Houfy Privacy Policy

Houfy, Inc. ("Houfy", "we", "us") runs a vacation rental marketplace where hosts list properties and guests book them directly. This policy explains what personal information we collect, why, who we share it with, and what you can ask us to do about it.

It covers houfy.com and the emails we send. Read it together with our Cookie Policy and our Terms of Service.

If you have a question about anything here, email us at info@houfy.com. We would rather you asked.

1. In short

• We collect what we need to run the marketplace: your account details, what you list or book, what you send through our messaging, and how you use the site.

• We use trusted companies to handle payments, verification, booking screening, analytics, advertising, and the features that generate text and improve photos for you, and we show tours and activities from partners such as GetYourGuide. They are named in §4.

• We do not publish your contact details to other users beyond what a booking requires.

• You can ask us for a copy of your data, ask us to correct or delete it, and object to some of what we do. §7 explains how.

• We are based in the United States, and your information may be processed there and in the other countries listed in §6.

2. What we collect

2.1 What you give us

Account details — your name and email address when you register. A phone number, address and profile photo if you add them.

Listing information — for hosts: property address, descriptions, photos, availability, pricing, house rules, and any registration or permit numbers a local authority requires.

Booking information — dates, guest numbers, the property booked, and any information you give the host about your stay.

Identity verification — every host completes identity verification before their first listing goes live, and we carry it out ourselves rather than through an outside verification company. All hosts provide a government-issued identity document. Hosts who do not connect through a channel manager also provide a recent utility bill. We delete the document image within 90 days of completing the check and keep only a record that it happened — see section 8. We do not run criminal background checks and we do not check sex offender registries.

Payments — payment details are collected and processed by Stripe, Square or PayPal, not by us. We keep the transaction record, and the postal code and country we need for billing and tax. We do not store full card numbers.

Messages — messages between hosts and guests sent through Houfy, and anything you send our support team.

Reviews and public content — reviews, posts, comments and anything else you publish on Houfy. These are visible to others by design.

Anything else you choose to give us — survey responses, competition entries, contact details you import to invite someone.

2.2 What we collect automatically

Usage data — pages viewed, searches run, listings opened, bookings started and completed, links clicked.

Device and log data — IP address, browser and device type, operating system, timestamps, referring page, crash reports. We collect this whether or not you are signed in.

Approximate location — derived from your IP address, used for language and currency defaults and for fraud checks. We do not collect precise device location.

Cookies and similar technologies — set out in full in our Cookie Policy, which forms part of this policy.

2.3 What we get from others

Sign-in providers — if you sign in through Google or Facebook, we receive your basic profile information from them. We never receive your password.

Payment, screening and sign-in providers — the outcome of a payment, the result of a houfyProtect booking check, and any fraud signals raised.

Channel managers and property management systems — where a host connects Houfy to a system like these, we receive listing, availability and booking data through that connection.

People who refer you — if someone invites you to Houfy, they give us your email address.

3. Why we use it, and on what basis

We rely on four legal bases. In the European Economic Area and the United Kingdom these have specific names; elsewhere they simply describe why we do it.

To perform our contract with you — creating and running your account; taking and managing bookings, including passing the host and guest the details each needs; processing payments and payouts; answering your support requests; and sending you service and transactional emails about your account and bookings. Without these we cannot provide the service you signed up for.

Because we have a legitimate interest — verifying host identity; screening bookings for fraud and risk where houfyProtect applies; providing the automated features described in §5C; detecting and preventing fraud, spam and abuse; measuring and improving the site; setting analytics and advertising cookies for visitors outside the European Economic Area, the United Kingdom and Switzerland, which you can switch off at any time in Cookie settings; and, where the law allows it, sending marketing to existing customers. We balance these against your interests, and you can object.

Because you have consented — analytics and advertising cookies for visitors in the European Economic Area, the United Kingdom and Switzerland, where we do not set them until you agree; and marketing emails where consent is required. You can withdraw consent at any time.

Because the law requires it — tax, accounting, payment and reporting obligations, and responding to valid legal requests.

4. Who we share it with

Between hosts and guests. When a booking is made, the host receives the information they need to host you, and you receive what you need to arrive. Before a booking, hosts see only what your public profile shows.

Service providers acting on our instructions. They may only use the data for the job we give them:

Stripe, Square and PayPal — take payments and pay out hosts.

Postmark — sends our transactional and marketing email.

Twilio — sends our text messages.

Amazon Web Services — hosts and stores the service, in the US West (Oregon) region.

