Privacy Policy

Higherstay (“we”, “us”) provides a free tool for short-term rental hosts to build a digital guidebook for their guests. Higherstay Ltd, a company registered in Scotland (company number SC903082), whose registered office is at 3F1 Third Floor, 3 Hill Street, Edinburgh EH2 3JP, United Kingdom, is the data controller for the personal data described in this policy.

You can reach us at hello@higherstay.com with any question about this policy or your data.

Higherstay runs on two domains that make up one service. higherstay.com is our marketing site — it explains what the product does and links through to the tool. higherstay.app is the tool itself: where hosts build a guidebook and where their guests view it. This single policy covers both, since they share the same underlying systems and the same company runs them.

If you just browse higherstay.com

We don’t ask you for anything. Our own analytics record anonymised, aggregated visit data. If you agree to it, the homepage and the guidebook builder (higherstay.app/create) also run the Meta Pixel, which tells Meta that a page was visited so we can measure our ads on Facebook and Instagram — see Cookies below.

If you build a guidebook (a “host”)

Creating a guidebook at higherstay.app/create doesn’t require an account or a password. To build your guide, we ask for:

• Your name and the property’s name and address
• Your email address — we send your guide link to it, email you when a guest checks in, and use it to match your guides to you if you later sign in
• A property photo, if you choose to upload one
• WiFi network name and password, house rules, check-in/check-out times, and any other guide content you write (parking, local recommendations, etc.)
• Your phone number, only if you choose to add it so guests can reach you
• Photos you take with the Photo Walkthrough (a Pro feature), which are added to your guide and are visible to anyone you share the guide link with. If you replace a photo, the old file is deleted straight away
• If you paste in an Airbnb listing link to save time, we fetch the public content of that page to help pre-fill your guide

Everything you enter here is written into your guidebook and becomes visible to anyone you share the guide link with — it is not kept private to us. Please don’t enter anything (yours or a third party’s) that you don’t want a guest to see.

If you sign in to manage your guides

Signing in is optional. It uses the same email address and a password you choose. The first time (or if you forget your password), we email you a one-time link to prove the address is yours before you set one. Your password is stored only as a secure hash by our sign-in provider, Supabase — we never see it. Signing in sets a cookie that keeps you logged in; it’s needed for the dashboard to work and isn’t used for anything else.

If you view a guidebook (a “guest”)

Before viewing a guide, we ask for your name, how you booked (e.g. Airbnb, Booking.com), and your check-in/check-out dates. This lets the host know who’s viewing their guide, and lets us show the right information (like door codes) only during your actual stay. This is stored against the property you’re viewing, and also saved in your browser so you don’t have to re-enter it on a repeat visit.

If you rate your stay (Pro guides only)

On Pro guides you can confirm your check-in and check-out and rate your stay from 1 to 5 stars. We store the time of each, your rating, and whether you tapped the button to leave a public review. That review is written on the booking site, not here, and is then covered by that site’s own policy.

If you rate 1 to 3 stars, you can also tell the host privately what could have been better. That’s optional. If you do, we store what you wrote and send it, with the property and host names and your rating, to Google’s Gemini, which writes a short summary for the host and a short reply that we show you straight away. Your name isn’t sent with it, but anything you write is. The host then gets an email with your feedback, the summary and the reply, along with your name and how you booked, and can see your rating and feedback in their dashboard.

If you sign up for a host’s yearly email (Pro guides only)

Some hosts offer a box on the check-in screen to hear from them about once a year. If you tick it, we ask for your email address and, if you choose, your first name. We then email you a link to confirm it’s you, and nothing else is sent until you click it. We record when you signed up, which wording of the permission you agreed to, when you confirmed, and whether you later unsubscribe, an email to you bounces, or you report one as spam. We send the email on the host’s behalf, at most one a year per host, and every email has a one-click unsubscribe link.

