How we use your information.

1. Who is responsible

Short Stay Control is run by Floodlight New Marketing Ltd, registered in England and Wales under company number 08613994, with its registered office at 116 Station Road, Chinnor, England, OX39 4QG.

For the website, the demo, your account and billing, we decide how your information is used, so we are the controller. For the property, booking and guest information your business brings into its workspace, your business is the controller and we process it only on your instructions, as set out in our Data Processing Agreement. Guests who want to use their rights should contact the business they stayed with.

Contact us about privacy at privacy@shortstaycontrol.com.

2. What we collect

• Account details: your name, business name, email address, optional telephone number and your role in the workspace.
• Billing details: your plan, number of properties, invoices and payment history. Card details are entered on our payment provider's own page and never reach us.
• Workspace information your business connects or uploads: properties, bookings, payouts, costs, receipts and documents, and any guest names or contact details included in them.
• Support and assistant messages: what you send us, and the questions you ask the AI assistant. From 16 November 2026, support requests and replies, and the details of businesses we email, are also held in HubSpot for the same 24 months.
• Help assistant (from 16 November 2026): when you ask the help assistant on the Get help page, your question is sent to an AI (artificial intelligence) model service so it can answer from our help guides. Keys, card numbers and passwords are stopped before anything is sent, and email addresses and phone numbers are removed. We do not keep the conversation unless you choose Pass this to a person; then it is saved with your support request and kept for 24 months after that request was last updated. We keep a count of questions, with no text, for 13 months to control cost.
• Guest messages (an optional feature, currently switched off): Short Stay Control can read recent guest messages from your booking system to help your team deal with guest issues faster, for example a fault reported during a stay. While it is off, no guest messages are read or stored. If it is switched on, we read only the 20 most recent conversations at each refresh, remove email addresses, phone numbers and card numbers before storing them, and use the text only to spot and resolve guest issues. We never use it for marketing or to contact guests. Your business is the controller of this information, and we process it on your behalf in line with UK GDPR (General Data Protection Regulation).
• Website and demo activity: enquiry form details, pages and demo steps visited, and active time. We do not record keystrokes or mouse movements.
• Security records: sign-in times, IP addresses and an audit trail of changes, used to protect accounts and investigate misuse.
• If you accept advertising cookies, our advertising partners receive information such as your browser identifiers, network address and visits to approved public marketing pages. We do not send workspace records or signed demo access links through these advertising tools.

3. Why we use it, and our lawful basis

We do not make decisions about you by automated means that have legal or similarly significant effects.

• To provide the service you signed up for, including billing: performance of our contract with your business.
• To answer enquiries and run the demo you asked for: steps taken at your request before a contract.
• To keep the service secure, prevent misuse and improve the product: our legitimate interests, balanced against your rights.
• To keep invoices and tax records: our legal obligation.
• We send product news and offers to customers, and to anyone who asked for them, with their consent. We also email businesses we think we can help, which the law allows as a "legitimate interest" (see "Businesses we email" below).
• To measure advertising and show relevant ads on other websites: your consent. You can withdraw it in Cookie settings without affecting your use of the service.
• To count visits and page views on our website (Google Analytics, page views only, without Google signals or ad personalisation): your consent.
• To keep a limited record of cookie choices: our legitimate interest in demonstrating and respecting those choices.

4. Businesses we email

We email some UK short-let businesses that we think Short Stay Control could help. We only email limited companies and limited liability partnerships. We don't email sole traders or partnerships.

We keep the business name, its website, how many properties it shows, its business email address and its entry on the Companies House register. We find these on the business's own website and on the public Companies House register, and we don't collect anyone's details from social media.

The law calls this a "legitimate interest". We have written down why telling a business about our product is fair to it, and you can have a copy by emailing privacy@shortstaycontrol.com.

Our own team can see these details. So can our database, which runs on our own server, and our customer system, HubSpot, once we have emailed you.

