Privacy Policy

This policy explains how cntrll ("we", "us") handles personal data in the cntrll property management platform. It covers hosts and property managers who create an account, the team members they invite, the cleaners and maintenance contacts they work with, and the guests who stay at their properties.

For your own account data, we're the controller. For data about your guests, cleaners and property owners that you bring into cntrll, you're the controller and we process it on your behalf, to run the service for you.

Account details. Name, email address, phone number, company name (for property managers) and account type.

Property data. What you enter to run a property: address, description, amenities, prices and availability rules, tourist licence and registration numbers, owner NIF/IBAN where you manage for an owner, cleaner details, and access details such as door or lockbox codes.

Guest data. From your connected channels: guest names, stay dates, number of guests, platform, booking value, the messages exchanged with guests, and the reviews they leave. Guests who open a property's guide link see what you've put in it; a door code is only shown to a booked guest shortly before their stay.

Cleaner and team data. Names, emails and (optionally) phone numbers of team members, cleaners and maintenance contacts; team members' roles and which properties they can access; cleaners' rates, hours and task history.

cntrll AI conversations. Messages you send the assistant and the changes you approve, kept so you can see what changed and why.

Payment details. Payments are processed by Stripe. We never see or store your card number; we keep only what's needed to run your subscription (plan, status, and a reference to your Stripe customer).

Technical data. IP address, browser and device information, collected to keep the service secure and working.

To run the service: showing your properties, calendar, bookings and reports; keeping prices and availability in sync across your channels; sending and drafting guest messages; publishing review replies; creating cleaning tasks and sending cleaners their job links (which include the address and access details they need).

To power cntrll AI and the writing help in cntrll: the relevant property, booking, pricing, message or review data is sent to our AI provider (Anthropic) so it can answer, draft or propose changes. It isn't used to train AI models.

To find a property's location on the map, its address is sent to a geocoding service.

To take payments and manage your subscription (Stripe), and to send transactional email — invites, task links, booking, cleaning and billing notices (Resend).

To keep the service secure — debugging, preventing fraud and enforcing our Terms.

We don't sell personal data. We share it only with the providers needed to run cntrll, each acting on our behalf:

• Supabase — database, file storage and sign-in
• Channex — the channel manager that connects your listings, bookings, messages and reviews with Airbnb, Booking.com and Vrbo
• Anthropic — cntrll AI and writing help
• Stripe — payments
• Resend — transactional email
• OpenStreetMap (Nominatim) or Google Maps — turning a property address into a map location

Data you sync through a connected channel is also held by that platform (Airbnb, Booking.com, Vrbo) under your own account with them.

We use only what the service needs to work: a sign-in cookie to keep you logged in, and your browser's local storage for small preferences (like your clock format or which property you last looked at). There are no advertising or cross-site tracking cookies.

We keep your data while your account is active. When you delete your account, it's deleted immediately and permanently — properties, bookings, guest messages, reports, cleaner records and cntrll AI history — your subscription is cancelled and your properties are disconnected from your channels. Billing records may be kept longer where the law requires it for accounting.

Removing a single property deletes its bookings, messages, tasks and guide in the same way.

If you're in the EU/EEA or UK, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Have it deleted — available directly from Settings → Security
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Complain to your local data protection authority

Guests, cleaners and owners should contact the host first, as the controller of their data; we'll help the host respond. To exercise a right not already available in Settings, contact us at the address below.

We use industry-standard measures — encryption in transit, access controls, and row-level isolation between accounts. No system is completely secure, and we haven't yet completed a formal third-party security audit.

We'll update the date at the top when this policy changes. It's currently a draft pending legal review.

Questions about this policy or your data: privacy@cntrll.app (placeholder address — to be confirmed).