Truvi Ltd — provides the houfyProtect guarantee and screens bookings for fraud and risk indicators before a reservation is confirmed, where a host has enabled houfyProtect. See §5A.

Anthropic — provides the models behind the features that generate text and suggestions for you. See §5C.

OpenAI — provides the models behind photo improvement. See §5C.

Advertising and review platforms. These companies receive limited information about how our site is used, and they also use it for their own purposes as described in their own policies. You control this through our cookie settings:

Google — Google Analytics, Tag Manager and Google Ads for measurement and advertising, and Google Sign-In if you use it to sign in. See Google's privacy policy.

Meta Platforms — the Meta Pixel, for advertising measurement. See Meta's privacy policy.

Trustpilot — displays reviews on some pages. See Trustpilot's privacy policy.

GetYourGuide — we do not contact GetYourGuide when you view a page. Once a day we ask GetYourGuide which tours and activities are near each destination we list, sending only that destination’s coordinates and a search radius, and we store the results; what you see on the page is served from that stored copy. We do not send your travel dates, your name, your email address or your account details, and GetYourGuide sets no cookies on Houfy. If you click through to GetYourGuide, you leave Houfy and GetYourGuide’s privacy policy applies. GetYourGuide may set a cookie on its own site recording that you arrived from Houfy, so that it can pay us a commission if you book. See GetYourGuide’s privacy policy.

Live chat and identity verification are both operated by Houfy itself, not by outside providers. Booking risk screening for houfyProtect is not — it is carried out by Truvi Ltd, described in §5A.

Channel managers and property management systems, where a host has connected one.

Authorities, where we are legally required to disclose, or where disclosure is necessary to respond to a valid legal request, to enforce our Terms, or to protect someone's safety. Where we are permitted to tell you about such a request, we will.

Tax and registration authorities, where the law requires us to report host or booking information, or where a local short-term-rental registration scheme requires it.

A buyer or successor, if Houfy is acquired or merges. We will tell you before your information becomes subject to a different policy.

We do not sell your personal information, and we do not give it to other companies to market their own products to you. We do share limited advertising and analytics identifiers with the platforms named above so that we can measure and target our own advertising — you can turn that off in cookie settings.

5. Advertising and analytics

We use Google Analytics to understand how the site is used, and Google Ads and the Meta Pixel to measure our advertising and show Houfy ads on other platforms. These set cookies and use identifiers, and you control them through our cookie settings — see the Cookie Policy.

We do not run a third-party advertising network on Houfy, and no outside company buys space to advertise to you here. Hosts can pay to promote their own listings, which affects where those listings appear in search — that is described in our Terms of Service.

We also show tours and activities from partners such as GetYourGuide. Those partners do not pay to be shown on Houfy; we may earn a commission if you book one through a link on Houfy. What we send them is described in §4.

5A. Booking screening and houfyProtect

Where a host has enabled houfyProtect on a listing, we send the booking and the details of the person making it to Truvi Ltd, which checks it against fraud and risk indicators before the reservation is confirmed. Truvi returns a result to us, and it also provides the damage guarantee that sits behind houfyProtect. We rely on our legitimate interest in preventing fraud and keeping stays safe, and on performing our contract with you where the check is part of a booking you have asked to make. What Truvi does with the information, and how long it keeps it, is set out in Truvi's own privacy notice.

The result of a check can affect a booking — including whether it proceeds and what cover applies to it. §5B explains what you can do about that.

5B. Automated checks and how to challenge one

Some of the checks we run are automated — screening a booking for fraud indicators, and the systems we use to detect spam, abuse and account takeover. These can affect what happens to a booking or an account without a person looking at it first.

If an automated check has gone against you, email info@houfy.com. We will have a person review it, tell you what we can about why the decision was made, and correct it if it was wrong. In the European Economic Area and the United Kingdom you have the right to ask for that review; wherever you live, we will do it.

5C. Automated and AI-assisted features

Some Houfy features generate text, suggestions or improved images for you — message drafts and replies, listing and website copy, marketing campaigns, trip suggestions and photo improvement. To do that we send the content you are working on, and the context needed to produce a useful result, to the provider behind that feature: Anthropic for the features that generate text, and OpenAI for photo improvement. They process it on our instructions and do not use it to train their models. We do not use the content of messages between members to train models of our own.

6. Where your information goes

Houfy is based in the United States, and your information is stored on servers in the United States, in Amazon Web Services' US West (Oregon) region.

