5.1 Landlord data

We process your enquiry details on the basis of legitimate interests — specifically, our legitimate interest (and yours) in connecting you with a suitable property management option, even where Stayful itself is not the right fit.

If we are not able to manage your property directly, we pass your enquiry to a trusted local operator who uses Stayful, who will then contact you directly.

Once we have decided to pass your enquiry on, we email you, usually within minutes, to say a local operator will be in touch, and to ask four quick questions about how and when you would like to be contacted. For some enquiries that email also introduces the operator by name. If you don't answer, we send up to two reminders, and then we stop. Your answers are shared with the operator, or operators, who hold your enquiry, so they can contact you the way you prefer.

Your enquiry is normally referred to no more than three operators. Where none of them takes it up, it may be referred to further operators, or made available to other operators who use Stayful to take on, so that it is not left unanswered. We do not sell your enquiry, and we do not pass your details on for any purpose beyond this referral, except as described in section 9.5.

5.2 Subscriber data

We process your account data on the basis of:

• Performance of a contract — to provide the subscription service you've signed up for (delivering leads, processing billing, maintaining your account).
• Legal obligation — for tax, accounting, and invoicing records.
• Legitimate interests — for basic platform security and service improvement.

5.3 Leads you add yourself, and the paid analysis

If you pay for the figures on a lead you added yourself, we send the property's address, postcode and number of bedrooms to Stayful's property analyser to work them out. We never send the landlord's name, email address or phone number.

We keep the result of each analysis as part of Stayful's market data, which we use to show average figures for an area on Stayful Intelligence. What we keep is the postcode, the number of bedrooms and the figures, not the street address, and not the landlord's name or contact details. These figures are shown as part of an area, never against a single postcode. We rely on our legitimate interests in building and improving that market data.

6. Who we share your data with

We use a number of third-party service providers to run the platform ("processors" in data protection terms). They only receive the data needed to perform their specific function, and are not permitted to use it for their own purposes — with one exception, Meta, which is not a processor. See section 9.

Landlord data referred to subscriber operators is shared with a small number of subscribers per lead — normally no more than three, and more only where earlier recipients do not take the enquiry up. We email you when we pass your enquiry on, as described in section 5.1.

We do not sell personal data to third parties for marketing purposes.

7. International data transfers

Several of the providers listed in section 6 are based outside the UK, or may process data through infrastructure located outside the UK. Each relies on a recognised safeguard, per their current published terms:

• Stripe, Twilio, Vercel — certified under the UK Extension to the EU-U.S. Data Privacy Framework, backed by the UK International Data Transfer Addendum as a fallback.
• Meta Platforms — our counterparty is Meta Platforms Ireland Limited; data is transferred onward to Meta Platforms, Inc. in the United States under the UK Extension to the EU-U.S. Data Privacy Framework, with the UK International Data Transfer Addendum as a fallback. See section 9.
• monday.com — relies on the UK's adequacy decision for Israel (where monday.com is headquartered), and on the UK Extension to the EU-U.S. Data Privacy Framework or the UK Addendum for the AWS regions it uses.
• n8n — n8n GmbH is based in Germany and n8n Cloud is hosted in Frankfurt; no transfer outside the UK/EU arises from this provider in normal operation.
• Resend — relies on the UK Addendum to the EU Standard Contractual Clauses.
• Supabase — relies on Standard Contractual Clauses and the UK International Data Transfer Addendum; Supabase is not currently certified under the Data Privacy Framework.

This reflects each provider's own published position as of the policy's drafting date, not a confirmation that Stayful has an executed, signed DPA in place with each one — a solicitor should verify that before publishing.

8. How long we keep your data

We retain personal data for 90 days from the point it is no longer active in our systems, and delete or anonymise it after that. Specifically:

• Landlord enquiry data not referred to a subscriber: deleted or anonymised 90 days after the enquiry is closed as not proceeding.
• Landlord data that was referred to a subscriber: retained for 90 days after the assignment ends, to allow time for any dispute or audit process, then deleted or anonymised.
• Subscriber account data: retained for 90 days after account closure, then deleted.
• Market data from the paid analysis: the postcode, number of bedrooms and figures described in section 5.3 are kept for as long as they are used in Stayful's market data. They carry no name, contact details or street address.

