Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: Name, email address, and password when you create an account, or email address and profile information when you authenticate via Google OAuth.
• Billing Information: Payment method details (credit card or other payment information) are collected and processed by our third-party payment processor, Stripe. We do not store your full payment card details on our servers. We receive and store your Stripe customer ID, subscription status, billing history, and transaction amounts.
• Property Information: Property names, addresses, time zones, and calendar feed URLs from vacation rental platforms (such as Airbnb and VRBO) that you provide.
• Cleaner Information: Names, email addresses, and phone numbers of cleaning staff you add to the platform. See Section 5 for details on how we handle cleaner data.
• Communication Preferences: Your notification channel settings (email, SMS, WhatsApp) and scheduling preferences.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken within the platform, and time spent on pages.
• Device and Browser Information: Browser type and version, operating system, screen resolution, device type, and language preferences.
• Network Information: IP address, approximate geographic location derived from IP address, and internet service provider.
• Analytics Data: We use Google Analytics 4 (GA4) to collect anonymized usage statistics, including page views, session duration, traffic sources, and user interactions. GA4 may use cookies and similar tracking technologies. See Section 4 for cookie details.
• Rate Limiting Data: IP addresses and request timestamps are temporarily processed through Upstash Redis to protect against abuse and enforce usage limits.
• Security Data: Cloudflare Turnstile processes browser signals and interaction data to distinguish legitimate users from bots during account registration. Cloudflare's CDN and security services process IP addresses and browser metadata.

1.3 Information from Third-Party Calendar Feeds

When you connect a vacation rental calendar, we receive and process booking data from those feeds, which may include booking dates, guest names or identifiers, check-in and check-out times, and booking status. This data originates from the rental platform and is processed as received. We do not independently verify its accuracy.

2. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To provide, operate, and maintain the GleamSync platform, including syncing your vacation rental calendars with cleaning schedules.
• Notifications: To send cleaning assignment notifications to you and your designated cleaners via email (SendGrid), SMS (Twilio), and WhatsApp (Twilio/Meta).
• Billing and Payments: To process subscription payments, manage your billing account, and send payment-related communications through Stripe.
• Account Communications: To send you service-related messages including account verification, password resets, service updates, and maintenance notices.
• Service Improvement: To analyze usage patterns and improve our platform's functionality, performance, and user experience.
• Security and Fraud Prevention: To protect against unauthorized access, abuse, and fraudulent activity through rate limiting, bot detection, and security monitoring.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or governmental requests.

We do not sell your personal information to third parties. We do not use your data for advertising purposes or share it with advertisers.

3. Third-Party Service Providers

We use the following third-party services to operate GleamSync. Each service receives only the data necessary to perform its function:

• Supabase (Database and Authentication) — Stores account data, property data, booking data, cleaning schedules, and notification logs. Handles email/password authentication.
• Stripe (Payment Processing) — Processes subscription payments and stores payment method details, billing addresses, and transaction history. Stripe's privacy policy governs their handling of your payment information.
• Twilio (SMS and WhatsApp Notifications) — Receives phone numbers and message content to deliver SMS and WhatsApp notifications to property owners and cleaners.
• SendGrid (Email Notifications) — Receives email addresses and message content to deliver email notifications, account verification emails, and service communications.
• Google (OAuth Authentication and Analytics) — Provides sign-in with Google functionality (receives email and profile information). Google Analytics 4 collects anonymized usage data.
• Vercel (Hosting and Deployment) — Hosts the GleamSync application. Processes server logs including IP addresses, request URLs, and response metadata.
• Cloudflare (Security and CDN) — Provides bot protection via Turnstile, DDoS mitigation, and content delivery. Processes IP addresses, browser data, and interaction signals.
• Upstash (Rate Limiting and Job Queuing) — Upstash Redis processes IP addresses for rate limiting. Upstash QStash manages asynchronous job queuing for calendar sync operations.

Each of these services maintains its own privacy policy governing their processing of data. We encourage you to review their respective policies.

4. Cookies and Tracking Technologies

GleamSync uses cookies and similar technologies for the following purposes:

• Essential Cookies: Required to maintain your authenticated session, remember your login state, and ensure security. These cannot be disabled without breaking core functionality.
• Analytics Cookies: Google Analytics 4 may set cookies to collect anonymized usage statistics. GA4 operates in a privacy-preserving mode and does not use this data for cross-site advertising.
• Security Tokens: Cloudflare Turnstile uses browser signals (not traditional tracking cookies) to verify human interaction during registration.

Do Not Track: Some browsers transmit a "Do Not Track" (DNT) signal. There is currently no industry standard for how websites should respond to DNT signals. GleamSync does not currently alter its data collection practices in response to DNT signals. We do not engage in cross-site tracking.

5. Cleaner Data — Special Provisions

Cleaners are individuals whose contact information is added to GleamSync by property owners. Cleaners are not direct customers of GleamSync, and their data is provided to us by the property owners who engage their services.