If you send photos from your stay (Pro guides only)

After you rate your stay, some guides invite you to send up to three photos. You make two choices separately: whether the host can have your photos, and whether they can also go in the guide’s year-end montage. You can add a first name to show with your photo, if you like. We store the photo, that first name if you gave one, your two choices, the date, and which wording of those choices you agreed to. We don’t ask for your name or email to send a photo. Instead, your browser keeps a random code, and we keep only a scrambled copy of it, so that you, on that same browser, can take a photo back.

Your photos are private to you, us and the host. The host reviews them once a year, in December. A photo only goes in the montage if the host approves it and you ticked the montage box. The montage is a web page that anyone with its link can open; we ask search engines not to list it. Photos with children in them should only be sent by a parent or guardian.

• To generate and display your guidebook, and to show guests the right content at the right time
• To auto-suggest nearby restaurants, cafés, and attractions near a host’s property
• To auto-fill parts of the guide from a host-supplied Airbnb link, and to generate or translate guide copy
• To email hosts their guide link, tell them when a guest checks in, and let them sign in to manage their guides
• To understand, in aggregate, how people use our site and product, so we can improve it
• To measure and improve our ads on Facebook and Instagram, using page visits to our homepage and guidebook builder
• To send the confirmation and yearly emails that guests asked for, and to keep a record of who has unsubscribed, bounced or reported an email, so we never email them again
• To collect ratings, and optional feedback, on Pro guides, to pass that feedback to the host, and to use Gemini to write a short summary of it and a reply to the guest
• To collect guest photos for the host to review, and, with the guest’s permission and the host’s approval, to show them in a year-end montage
• To limit abuse of our forms, using short-lived counters and a check that you’re not a bot

We do not sell personal data. Nothing a host writes into a guidebook, and nothing a guest enters or views on a guidebook, is shared with Meta or used for advertising — guidebook pages don’t run the Meta Pixel.

We use a small number of service providers (“processors”) to run Higherstay. None of them are permitted to use your data for their own purposes.

• Vercel — hosts the application and provides cookieless analytics and performance monitoring
• Supabase — our database, where guidebook, host, and guest data is kept, and file storage for cover photos that hosts upload
• Cloudflare — stores and serves the photos from the Photo Walkthrough and the photos guests send (we ask for storage in Western Europe where possible, which is a preference rather than a guarantee). Cloudflare also runs Turnstile, the check on the yearly-email form that tells people from bots, which looks at your browser and IP address to do so
• Upstash — keeps short-lived counters that limit how often a form or button can be used. A counter can include your IP address, or an email address you typed, and expires within an hour
• Google — Places/Maps APIs for address lookup, local recommendations, and place photos; Google’s Generative AI (Gemini) for drafting and translating guide content, and for writing a short summary and reply when a guest chooses to send feedback
• Airbnb — only if a host supplies an Airbnb listing URL, we fetch that public page’s content
• Resend — sends our emails to hosts (your guide link, guest check-ins, sign-in links, and the yearly photo-review email) and, for Pro guides, the confirmation and yearly emails to guests who asked for them. Resend also tells us when an email bounced or was reported as spam

Separately, Meta (Facebook and Instagram) receives page-visit data from the Meta Pixel on our homepage and guidebook builder, if you agree to it. Unlike the providers above, Meta also uses that data for its own purposes under Meta’s Privacy Policy.

If you’ve agreed to the Meta cookie and then buy Higherstay Pro, we also tell Meta about the purchase directly from our server: the amount, a scrambled (hashed) copy of the email address you paid with, and the browser details the Pixel would see (the Meta cookie, your browser type and IP address). This lets Meta count the sale even if an ad blocker stops the Pixel. If you haven’t agreed, we send Meta nothing about your purchase.

If a host buys Higherstay Pro, the purchase is made through Onelink(Stripe), which sells it to you as merchant of record. Onelink collects your payment details and billing information itself, under Onelink’s Privacy Policy. We never see or store your card details; we receive confirmation that you’ve paid, and the email address used at checkout.

