Privacy Policy
Last updated: July 2026
1. Who We Are
Guestark is a software-as-a-service platform that provides vacation rental hosts with booking tools, guest-facing websites, and payment processing.
Operator: Christoph Koch, PO BOX 215, 7142 Takaka, New Zealand
Contact: support@guestark.com
2. Data We Collect from Hosts
- Account information: name, email address, password (hashed)
- Property details: name, description, photos, location, pricing, amenities
- Payment data: Stripe Connect account details (managed by Stripe; we store only the Stripe Account ID)
- Subscription billing data via Stripe (we do not store card numbers)
3. Data We Collect from Guests
When a guest submits a booking inquiry or makes a payment, we collect:
- Name, email address, phone number (optional)
- Booking dates and number of guests
- Messages sent to the host
We do not create guest accounts. We do not send marketing emails to guests unless they explicitly opt in via the newsletter checkbox during booking.
3a. Guest Guide Email Verification
When a guest scans a property's QR code or visits a property's guest guide URL, they are asked to enter their email address before the guide is shown. We use this email address to:
- Send a one-time verification code so we know the address belongs to the guest (service, legitimate-interest basis).
- Keep a 30-day device-scoped session cookie so the guest doesn't have to re-verify on every visit during their stay.
- Send occasional marketing or update emails about the host's property only if the guest explicitly ticks the optional marketing checkbox at the email-entry step. The checkbox is unchecked by default; the verification works whether or not it is ticked.
Hosts do not have access to the email addresses of guests who pass through the guide. Email addresses are stored only in the Guestark platform and are used solely for the purposes above.
Guests can withdraw marketing consent at any time via the unsubscribe link in every marketing email. Withdrawing marketing consent does not affect access to the guide.
We keep a versioned record of the exact wording shown to each guest at the moment they gave consent, and an append-only audit log of consent grants and withdrawals, so we can demonstrate compliance with our burden-of-proof obligations.
4. How We Use Data
- Service delivery: processing bookings, sending confirmation emails, displaying property pages
- Communication: transactional emails (booking confirmations, host notifications)
- Fraud prevention: detecting spam submissions via honeypot fields
5. Payments
All payments are processed by Stripe. Guests enter card details directly with Stripe. Guestark never sees or stores full card numbers. Host payouts are handled via Stripe Connect.
6. Email
Transactional emails are sent via Resend. We send booking confirmations, host notifications, and account-related emails. We do not send marketing emails to guests without explicit opt-in. Guests may opt out at any time via the opt-out page.
7. Guest Opt-Out
Guests who opted in to newsletters can unsubscribe at any time via the unsubscribe link in each email or by visiting guestark.com/opt-out.
8. Data Retention
- Booking records are retained for 7 years for tax and legal compliance.
- Host account data is deleted upon request. Email support@guestark.com to request account deletion.
- Guest data associated with bookings is retained with the booking record. Guests may request deletion of data not required for legal retention by contacting us.
9. Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data (subject to legal retention periods)
- Object to processing of your data
Contact support@guestark.com. We will respond within 30 days.
10. Cookies and Local Storage
Guestark uses only strictly necessary and functional cookies. We do not use tracking, analytics, or advertising cookies, and we do not embed third-party advertising or social-media pixels. Because we use only these essential and functional cookies, we do not display a cookie consent banner.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
sb-* (Supabase) | Keeps you signed in to your host dashboard | Strictly necessary (authentication) | Session / up to ~1 year |
guestark_dev_auth | Pre-launch site password gate (temporary; removed at public launch) | Strictly necessary (security) | 90 days |
__Host-gst_sid | Remembers a verified guest so the email verification code is not re-requested on every visit during the stay | Functional (guest guide) | 30 days |
gg_qr | Marks that a device arrived via a printed QR code, so the guest email gate applies correctly | Functional | 30 days |
locale | Remembers your language preference | Functional (preference) | 1 year |
guestark-active-property | Remembers which property a multi-property host has selected in the dashboard | Functional (preference) | 1 year |
guestark_ref | Attributes a referral to the correct partner; deleted after it is used | Functional | Up to 10 years (or until used) |
__stripe_mid, __stripe_sid (Stripe) | Payment processing and fraud prevention, only on pages where you pay or manage billing | Strictly necessary (payments), set by Stripe | ~1 year / ~30 minutes |
Cloudflare Turnstile (cf_chl_*) | Bot and abuse protection on the guest email form, only when the challenge runs | Strictly necessary (security), set by Cloudflare | Short-lived |
All cookies are first-party except Stripe’s and Cloudflare Turnstile’s, which are set by those providers only on the pages where you pay or complete a security check. You can control or delete cookies in your browser settings; note that the strictly necessary ones are required to sign in or make a payment.
We also use your browser’s local storage for functionality (for example, saving an in-progress listing draft and its photos on your own device) and for anonymous, first-party product analytics (a random identifier that is not linked to your identity). This data stays on your device or with us and is not shared with third parties.
11. Do Not Sell or Share; Global Privacy Control
We do not sell or share your personal information, and we do not use it for targeted or cross-context behavioural advertising. There is accordingly nothing to opt out of in that respect. We nonetheless recognise Global Privacy Control (GPC) and similar browser signals.
12. Updates
This policy may be updated from time to time. Continued use of Guestark after changes constitutes acceptance of the updated policy.