5.1 What Cleaner Data We Collect

Through property owners, we collect and process cleaner names, email addresses, phone numbers, notification channel preferences, and cleaning assignment history (which properties they clean and when).

5.2 How Cleaner Data Is Used

Cleaner data is used solely to deliver cleaning assignment notifications via the property owner's configured channels (email, SMS, and/or WhatsApp) and to display cleaning schedules within the platform.

5.3 Consent and Responsibility

Property owners are responsible for obtaining proper consent from their cleaners before adding their contact information to GleamSync, as outlined in our Terms of Use (Section 5). GleamSync relies on the property owner's representation that appropriate consent has been obtained.

5.4 Cleaner Rights

If you are a cleaner whose information has been added to GleamSync by a property owner, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data from our platform.
• Opt out of receiving notifications by contacting us at support@gleamsync.com or by asking the property owner to update your notification preferences.

To exercise these rights, contact us at support@gleamsync.com. We will process requests within 30 days.

6. Data Retention

We retain your data for the following periods:

• Account Data: Retained while your account is active. Upon account deletion or subscription cancellation, your data is retained for 90 days to allow for reactivation, after which it is permanently deleted.
• Cleaning and Booking History: Retained for 12 months from the date of the cleaning event for your reference and operational purposes.
• Communication and Notification Logs: Retained for 90 days for troubleshooting and delivery verification purposes.
• Billing Records: Transaction history and invoices are retained for 7 years as required for tax and accounting compliance.
• Rate Limiting and Security Logs: IP addresses and request data used for rate limiting are retained for no more than 24 hours. Security incident logs may be retained longer as needed for investigation.

After the applicable retention period, data is permanently deleted or anonymized so that it can no longer be associated with you.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Deletion: Request deletion of your account and associated personal data, subject to our retention obligations.
• Right to Data Portability: Request an export of your data in a commonly used, machine-readable format.
• Right to Opt Out: Opt out of non-essential communications at any time through your account settings or by contacting us.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time.

To exercise any of these rights, contact us at support@gleamsync.com. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

8. Data Security

We implement industry-standard security measures to protect your personal information, including:

• Encryption in transit via HTTPS/TLS for all data transmitted between your browser and our servers.
• Encryption at rest for sensitive data stored in our database.
• Row-level security (RLS) policies in our database to ensure multi-tenant data isolation — users can only access their own data.
• Server-side rate limiting to protect against brute-force and abuse attacks.
• Bot protection via Cloudflare Turnstile on registration and sensitive endpoints.
• Secure authentication with hashed passwords and OAuth 2.0 for Google sign-in.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. Data Breach Notification

In the event of a data breach that poses a real risk of significant harm to affected individuals, we will notify affected users as soon as feasible and in accordance with applicable laws, including PIPEDA's breach notification requirements and CCPA's disclosure obligations. Notification will be provided via the email address associated with your account and, where required, to applicable regulatory authorities.

10. International Data Transfers

GleamSync is operated by Fromson Consulting Inc. in British Columbia, Canada. Your data may be processed in the United States and Canada by our third-party service providers (including Supabase, Stripe, Twilio, SendGrid, Vercel, Google, Cloudflare, and Upstash). By using GleamSync, you consent to the transfer and processing of your data in these jurisdictions, which may have different data protection laws than your home jurisdiction.

11. Children's Privacy

GleamSync is a business-to-business service intended for use by adults who manage vacation rental properties. It is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from an individual under 18, we will take steps to delete that information promptly.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain legal exceptions.
• Right to Opt Out of Sale: We do not sell your personal information to third parties. We do not share your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights. You will receive equal service and pricing regardless of whether you exercise these rights.

To submit a request, contact us at support@gleamsync.com. We will verify your identity and respond within 45 days as required by law.

13. Canadian Privacy Rights (PIPEDA)

Fromson Consulting Inc. complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). We collect and process personal information based on meaningful consent and legitimate business purposes necessary to deliver the GleamSync service.

Under PIPEDA and PIPA, you have the right to:

• Access the personal information we hold about you.
• Challenge the accuracy and completeness of your personal information and have it amended as appropriate.
• Withdraw consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.

For privacy inquiries or complaints, contact our Privacy Officer at privacy@gleamsync.com. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada or the BC Office of the Information and Privacy Commissioner.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. For material changes, we will provide at least 30 days' advance notice via the email address associated with your account or through a prominent notice within the platform. Continued use of GleamSync after the effective date of a revised Privacy Policy constitutes your acceptance of the changes.

We encourage you to review this Privacy Policy periodically.

15. Contact Us

If you have questions about this Privacy Policy, contact us at:

Fromson Consulting Inc.

General Inquiries: support@gleamsync.com

Privacy Officer: privacy@gleamsync.com

Website: gleamsync.com