Staylist Privacy Policy

1.1 Business Customers.

Vacation-rental managers, owners, hospitality businesses, and other property operators use ApexOS to manage their operations and serve their guests (each, a “Customer”). When we process personal information for a Customer under its instructions, the Customer controls that information and we act as its service provider or processor. The Customer’s privacy notice also applies.

1.2 Staylist Activities.

We control personal information that we collect for our own business purposes, such as website use, business contacts, account administration, security, billing, service analytics, and direct communications from Staylist.

1.3 Privacy Requests.

If your request concerns a reservation, stay, property, or communication from a Customer, contact that Customer first. We will assist the Customer as required by our agreement and applicable law.

2.1 Information You Provide.

We may collect:

1. Contact and account information. Name, username, business contact details, account credentials, organization, role, and account preferences.
2. Reservation and stay information. Property, dates, party size, booking details, preferences, service requests, maintenance requests, and information needed to manage a reservation or stay.
3. Communications. Emails, text messages, support requests, chat content, call recordings, transcripts, and other communications with Staylist, a Customer, or an automated assistant.
4. Payment information. Payment tokens and limited transaction metadata. A third-party payment processor collects and processes full payment-card information through Staylist’s payment platform. Staylist does not store full payment-card numbers. Staylist receives transaction status and limited payment metadata and may initiate refunds or reversals through the platform.
5. Access and event information. Door, property-access, delivery, maintenance, task, and workflow events associated with use of the Services.
6. Feedback and content. Survey responses, reviews, files, images, instructions, prompts, outputs, and other content submitted through the Services.
7. Identity and verification information. Government-issued identification or other verification information when required by a Customer or an enabled service.

2.2 Information Collected Automatically.

We may collect device, browser, IP address, operating system, identifiers, log data, pages or features viewed, actions taken, referring pages, approximate location derived from IP address, and performance or diagnostic information.

2.3 Information from Customers and Third Parties.

We may receive information from Customers, property owners, authorized users, guests, integration partners, payment processors, communications providers, identity or fraud-prevention providers, and other services connected by a Customer.

2.4 Information We Do Not Intend to Collect.

The Services are not designed to collect biometric identifiers or precise geolocation. Do not submit that information unless Staylist has expressly authorized the use. A responsible adult may provide ordinary reservation-party information, such as the number of children in a group, but should not provide unnecessary personal information about a child.

3.1 Services and Transactions.

We use personal information to provide, configure, maintain, and support the Services; create and administer accounts; process reservations and requests; support payments; enable property access; and perform Customer-configured workflows.

3.2 Communications.

We use personal information to communicate about accounts, reservations, stays, requests, service updates, support, safety, and security. We may facilitate calls, recordings, texts, emails, or AI-assisted communications for a Customer.

3.3 Security and Integrity.

We use personal information to authenticate users, monitor and protect the Services, prevent fraud and misuse, troubleshoot problems, and enforce our agreements.

3.4 Analytics and Improvement.

We use personal information and service data to analyze use and performance, improve the Services for a Customer, develop generally available features, and evaluate service quality. We may use aggregated or deidentified information that does not reasonably identify a person or Customer for lawful business purposes, including benchmarking.

3.5 Artificial Intelligence.

We may process prompts, instructions, communications, reservations, preferences, requests, recordings, transcripts, outputs, and related information to provide, secure, evaluate, train, and improve features that use artificial intelligence, machine learning, large language models, or similar technology (“AI Features”). Before we use interaction data to train a Staylist-owned model, we strip personal information and contact details from the training data. We do not authorize third-party AI providers to use this information to train or improve their general-purpose models unless the applicable Customer authorizes that use in writing. Our AI Terms at https://staylist.com/legal/ai-terms provide more information.

3.6 Legal and Business Purposes.

We use personal information to comply with law, respond to lawful requests, establish or defend legal claims, manage billing and contracts, conduct audits, and support a merger, financing, acquisition, reorganization, or sale.

3.7 Marketing.

We may use business contact information to provide information about Staylist products, services, product updates, and events, subject to applicable law and available opt-outs. We do not currently send marketing calls or text messages to consumers in our own name. If we begin doing so, we will obtain any consent required by law.

4.1 Customers and Their Users.

We disclose information to the applicable Customer, property owner, authorized user, or other person whom the Customer authorizes when needed to provide the Services and fulfill requests.

4.2 Service Providers.

We disclose information to vendors that provide hosting, security, support, payment processing, communications, analytics, AI, implementation, and other services for us. These providers process information under the agreements and provider terms applicable to their services. The AI-provider practices described in Section 3.5 may apply to information processed through AI Features.

4.3 Integrations and Customer-Directed Disclosures.

We disclose information to a third-party service or integration when a Customer or user enables the connection or directs the disclosure. The third party’s privacy notice applies to its processing.

4.4 Legal, Safety, and Rights.

We may disclose information if we reasonably believe disclosure is required by law or needed to protect a person, the Services, Staylist, a Customer, or another person’s rights, property, or safety.

4.5 Business Transactions.

We may disclose information in connection with a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate confidentiality protections.

4.6 Aggregated or Deidentified Information.

We may disclose information that has been aggregated or deidentified so that it does not reasonably identify a person or Customer. We will not attempt to reidentify deidentified information except as permitted by law to test our deidentification methods.

