Privacy Policy

1. Who We Are

KynStay is a product of Tilted Labs LLC, a California limited liability company. When we say "KynStay," "we," "our," or "us" in this policy, we mean Tilted Labs LLC operating as KynStay.

We are the data controller for the personal information we collect through the KynStay platform. This means we decide how and why your personal information is processed. Where a host holds information about their guests in their own account, or takes a card payment on their own Stripe account, that host is responsible for that copy of the information in their own right — see Section 5.

2. Information We Collect

2.1 Account information you provide

When you create an account, we collect:

• Name and email address
• Phone number (optional)
• Password (stored only in hashed form—we cannot see your actual password)
• Profile photo (optional)
• A short profile description, if you write one — the members you share with can see it
• Currency preference (USD, GBP, or EUR)
• Whether you are open to reciprocal hosting, and what you told us you came to KynStay to do
• Notes we keep about your use of KynStay: which tips you have dismissed, whether you have opted out of setup emails, which of those emails we have already sent you, a referral code, and — for hosts — a count of cancellations that feeds the standing check described in Section 3
• The dates on which you confirmed you are 18 or over, accepted our Terms, and were shown this policy

2.2 Property information

If you list a property, we collect:

• Property address, description, photos, and pricing
• Availability and booking calendar data
• Property access information you choose to provide, such as WiFi credentials, lock codes, emergency contacts, and check-in instructions

2.3 Booking information

When bookings are made through the platform, we collect:

• Check-in and check-out dates, guest count, and booking notes
• Pricing details (base rate, cleaning fees, discounts)
• Payment status and payment method — either a method you tell us you paid by (e.g., Venmo, Zelle, bank transfer) or, where the host accepts cards, a record of the card payment described in Section 2.6
• A history of any modifications to bookings, including who made the change, what was changed, and any reason given; and any reason given for declining or cancelling a booking

2.3a Payment details you give us as a host

If you tell guests how to pay you outside KynStay, we store the details you enter — for example a bank sort code and account number, an IBAN, a Zelle or PayPal address, or a name and postal address for a cheque — together with any instructions you write and any payment link you provide. We store these only so we can show them to the guests you have given access to. We do not use them to take money, and we never move money ourselves.

2.3b Messages

KynStay includes a private messaging area so hosts and guests can discuss a stay. We store the content of the messages you send, who sent them, when, which conversation and property they relate to, and whether and when the other person read them. Hosts can also save message templates and set up messages that send automatically when a booking reaches a certain point; we store those too. Only you and the other person in the conversation can read it through KynStay; our administrators can also read it (see Section 5). Please do not send health information, financial details or other sensitive information through KynStay messages.

2.3c Reports about a booking

If you tell us something has gone wrong with a booking, we store what you wrote, which booking it concerns, which category you chose, when you sent it, and what we did about it. Where the report concerns safety or a breach of our Terms, our administrators read it and may act on it. Please describe what happened without including health information or other sensitive details about anyone.

2.3d Requests to stay

If you ask a host for access through a property's public profile, we store your request: which property it is for, the note you write to the host, when you sent it, and whether it was approved or declined, and when. The host of that property sees your note, your name and your email address, in KynStay and in the email we send them about your request; our administrators can also see it (see Section 5). A declined request is kept, so that the host can change their mind later and so that the same request is not sent twice. Your request is deleted if you delete your account or the host deletes the property.

2.4 Information from third-party sign-in

If you sign in using Google or Apple, we receive your name, email address, and profile picture from that provider, and an identifier for your account there. We store that identifier and the web address of your profile picture, which we display in KynStay; your browser fetches the picture from the provider, which sees your IP address when it does. We do not receive your password from these services.

2.5 Information collected automatically

• IP address—used for security, rate limiting, and fraud prevention, and to estimate your country so we can suggest a currency — for which your IP address is sent to a geolocation provider named in Section 5. The IP addresses of your most recent and previous sign-in are stored on your account record and are visible to our administrators, and the address you accepted our Terms from is kept with that record (Section 7).
• Calendars you connect—if you link a calendar from another site, we fetch it from that site to keep your dates in step; and we can publish your booked dates as a calendar link you can paste elsewhere, which shows only which dates are taken, never who is staying
• Device and browser information—included in standard web server logs
• Session cookies—essential for keeping you logged in (see Section 4)

2.6 Information from Stripe

We use Stripe in two separate ways, and hold different information for each.

Your KynStay subscription.

When you subscribe to KynStay, your payment is processed by Stripe. We store your subscription plan, billing interval, subscription status, and a Stripe customer identifier to manage your account. We receive payment confirmations from Stripe, but we never receive or store your full credit card number. Card details are handled entirely by Stripe.

Card payments from guests to hosts.

Hosts may connect their own Stripe account so guests can pay them by card. Where a host has done that:

• If you are the host, we store the identifier of your connected Stripe account, whether Stripe has enabled it to take payments, whether you have submitted your details, and the dates you completed setup and accepted Stripe's terms. If you later disconnect, we keep the identifier of the disconnected account so we can still match up past payments.
• If you are the guest, we store Stripe's identifiers for the checkout session, the charge, the payment intent and any refund, together with the amount, the currency and the fee Stripe charged. As with subscriptions, we never receive or store your full card number.

