Your privacy is our priority.

We collect information you provide directly, information collected automatically, and information from third parties.

Information You Provide

• Account registration data (name, email address, phone number)
• Profile information (profile photo, preferences, travel interests)
• Booking and payment information (stay dates, guest count, payment method details processed by Stripe)
• Communications (messages to hosts, support inquiries, reviews)
• Host-specific business information (company name, tax ID, bank account for payouts)
• Identity verification documents when required

Information Collected Automatically

• Device information (browser type, operating system, device identifiers)
• Usage data (pages visited, features used, search queries, booking patterns)
• Location data (IP address geolocation, with consent: precise location for search)
• Cookies and similar tracking technologies (see our Cookie Policy)

Information from Third Parties

• Google account information when using Google Sign-In
• Payment verification data from Stripe
• Property management system data when hosts connect their PMS

We use your personal information for the following purposes:

• Provide, maintain, and improve our Services — processing bookings, payments, and refunds
• Create and manage your account, including host and admin accounts
• Facilitate communication between guests and hosts through our messaging system
• Process payments and payouts through Stripe Connect
• Calculate and collect applicable taxes (Sales Tax, County Surtax, Tourist Development Tax)
• Send transactional emails (booking confirmations, payment receipts, review requests)
• Send marketing communications with your consent (you can opt out at any time)
• Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations and enforce our Terms of Service
• Analyze usage patterns to improve our platform and develop new features
• Personalize your experience with relevant search results and recommendations

We do not sell your personal information. We may share your information in the following circumstances:

• With Hosts/Guests — to facilitate bookings (e.g., guest name and booking details shared with host upon confirmation)
• With Service Providers — Stripe (payments), Resend (transactional email), Brevo (marketing email), Mapbox (maps), Vercel (hosting), Supabase (database), Sentry (error monitoring), PostHog (analytics)
• With Tax Authorities — we remit collected lodging taxes to applicable taxing authorities as required by law
• For Legal Compliance — when required by law, subpoena, court order, or government request
• For Safety — when necessary to protect the rights, safety, or property of OpenRoom, our users, or the public
• Business Transfers — in connection with a merger, acquisition, or sale of assets (users will be notified)

Depending on your location, you may have the following rights regarding your personal information:

• Access — Request a copy of the personal information we hold about you
• Correction — Request correction of inaccurate or incomplete information
• Deletion — Request deletion of your personal information (subject to legal retention requirements)
• Portability — Request your data in a structured, machine-readable format
• Opt-Out — Unsubscribe from marketing communications at any time
• Cookie Preferences — Manage cookie settings through our Cookie Policy

California Residents (CCPA): You have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us at privacy@openroomgroup.com or through your account settings.

We implement industry-standard security measures to protect your information:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• PCI DSS Level 1 compliance through Stripe for payment processing
• Regular security audits and penetration testing
• Row-Level Security (RLS) policies ensuring users can only access their own data
• Cloudflare WAF for protection against common web attacks

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We encourage you to use strong, unique passwords and enable available security features.

We retain your personal information for as long as necessary to provide our Services and fulfill the purposes described in this policy. Specifically:

• Active accounts: data retained while your account is active
• Booking records: retained for 7 years for tax and legal compliance
• Payment records: retained as required by financial regulations
• Deleted accounts: personal information purged within 1 day, with exceptions for legal holds

OpenRoom is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, contact us at privacy@openroomgroup.com and we will take steps to delete such information.

OpenRoom operates primarily in the United States. If you are accessing our Services from outside the US, your information may be transferred to and processed in the US, where data protection laws may differ from your jurisdiction. By using our Services, you consent to such transfers.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our platform at least 30 days before they take effect. Your continued use of our Services after changes become effective constitutes acceptance of the revised policy.

For privacy-related questions, requests, or concerns:

• Email: privacy@openroomgroup.com
• Website: openroomgroup.com/help
• OpenRoom Group, United States