Our team and contractors work from several countries, including India and the European Union, and access that information from there. Some of our service providers operate elsewhere.

When personal information is sent from the European Economic Area or the United Kingdom to the United States or to another country, we rely on the contractual protections our service providers put in place for international transfers, and we require them to protect your information to the standard described in this policy. If you would like more detail about the safeguards that apply, email us at info@houfy.com.

7. Your rights

Wherever you live, you can ask us to:

• give you a copy of the personal information we hold about you

• correct anything that is wrong

• delete your information — you can also delete your account yourself

• stop sending you marketing, by using the unsubscribe link or changing your settings

If you are in the European Economic Area or the United Kingdom, you can also ask us to restrict how we use your information, object to processing based on legitimate interests, and receive your information in a portable format. Where we rely on your consent, you can withdraw it at any time. You can complain to your national data protection authority.

If you are in California, Colorado, Connecticut or another US state with a privacy law, you may also have the right to know what we collect, to correct or delete it, to opt out of targeted advertising, and not to be treated differently for exercising those rights.

To opt out of targeted advertising, use Cookie settings in the footer of any page, or email info@houfy.com.

Sensitive information. Where we verify identity we handle a government-issued identity document. We use it only to carry out the check and to meet our legal obligations, we do not use it to infer anything about you, and we delete the image as set out in §8.

If we refuse your request, we will tell you why, and you can appeal by replying to that email. We will answer the appeal within 45 days, and tell you how to contact your state Attorney General if you are still not satisfied.

How to ask. Email info@houfy.com. We will respond within one month, and will tell you if we need longer. We do not charge for this. We may need to confirm who you are before we act, so that we do not hand your information to someone else.

If we cannot do what you ask — because the law requires us to keep something, because it relates to a live dispute, or because it would expose someone else's information — we will explain why. Section 8 sets out how long we keep each kind of record.

8. How long we keep it

We keep personal information while we have a reason to keep it, and then we remove it.

Identity documents — where we verify your identity, we delete the document image within 90 days of completing the check. We keep a record that the check happened, what type of document it was, and when.

Account information — while your account is open, and for 3 years after you close it.

Closed accounts — when you close your account we keep a minimal record of the closure: your email address, phone number, the date and the reason. We keep this so that we can honour your choice not to be contacted again, and to prevent misuse of the platform. We keep it indefinitely, because that purpose only works for as long as the platform exists.

Booking, payment and transaction records — 7 years, because tax and accounting rules require it. After that we remove the personal details and keep only the financial record.

Messages between members — 3 years after the stay they relate to. Where a conversation did not lead to a booking, 3 years after the last message.

Support conversations — 3 years after we close your request.

Fraud and safety records — 7 years, where we need them to keep the platform safe.

Reviews — reviews stay on Houfy after an account is deleted, shown as written by "Houfy user" rather than by name.

Marketing preferences — until you change them.

Server and access logs — 14 days.

Backups — our backups are overwritten on a 35-day cycle, so information you have deleted may persist in a backup for up to 35 days after it leaves the live service.

We may keep information for longer where the law requires it, or where it relates to a live dispute, claim or investigation. When that ends, the ordinary periods apply again.

9. If you are a host

When a guest books, you receive their personal information and you decide what you do with it. For that use you are responsible in your own right, separately from us: we are not responsible for what you do with guest information after you receive it, and you are not responsible for what we do with it on Houfy. You must use it only to host that stay, keep it secure, delete it when you no longer need it for that stay or for your own tax and accounting records, and not market to a guest without their agreement. If a data protection law applies to you, meeting it is your responsibility.

If you use a channel manager or property management system, that connection is between you and that provider.

10. Security

We use encrypted connections, restrict internal access to personal information, and monitor for unauthorised access. No system is completely secure, so we cannot promise that nothing will ever go wrong — but if a breach affects you, we will tell you where the law requires it.

If you think your account has been accessed by someone else, email info@houfy.com straight away.

11. Children

Houfy is not for children. You must be at least 18 to hold an account. We do not knowingly collect personal information from children. If you believe a child has given us information, tell us and we will delete it.

12. Changes

We update this policy from time to time. When we do, we change the date at the top. If a change materially affects your rights, we will tell you by email or through Houfy at least 30 days before it takes effect. Continuing to use Houfy after that means the updated policy applies to you.

13. Contact us

Email info@houfy.com, or write to:

Houfy, Inc. Legal Department 1500 N Grant St # 4282 Denver, Colorado 80203 USA