What we hold, and for how long.

Your guide, your stays and your guest messages sit in an EU database. Six other companies see part of that. Messages are kept two years and agent logs one year, and both are settings you can lower. Everything below is how the running system behaves today.

The formal notice and the data processing agreement are drafted against exactly these facts and are still in review, so this page is not yet that document. Ask and we will send the current draft with the date it is signed off.

Where it is, and who else sees it

The database: Postgres, hosted by Supabase, running in an EU region. Your account records the region it was created in, so we can add a second region later without having to guess where your rows already are.
The application: Served by Vercel. No key that can act on behalf of the whole business is ever in the code your browser downloads. Those keys stay on the server.
The six sub-processors: Supabase for the database and files, Vercel for the application, Stripe for payments, OpenAI for drafting replies, Channex for carrying messages to and from the booking platforms, and Google for photos of nearby places. That is the entire list, and each one is covered by its own agreement.
Who we are to you: For your own account we are the data controller. For your guests we are a processor acting on your behalf, because they are your guests rather than our customers. That is why we keep exactly what a stay needs and nothing more.

What we do not hold at all

Card details: None, ever. Stripe takes the payment and holds the card. There is no field in our database a card number could sit in.
Identity documents: No passports, no ID scans, no photographs of documents. Fredo never asks a guest to prove who they are to us.
Contact details we were not given: A guest phone number or email address is in your account only if a booking platform sent it to us with the reservation.

How long it is kept

Guest messages: Two years by default. It is a setting on your account, not a written policy nobody implemented, and a scheduled job deletes anything past it.
The record of agent runs: One year by default, and also a setting. This is the log that explains why an agent said what it said, so it outlives the conversation but not indefinitely.
Deleting an account: Removes everything belonging to it, by foreign key, all the way down. No orphaned table is left holding somebody’s messages after the account that owned them is gone.

Getting it out, or getting it removed

Export: Your account’s own rows, as JSON, any day. The guide, the stays and the threads. It is a button, not a request you have to chase.
Erasure: Removes a guest’s identifying fields and their messages, leaving only the totals a business has to keep for its own accounts.
Every request is recorded: Who asked, for what, and what was done about it. Your account can read that record, and nobody can edit it, including us.

Signing in

Two ways, no password: A Google account, or a link sent to your email address. We store no password, so there is none to leak or reuse.
The session itself: Short-lived tokens, exchanged rather than passed in a URL where any script on the page could read them. Signing out clears them and removes your account’s data from the device.