Privacy policy

Last updated October 31, 2026

Longstays (“Longstays”, “we”, “us”) provides an AI leasing assistant for operators of furnished rentals at longstays.ai and the app hosted there (together, the “Service”). This policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to operators who create an account, to visitors of our website, and to guests whose inquiries operators handle through the Service.

Two roles: operators and guests

Operators are the property managers and hosts who sign up for Longstays. For operator account information we decide how data is used and are the “controller” of it.

Guests are the people who inquire about an operator’s apartment. Guest information reaches us because an operator entered it or connected a system that holds it. For guest information the operator decides how it is used and we act on the operator’s instructions as their “processor” or “service provider”. If you are a guest with a question about your information, contact the operator you inquired with. We will help them respond.

Information we collect

From operators:

• Account details: email address and a password, which we store only as a hash.
• Unit details you enter or import: names, addresses, size, pricing, minimum stay, descriptions and house rules.
• Settings you choose for the assistant, such as reply tone and whether replies need your approval before sending.
• Connection credentials for property management systems you link, such as an API token. These are encrypted at rest and used only to read listings and messages and to send replies on your behalf.
• Billing details when paid plans launch. Card numbers are collected and stored by our payment provider, not by us.
• Messages you send us for support.

About guests, on behalf of operators:

• Name, email address and phone number when provided.
• The content of inquiries and the conversation that follows, including requested dates, number of guests and budget.
• Notes the operator writes about the inquiry.

Automatically:

• Server logs with IP address, browser type, pages requested and timestamps, kept for security and troubleshooting.
• Cookies strictly needed to keep you logged in. We do not use advertising cookies or third-party trackers on the Service.

How we use information

• To run the Service: create your account, show your units and leads, and keep you logged in.
• To draft and, where you have enabled it, send replies to guest inquiries using your unit details and settings.
• To score and organise inquiries so you can see which ones to act on first.
• To send service emails such as password resets, approval requests and activity summaries.
• To bill you for paid plans once they launch.
• To answer support requests and to keep the Service secure and reliable.

If you join our early-access list or create an account, we may email you about Longstaysitself, such as new features and pricing. Every such email includes an unsubscribe link, and opting out does not affect service emails you need to use your account.

We do not sell personal information and we do not share it with third parties for their own advertising. Because we do not sell or share information in that sense, there is nothing to opt out of, and we treat browser opt-out signals such as Global Privacy Control accordingly.

How the AI assistant handles information

To draft replies, the Service sends the relevant guest conversation and the operator’s unit details to an AI model provider through its API. We use Anthropic. Under its API terms, Anthropic does not use content sent through the API to train its models. The assistant drafts replies from the operator’s own information and never sends a guest anything an operator has not made available for that purpose.

The assistant does learn from each operator, but not by training a model. When an operator edits a drafted reply before sending it, or writes a rule in Settings, the Service stores that as a short plain-language rule in the operator’s own account, where they can read, edit or delete it. Those rules are read when drafting that operator’s later replies and are never used for anyone else’s.

Guest conversations may be handled in whole or in part by this automated assistant on the operator’s behalf. The assistant identifies itself as an assistant when a guest asks, and operators can hand any conversation to a person at any time.

Guest information belongs to the operator. We use it only to provide the Service to that operator and never to train models, to build products for anyone else, or for our own marketing. Operators remain responsible for the replies sent from their account, including any they allow the assistant to send automatically.

Who we share information with

We share information only with service providers that help us run the Service, under contracts that limit what they can do with it:

• Supabase, which hosts our database and authentication, in the United States.
• Vercel, which hosts the website and application.
• Anthropic, which provides the AI model used to draft replies.
• Property management systems you connect, such as Hospitable, which receive the replies the assistant sends on your behalf.
• Stripe, which will process payments when paid plans launch.
• Email delivery providers used to send service emails.

Property management systems and other services you connect handle information under their own privacy policies, which we do not control. We will keep this list current as providers change and will email operators before adding a provider that handles guest information.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to the transferred information.

How long we keep information

Operator account data is kept while the account is active. If you close your account, we delete it and the units, leads and conversations in it within 30 days, except where we must keep records for legal, tax or security reasons. Operators can delete individual units and leads at any time from the app. Server logs are kept for up to 90 days.

Security

Data is encrypted in transit and at rest. Access to each operator’s data is enforced in the database itself, so one operator cannot read another’s records. Connection credentials are encrypted and never exposed to the browser. No system is perfectly secure, so we cannot promise that unauthorised access will never occur, but we will tell affected operators promptly if it does.

Your choices and rights

• Operators can view and edit their account, units and leads in the app at any time.
• Operators can disconnect a property management system, which removes the stored credentials, and can close their account by contacting us.
• You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, or object to how we use it. Email us at the address below and we will respond within 30 days. We will not treat you differently for exercising these rights.
• Guests should direct requests to the operator they inquired with, since the operator controls that information. We will support the operator in responding.
• Residents of California, Virginia, Colorado, Connecticut, Utah and other states with privacy laws, and residents of the European Economic Area and the United Kingdom, may have additional rights under those laws. Contact us and we will honour them where they apply.

International visitors

We are based in the United States and process information there. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the date at the top. If a change materially affects how we use information, we will also email operators before it takes effect.

Contact

Questions or requests about privacy: hello@longstays.ai. The Service is operated by Longstays LLC, Miami Beach, Florida, United States.