One exception, not a choice: financial and invoicing records (including Stripe billing history) must be kept for 6 years under UK tax law (HMRC record-keeping requirements), regardless of the 90-day period above. This isn't optional and applies on top of, not instead of, the 90-day rule for other data.

9. Cookies, advertising, and similar technologies

We advertise on Facebook and Instagram. To measure whether those adverts work, this website uses the Meta Pixel — a small piece of code provided by Meta — together with Meta's Conversions API, which sends the same measurement information to Meta from our server rather than from your browser.

The pixel is loaded on our public pages only. It is not loaded inside the subscriber dashboard or the admin area, so nothing you do while signed in to your account is measured for advertising purposes.

9.1 What is stored on your device

• _fbp — a randomly generated browser identifier set by the Meta Pixel. It contains no name, email address or phone number. Expires after 90 days.
• _fbc — set only if you arrived by clicking one of our Facebook or Instagram adverts. It stores the click identifier that Meta added to the link, so that an enquiry made later in the same browser can be connected back to that advert. Expires after 90 days.
• A cookie used to keep you signed in to your account. This one is strictly necessary to operate the service and is exempt from consent requirements under UK PECR.

9.2 What is sent to Meta

When you submit an enquiry form we send Meta a "Lead" event, and when a subscription is paid for we send a "Purchase" event including the amount paid. Alongside each event we send matching information, so that Meta can work out whether the person who converted is the person who saw the advert:

• Your email address, phone number, first name and last name — each one irreversibly hashed using SHA-256 before it leaves our server. Meta receives only the hashes, never the plain values, and can use them solely to look for a match against the equivalent hash of an existing Meta account.
• The _fbp and _fbc values described above, your IP address, and your browser's user-agent string. These are not hashed.
• The page you were on, the time of the event, and — for a purchase — the amount and the currency.

We do not send Meta the contents of your enquiry, your website address or the number of properties you manage. What we may send about landlords is set out in section 9.5.

9.3 Meta's role, and where the data goes

Meta is not a processor for this purpose. For the collection and transmission of this information we and Meta act as joint controllers, and Meta then acts as an independent controller in respect of its own subsequent use of that data, including improving how it targets adverts generally. Meta's handling of it is governed by the Meta Privacy Policy, not by this one. Our arrangement with Meta is the Meta Business Tools Terms and the associated Controller Addendum. Details of the international transfer are in section 7.

9.4 Our lawful basis, and how to stop it

We rely on legitimate interests — measuring the effectiveness of our own advertising — as the lawful basis for this processing. We do not currently ask for your consent before the pixel loads, and we would rather tell you that plainly than imply otherwise. You can stop it at any time:

• Block third-party tracking in your browser, or use any standard content blocker — the Meta Pixel is blocked by all of the common ones.
• Clear the _fbp and _fbc cookies for this site in your browser settings.
• Change what Meta does with off-Facebook activity in your Meta Accounts Centre under "Your information and permissions".
• Email us at the address in section 14 and object to this processing. We will stop sending your data to Meta.

9.5 Landlords who answer our four questions

If you are a landlord and you answer the four questions about how you would like to be contacted (section 5.1), we may send Meta your email address and phone number, each irreversibly hashed using SHA-256 before it leaves our systems. We do this to show our adverts to other landlords who may want the same help, and to stop showing them to you. Meta receives only the hashes, and can use them solely to look for a match against existing Meta accounts. We do not send your answers, your property's address, or anything else about your enquiry.

We rely on our legitimate interests in reaching other landlords like you. You can object at any time by emailing us at the address in section 14, and we will stop including you in anything we send to Meta.

10. Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data, in certain circumstances
• Object to or restrict certain processing
• Request a copy of your data in a portable format
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled

To exercise any of these rights, contact info@stayful.co.uk.

11. Keeping your data secure

Leads are delivered via an encrypted, real-time connection, and access to subscriber accounts and landlord data is restricted to what's needed for the platform to function.

12. Children

This service is not directed at, and should not be used by, anyone under 18. We do not knowingly collect data from children.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected with an updated "last updated" date at the top of this page.

14. Contact us

For any question about this policy or how your data is handled, contact:

Stayful Ltd
20–22 Wenlock Road, London, England, N1 7GU
info@stayful.co.uk