Card payments are taken on the host's own Stripe account, not ours — KynStay never receives or holds the money. An important consequence for guests is described in Section 5.

2.7 Sensitive information

We do not ask for information about your health, your beliefs, your ethnicity or anything else the law treats as sensitive, and we have no need for it. Please do not put it in a message, a booking note or a report. If you tell a host something sensitive because it matters for your stay, that is between you and them — they see it, and so can our administrators. If a host records an emergency contact for a property, please make sure that person knows their details are held here.

3. How We Use Your Information

We process your information for the following purposes. Where required by UK and EU data protection law, we have identified the lawful basis for each.

Where we rely on legitimate interest, we have assessed that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interest (see Section 8).

3.1 Automated decisions

Some things happen automatically on KynStay without a person reviewing them: a booking request the host has not responded to within their chosen window is declined automatically; a booking that is not secured by its deadline is released; a subscription is paused automatically when a payment fails; and we count cancellations against a host's account, which can raise a warning and lead us to review that account. Repeated failed sign-ins from the same address are blocked automatically. These follow fixed rules that we set, not a judgement about you, and none of them produces a legal effect on you. If an automated outcome seems wrong, email privacy@kynstay.com and a person will look at it.

4. Cookies and Similar Technologies

We use only essential cookies that are strictly necessary to operate the platform:

• Session cookie—keeps you logged in while you use KynStay
• CSRF token—protects against cross-site request forgery attacks
• Remember-me cookie—keeps you signed in between visits (only if you choose this option)
• Preference cookies—remember that you have dismissed a banner or notice, so we do not show it again
• Payment pages—when you pay by card or save a card, Stripe's checkout script runs on that page and may set its own storage to run the payment and detect fraud

We also store a little information in your browser rather than in a cookie: which view you last chose on a screen with a toggle, and a temporary draft of a property listing you are part-way through, so you do not lose it if the page reloads. The draft is held only for that browser tab and is cleared when you sign out. None of this is sent to anyone else.

Some parts of our pages load from other companies' servers: the web fonts we use come from Google, a small number of software libraries come from a public code repository (jsDelivr), and some images on our public pages are hosted by Unsplash. When your browser fetches these, that company sees your IP address and which page requested them. We do not use them to track you, and they set no cookies for us.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies. We do not use any tools that track your activity across other websites.

5. Who We Share Your Information With

We share your information only with the following parties, and only to the extent necessary:

We also share information in these circumstances:

• Your host, and other users: Property details (descriptions, photos, pricing, availability) are visible to the guests a host has given access to. If a host switches on a property's public profile, the page is public to anyone who has the link, without signing in. The host chooses what it shows, from three choices: nothing about the property (only an optional welcome line); the property's name, one cover photo, city and country, number of bedrooms and bathrooms, how many it sleeps and welcome line; or all of that plus the property's other photos and its description. The address, pricing and availability are never shown there, and any photos on that page are resized copies with their location metadata removed. If you book, or a host gives you access to a property, that host can see your name, your email address, your bookings with them, the access level they have given you, your payment record for those bookings and your messages with them — in their KynStay account, for as long as they keep it. They hold that information under their own control, and their own practices govern it; our Terms require hosts to use it only to run the stay and to keep it secure. If you want a host to remove you from their guest list, ask them, or email us and we will pass it on.
• Our administrators: A small number of KynStay staff can see your account to help with a problem or to investigate a report — including, where necessary, viewing KynStay as you would see it, which shows them your bookings, messages and payment records. That access is read-only, and every session is recorded in the log described in Section 7.
• Your host, if you pay by card: A card payment is taken on the host's own Stripe account, which makes that host the merchant of record for your payment — not KynStay. The host therefore sees the transaction in their own Stripe dashboard, including whatever Stripe shows them about it, and they — not we — decide how long they keep it and who else they let see it. Stripe's own privacy notice and your host's own practices govern that copy of the data. If you would rather not have a payment recorded on a host's Stripe account, use one of the host's manual payment methods instead.
• Legal requirements: We may disclose information when required by law, regulation, court order, or governmental request.
• Business transfers: If KynStay is acquired or merged with another company, your information may be transferred as part of that transaction. Where that happens, the acquiring company's privacy policy would apply to your information from the date we post that change here.

6. International Data Transfers

Your data — including every file you upload — is stored on servers located in Germany (EU), operated by Hetzner Online GmbH, and your uploaded files never leave them. Some of your data is also transferred to service providers in the United States (Stripe, Postmark, Google, Apple, Mapbox, IPinfo and Sentry) as described in Section 5.

Where data is transferred outside the European Economic Area (EEA) or the United Kingdom, we rely on the following safeguards:

• EU-US Data Privacy Framework—where the recipient is certified under the framework
• Standard Contractual Clauses (SCCs)—approved by the European Commission
• UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs—for transfers from the UK

You can request further information about the safeguards we use by contacting us at privacy@kynstay.com.

