Privacy Policy for Stay Pilot

This Privacy Policy explains what information Stay Pilot, accessible at https://www.stay-pilot.com, collects, how we use it, and the choices you have. It covers two kinds of people: hosts, who create an account and build guidebooks, and guests, who open a host's guidebook link and do not need an account.

By using our website and services, you agree to this policy. Our Terms and Conditions also apply.

From hosts

• Account information. Your name and email address, from Google sign-in or from the address you use to get a sign-in link. If you sign in with Google, we also receive your Google profile picture.
• Guidebook content. Everything you add to a guidebook: the property name and address, check-in and Wi-Fi details, house rules, recommendations, photos, and any text you paste or answers you type to build it. If you start a guidebook before you sign in, we save what you typed in a temporary draft so it survives sign-in. Unused drafts are deleted automatically after 48 hours.
• Billing information. Payments are handled by Stripe. We do not store your card number. We keep your Stripe customer and subscription details, such as your plan, its status and your billing dates.
• Emails and messages. Records of the emails we send you, and anything you send us when you contact us.

From guests

• Chat and itinerary messages. When a guest uses AI chat or the itinerary builder, what they type is sent to our AI provider to produce an answer (see section 5). We do not keep a history of guest chats in our database.
• Email addresses. If a guest asks for an itinerary by email, or a host has turned on the email prompt in a guidebook and the guest enters an address, we store that address with the guidebook it came from.

From everyone

• Usage information. When you visit the website or open a guidebook, our analytics tools collect information such as the pages you view, the buttons you click, your browser and device, and your approximate location based on your IP address. We use Google Analytics, Google Tag Manager, Plausible Analytics and Vercel Analytics.
• Technical logs. Our servers and hosting provider log requests, such as the IP address, time and page requested, for security and reliability.
• Cookies. See section 6.

• To run the service: build guidebooks, show them to guests and answer guests' questions.
• To create and manage your account, and to process payments and subscriptions.
• To send you the emails described in section 4.
• To give you support when you contact us.
• To understand how the website is used, to improve it, and to measure how our own marketing is doing.
• To keep the service secure, prevent abuse and fraud, and meet our legal obligations.

• Service emails. We send these through Mailgun. They include sign-in links, a welcome email, reminders about your free preview, a note when you publish your first guidebook, subscription updates, and itineraries that guests ask us to email them.
• Product updates and tips. When you create an account, we add your name and email address to our mailing list with EmailOctopus so we can send these. Every one of these emails has an unsubscribe link, and you can also ask us to remove you at any time.

Guidebook text and guest chat messages are processed by our AI provider, currently OpenAI, to build guidebooks, power the itinerary builder and answer guest questions. For each request we send what is needed to answer it, such as the notes you pasted, the content of the guidebook, and the question a guest typed. OpenAI handles that data under its own terms and privacy policy.

Please do not put sensitive personal data, such as government ID numbers, financial account details or health information, into your notes, your guidebook or the chat.

Cookies are small files that your browser stores. We use these:

• Sign-in cookies keep you signed in.
• A draft cookie lets the browser that started a draft finish it after sign-in.
• Guidebook cookies remember a guidebook password you entered (for 2 days) and whether you answered or skipped an email prompt.
• Analytics cookies from Google Analytics and Google Tag Manager recognize your browser and help us measure usage.

You can block or delete cookies in your browser settings, but if you block the sign-in cookies you will not be able to sign in. Google also offers a browser add-on that opts you out of Google Analytics.

We do not sell your personal data. We share information with service providers that help us run Stay Pilot, only as needed to provide their service:

• Stripe, for payments and billing.
• OpenAI, for the AI features.
• Mailgun, for service emails, and EmailOctopus, for our mailing list.
• Google, for sign-in, analytics, Tag Manager, and the Maps and Places data behind place recommendations and photos.
• Vercel, for hosting and analytics, and Plausible, for analytics.
• MongoDB, for our database, and Cloudinary, for image storage.

These providers have their own privacy policies. We may also share information when the law requires it, to protect people's safety or our rights, or as part of a sale or merger of the business.

Remember that a published guidebook, or one in its free preview, can be opened by anyone who has its link. What a host puts in a guidebook is visible to anyone with that link.

• You can delete any guidebook at any time from your dashboard.
• To delete your account, email us at matt@stay-pilot.com. We will delete your account information and guidebooks, except for what we need to keep for legal, tax or fraud-prevention reasons, such as payment records.
• Guidebooks that are not published stay saved until you delete them or your account.
• Guest email addresses are kept with the guidebook they came from. A guest can ask us to remove their address by emailing us.

You can ask us to show you, correct or delete the personal information we hold about you by emailing matt@stay-pilot.com. You can unsubscribe from product updates with the link in any of those emails, and you can control cookies in your browser. Depending on where you live, you may have additional rights over your personal data. Contact us and we will respond to your request.

Our website is not intended for children, and we do not knowingly collect any personal information from children. If we become aware that we have collected personal information from a child without verification of parental consent, we take steps to remove that information from our servers.

The security of your data is important to us. We take reasonable steps to protect it, but remember that no method of transmission over the Internet or method of electronic storage is 100% secure.

This Privacy Policy is governed by the laws of the United States.

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "last updated" date at the top. If a change is significant, we will also email account holders.

If you have any questions about this Privacy Policy, please contact us at matt@stay-pilot.com.