We may also disclose data if required by law, or to protect the rights, safety, or property of Higherstay, our users, or the public.

If you sign in to manage your guides, we set a cookie that keeps you logged in. It’s essential to the dashboard and isn’t used for anything else.

Our own analytics (Vercel Web Analytics and Speed Insights) are cookieless by design — they identify visits using a rotating, anonymised hash and don’t track you across other sites.

If you agree to it, the homepage and the guidebook builder (higherstay.app/create) use the Meta Pixel, a small script from Meta that sets a cookie (_fbp) and sends Meta a record of the page you visited, along with standard browser information. If you’re logged in to Facebook or Instagram, Meta may link that visit to your account. We use it to measure how our ads perform. We ask first, and nothing from Meta loads until you say yes. No other Higherstay page — including every guest guidebook — runs the Pixel or sets this cookie. You can also manage how Meta uses it in your Meta ad preferences.

We remember your answer in your browser’s local storage. higherstay.com and higherstay.app are separate sites to your browser, so each asks once.

We do use your browser’s own local storage (not a cookie) to remember your guest details and language preference on a guide you’ve already visited, purely so you don’t have to re-enter them. This stays on your device and isn’t something we can access remotely.

If you send photos from a guide, your browser also keeps the random code that lets you take a photo back (see “If you send photos from your stay” above). It’s not your name or email.

• Guidebooks, host details, guest check-ins, and any rating or feedback attached to them— for as long as the guidebook exists. That includes the summary and reply Gemini wrote about feedback. We don’t currently offer a self-service way to delete a guidebook or guest record; email us at hello@higherstay.comand we’ll delete it manually on request.
• Photo Walkthrough photos — for as long as the guidebook exists. A photo a host replaces is deleted straight away.
• Yearly-email sign-ups you never confirm — deleted after 14 days (the confirmation link itself stops working after 7 days).
• Confirmed sign-ups — until you unsubscribe or the guidebook is deleted. After you unsubscribe we keep the address, marked as unsubscribed, so that we keep honouring it. An address that bounces, or is reported as spam, goes on a do-not-email list that we keep so it is never emailed again. Email us if you want any of these erased.
• Guest photos waiting for review — until the host reviews them, which they do once a year. If they never do, we delete them automatically after 400 days.
• Approved guest photos — 3 years after they were sent, then deleted (so they also disappear from any montage that shows them).
• Rejected or withdrawn guest photos — the photo is deleted straight away. We keep a short record of the decision, and the permission that was given, for 90 days, then delete that too.
• Records of which yearly emails were sent to which address — 2 years.
• Yearly usage counters — a count of how many photos, uploads or emails a guide has used in a year, which we use to enforce limits. They hold no names or email addresses, though some are keyed to a scrambled guest code. We keep them for 2 calendar years, counting the current one, then delete them.
• Counters that limit abuse of our forms — they expire within an hour.

We run the automatic deletions above every week.

Depending on where you live, you may have the right to:

• Ask what personal data we hold about you, and get a copy of it
• Ask us to correct inaccurate data
• Ask us to delete your data. You can also unsubscribe from a yearly email in one click, from the link in any email, and take back a photo you sent from the same browser you sent it from
• Object to, or ask us to restrict, certain processing
• Complain to your local data protection authority (in the UK, the ICO)

To exercise any of these, contact us at hello@higherstay.com.

Higherstay isn’t directed at children, and we don’t knowingly collect data from anyone under 16. If you believe a child has given us personal data, please contact us and we’ll remove it. When a guide invites guests to send photos, it asks that a photo with children in it is only sent by a parent or guardian.

Our service providers (including Cloudflare and Upstash, alongside those above) may process data outside your own country, including in the United States. Where this happens, they do so under their own published data protection commitments and standard contractual safeguards.

We may update this policy as Higherstay changes. We’ll update the “last updated” date above when we do. Significant changes will be flagged more prominently if the change materially affects how we handle your data.

Questions, requests, or concerns about this policy or your data: hello@higherstay.com.