4.7 No Cross-Customer Access.

We do not disclose personal information that we process for one Customer to another Customer or permit another Customer to access it.

4.8 Advertising Disclosure.

Staylist does not sell personal information or share it for cross-context behavioral advertising or other targeted advertising. If we disclose business contact information to a business partner, our agreement with that partner prohibits it from using the information for those purposes.

5.1 Technologies.

We and our service providers use cookies, pixels, local storage, software development kits, and similar technologies to operate the Services, remember preferences, understand use, measure performance, and protect accounts.

5.2 Analytics and Similar Tools.

Our website may use third-party analytics, website chat, and similar tools. These tools may collect device, browser, page-view, interaction, and referral information as described by the applicable provider.

5.3 Choices.

You can control many cookies through browser or device settings and any cookie-management tool we make available. Disabling a necessary cookie may affect functionality.

5.4 Global Privacy Control.

We do not currently respond to Global Privacy Control, Do Not Track, or similar browser signals because we do not sell personal information or share it for cross-context behavioral advertising.

6.1 AI-Assisted Services.

AI Features may answer questions, summarize content, draft communications, recommend actions, or perform configured workflows. AI outputs may be inaccurate or incomplete and should be reviewed before material use.

6.2 Significant Decisions.

Staylist does not use AI Features on its own behalf to make decisions that produce legal or similarly significant effects about guests. A Customer is responsible for its configurations, decisions, notices, and human-review processes.

6.3 AI Service Providers.

We use third-party model and AI-infrastructure providers to route and process large-language-model traffic. These providers may process prompts, outputs, and tool-call traces as our service providers or subprocessors to provide and route requests and to support our security, evaluation, and improvement of AI Features. We do not authorize these providers to use this information to train or improve their general-purpose models unless the applicable Customer authorizes that use in writing. Provider terms and practices may change, but the no-training commitment in Section 3.5 will continue to apply.

7.1 Retention Criteria.

We retain personal information for as long as reasonably needed to provide the Services, maintain business and transaction records, comply with law, resolve disputes, protect the Services, and enforce agreements. The period depends on the type of information, the Customer’s instructions, legal requirements, and operational needs.

7.2 Customer-Controlled Information.

While a Customer account is active, we retain guest records and communications until the account ends, subject to Customer instructions and available deletion or retention settings. We delete stored payment tokens and limited card-related metadata 30 days after the latest departure associated with that payment information. A Customer selects the available retention period for its call recordings. We retain Customer-controlled information for 30 days after the Customer account terminates and then delete it from production systems, subject to legal holds, legal requirements, and routine backup deletion.

7.3 Deletion Limits.

We may retain information longer if required by law, subject to a legal hold, needed to prevent fraud or abuse, or stored in routine backups until overwritten through normal processes.

8.1 Safeguards.

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure.

8.2 No Guarantee.

No system, transmission method, or storage method is completely secure. You are responsible for protecting credentials and promptly reporting suspected unauthorized access.

9.1 Account and Communications Choices.

You may update certain account information through the Services. You may opt out of promotional email by using the unsubscribe link. You may opt out of marketing texts as stated in the message. You may still receive nonmarketing messages about an account, reservation, transaction, security, or requested service.

9.2 Privacy Rights.

Depending on where you live and subject to legal exceptions, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information; obtain information about our processing and disclosures; withdraw consent; opt out of certain targeted advertising, sales, or profiling; and appeal a denied request.

9.3 How to Submit a Request.

Submit a request to [email protected] or through https://staylist.com/legal/privacy-request. Describe the request and the context in which you interacted with Staylist. We may verify your identity and authority before acting. An authorized agent may submit a request where permitted by law, subject to verification.

9.4 Customer-Controlled Information.

If Staylist processes information for a Customer, we may direct your request to that Customer. We will assist the Customer as required by law and our agreement.

9.5 Appeals and Complaints.

To appeal a decision, reply to our response or contact [email protected] with “Privacy Appeal” in the subject line. You may also contact the privacy or data-protection regulator where you live.

9.6 Nondiscrimination.

We will not unlawfully discriminate against you for exercising a privacy right.

10.1 Not Directed to Children.

The Services are not directed to children under 13, and Staylist does not knowingly collect personal information directly from a child under 13. A responsible adult may provide limited information about children as part of ordinary reservation-party details.

10.2 Contact.

If you believe a child provided personal information directly to Staylist without appropriate consent, contact [email protected]. We will review the request and take appropriate action.

11.1 United States and Canada.

Staylist and its providers may process personal information in the United States, Canada, and other locations where they operate. Privacy laws in those locations may differ from the laws where you live.

11.2 Safeguards.

Where required, we use contractual or other safeguards for cross-border transfers. You may contact us for information about applicable safeguards.

12.1 Other Policies.

The Services may link to or integrate with third-party sites and services. Staylist does not control their privacy practices. Review their privacy notices before providing information.

13.1 Updates.

We may update this Privacy Policy. We will post the updated version and revise the Effective Date. If a change is material, we will provide additional notice when required by law.

14.1 Privacy Contact.

Questions, requests, or complaints may be sent to [email protected], https://staylist.com/legal/privacy-request, or by mail to Staylist, LLC, Attention: Privacy, 614 Mabry Hood Road, Suite 100, Knoxville, Tennessee 37932, United States.