7. How Long We Keep Your Information

Where a row above says we do not enforce a fixed maximum period, that is a statement of what our systems do today, not a claim that we keep the data forever by design. We are working to put automatic limits on each of these; until we do, we would rather tell you the criterion we actually apply than publish a period we do not keep to. You can ask us to delete your data at any time — see Section 8.

8. Your Privacy Rights

8.1 Rights for all users

Regardless of where you live, you can:

• Access the personal information we hold about you
• Correct inaccurate information in your account
• Delete your account and associated data — with the exceptions set out in Section 7, which that table states in full. Chiefly: the record of which version of our Terms you agreed to survives, because without it we could not establish or defend a legal claim about them; an invitation someone else sent to your email address survives, because it belongs to their account rather than yours and is deleted with theirs; and records of payment activity and of administrator actions are kept for the periods stated there.
• Export your data in a portable format
• Opt out of setup emails. As well as the emails we have to send you to run your bookings and your subscription, we send a few one-off emails to help you get set up. Every one has an unsubscribe link, and your email app's own unsubscribe button works too. Opting out stops all of them and does not affect booking, payment or account emails, which we have to send.

You can do two of these yourself. From your profile you can ask us to email you a copy of your data, and you can delete your account. The copy covers your account and subscription details, your properties, your bookings as a guest, your property access records, the invitations you sent, your notification preferences, and the record of the terms you agreed to; it does not yet include message content, payment records, bookings you received as a host, notifications or uploaded photos — email privacy@kynstay.com for any of those and we will send them. We send the copy as a file attached to an email to your account address; email is not fully secure, so save the file and delete the email once you have it.

One condition on deletion: if you have bookings still to come — as a host or as a guest — cancel or complete those first. For a host, that is so your guests are not left with a stay nobody is hosting; for a guest, it is so your host is told and any refund is worked out under the booking's cancellation policy, rather than the booking vanishing from their records. If a deletion does not go through, email us and we will complete it for you.

8.2 Additional rights for UK and EU residents

Under the UK GDPR and EU GDPR, you also have the right to:

• Restrict processing of your personal information in certain circumstances
• Data portability—receive your data in a structured, commonly used, machine-readable format
• Object to processing based on our legitimate interests
• Withdraw consent at any time where consent is the basis for processing
• Lodge a complaint with a supervisory authority—in the UK, this is the Information Commissioner's Office (ICO)

We will respond to rights requests within one month. If a request is complex, we may extend this by up to two further months, and we will let you know. Where California law applies, we respond within 45 days and will tell you if we need the further 45 days it allows. An authorised agent may make a request for you with your written permission.

8.3 Additional rights for California residents

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to:

• Know what personal information we collect, use, and disclose
• Delete personal information we hold about you, subject to the exceptions in Section 8.1
• Opt out of the sale or sharing of personal information—we do not sell or share your personal information as defined by the CCPA
• Non-discrimination—we will not treat you differently for exercising your privacy rights

9. Children's Privacy

KynStay is intended for users who are 18 years of age or older. Everyone who creates an account confirms they are 18 or over, and we keep a record of when that confirmation was made. We do not knowingly collect personal information from anyone under 18. If we discover that we have collected information from a person under 18, we will delete their account and data promptly, keeping only the records described in Section 7 that survive account deletion. If you believe a minor has provided us with personal information, please contact us at privacy@kynstay.com.

10. Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit between your browser and KynStay using HTTPS/TLS, and encryption at rest of the most sensitive fields we hold: lock codes, WiFi passwords, emergency contacts and key-pickup details
• Where a host has arrival details sent to a guest by email, those details are included in the email itself. Email is not fully secure in transit or in the recipient's mailbox; hosts should change lock codes between guests
• Password hashing using bcrypt (we never store plaintext passwords)
• Rate limiting and automatic account lockout after repeated failed login attempts
• No storage of credit card data—all card information is handled by Stripe using PCI-compliant tokenization
• Filtering of passwords, tokens, access codes and emergency contacts from our request logs
• A content security policy that stops our pages loading scripts from anywhere we have not named, and no analytics or advertising scripts at all

If something goes wrong. If personal information is lost or exposed in a way that is likely to put you at risk, we will tell you as soon as we can, describe what happened and what we are doing about it, and — where the law requires it — report it to the relevant regulator within 72 hours of becoming aware.

While we work to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to following industry best practices and promptly addressing any security issues.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we post the updated policy on this page and change the "Last updated" date at the top.

Where a change materially affects your rights, we will say so on this page. When we update this policy, we show you a notice inside KynStay the next time you use it, with a link to read it in full. We do not currently email you about changes, so please also check this page from time to time. A privacy policy is a notice rather than an agreement, so when it changes we bring the change to your attention rather than asking you to agree to it again — but if you do not agree with a change, you may stop using KynStay and close your account, as described in our Terms of Service.

12. Contact Us

UK residents: If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):