If you don't reply, we delete your details 12 months after our last email. If you ask us to stop, we keep only your business name and email address on a "do not contact" list, so we can't email you again by mistake.

To stop our emails, reply "stop" to any of them or write to privacy@shortstaycontrol.com, and we'll stop straight away. You can also ask to see, correct or delete what we hold, and you can complain to the Information Commissioner's Office at ico.org.uk.

5. Who can see it

Our own systems and databases are hosted in the United Kingdom. We use service providers for hosting, email delivery and payment processing. Our accountants, Akusika Business Services Ltd, receive our invoices and payment records to prepare our accounts and tax returns. If you accept advertising cookies, we also share the advertising information described above with advertising and measurement partners. Depending on the service, those partners may act as processors, independent controllers or joint controllers. The enabled partners and links to their policies are listed on our cookies page. We never sell personal information.

When you use an AI feature, such as reading a receipt or asking the assistant a question, the relevant text or image is sent to an AI model service to produce the answer. AI features are optional and only run when you use them. Some suppliers, including AI model services and email delivery, process data outside the UK, including in the United States. Where that happens we use the safeguards UK data protection law requires, such as the UK Addendum to the standard contractual clauses.

Our own systems are hosted in the United Kingdom. The tools you can switch on in Cookie settings are run by companies based in the United States, so information they receive from your browser may be processed there. Google (Google Ads and Google Analytics), Microsoft (Microsoft Advertising) and LinkedIn (the LinkedIn Insight Tag) take part in the UK Extension to the EU-US Data Privacy Framework, which the UK government recognises as giving personal information a suitable level of protection when it is sent to certified US companies. Meta (the Meta Pixel) is covered by the UK Data Transfer Addendum in Meta's business tools terms. We check each safeguard before we switch a tool on. Contact privacy@shortstaycontrol.com for details or a copy of the relevant safeguards.

We may also share information where the law requires it, or to protect our rights and the safety of others.

6. How long we keep it

• Demo activity: deleted automatically after 90 days. If you open a demo we may send you up to three emails about it over the following nine days; each has an unsubscribe link, and they stop as soon as you start a trial or unsubscribe.
• Account and workspace information: kept while your subscription is active. After it ends, you have 30 days to export your data, then it is deleted. If you close your workspace during a free trial, it is deleted within 7 days and no export is provided.
• Invoices and payment records: held by our payment provider, Stripe, and our accountants, Akusika Business Services Ltd, for 6 years, because UK tax law requires it.
• Backups: overwritten within 14 days.
• Guest messages, when the feature is switched on: deleted automatically 6 months after they are received. The originals stay in your booking system.
• Cookie choices are remembered in your browser for 180 days. We keep a limited record of each choice for 12 months to demonstrate how consent was handled, then delete it. Advertising partners' own retention periods are explained in the policies linked from our cookies page.

7. Deleting your information

We delete your information when you ask us to, and when your account is deleted. Email privacy@shortstaycontrol.com to ask.

We retain invoices and payment records for the periods explained above. We may retain the limited cookie-choice evidence described above where necessary to demonstrate compliance. We assess deletion requests and explain any information we must retain and why. Backup copies are overwritten within 14 days.

8. Your rights

You can ask to see, correct, delete, restrict or move your information, object to how we use it, and withdraw consent at any time. Email privacy@shortstaycontrol.com. We reply within one month, and tell you if we need longer for a complex request.

9. Complaints

If you are unhappy with how we have handled your information, email privacy@shortstaycontrol.com. We acknowledge every complaint within 30 days and tell you what we have done about it.

You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

10. Cookies, age and changes

We use essential cookies to run the site. Where advertising tools are enabled, they load only after you accept Advertising cookies. You can reject them or withdraw consent in Cookie settings. Our cookies page lists the enabled tools, their providers, purposes and lifetimes.

Short Stay Control is a service for businesses and is not intended for anyone under 18.

If we change this notice in a way that matters, we will email account holders before the change takes effect.