Privacy Policy
Draft for legal review. Text in [brackets] must be completed before publication.
1. Who we are
Flare Portal is provided by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], company number [NUMBER] (“we”, “us”). Contact for privacy questions: support@getflare.net.
This policy explains what personal data we handle when you use Flare Portal, a security monitoring service for short-term rental businesses. Our guiding principle is to keep fingerprints, not your data.
2. Our two roles
- Controller for the data about people who use the portal: account holders and invited team members (section 3).
- Processor for data we touch on your behalf when we check your PMS account or website. That processing is governed by our Data Processing Agreement, and your business is the controller.
3. Data about portal users (we are controller)
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Email address, company name, language | Your account, sign-in, service emails | Contract | Until your account is deleted |
| Password (stored only as a one-way hash) | Sign-in | Contract | Until your account is deleted |
| Two-step verification secret (encrypted) and hashed recovery codes | Protecting your account | Contract; legitimate interest in security | Until your account is deleted |
| Alerts on your devices, if you turn them on: the push address and keys your browser gives us (encrypted), a device label such as “iPhone · Safari”, and when the last alert was delivered. No phone numbers. | Sending alerts you asked for to your phone or laptop | Contract (a feature you turn on) | Until you turn it off or remove the device, or the browser cancels it |
| Team actions on findings (who marked “I’m on it”, “called the owner” and similar, and when) | Helping your team coordinate during an incident | Legitimate interest | 30 days |
| Activity log (who changed what in the portal) | Accountability for your team; security | Legitimate interest | 12 months |
| AI assistant connections: access keys and sign-in tokens (stored only as one-way hashes), the app's self-declared name, which company it can read, expiry and last use; the IP address that registered an app | Letting your own AI assistant read your security status | Contract | Until revoked or expired |
| Pilot applications (early-access list): email address, language, and optionally your property management system and number of properties | Choosing pilot customers and telling you when Flare opens | Consent (you can ask to be removed any time) | Until we open, then deleted unless you sign up |
| Which versions of our Terms, Privacy Policy and Data Processing Agreement you accepted, for which company, and when (no IP address) | Proof of what was agreed | Contract; legitimate interest in being able to show it | Until your account is deleted |
| IP address | Rate limiting and abuse prevention | Legitimate interest in security | Up to 2 days |
| Billing details (handled by Paddle, our reseller and Merchant of Record) | Payment and invoices | Contract; legal obligation for tax records | As required by tax law |
Accounts whose email address is never confirmed are deleted after 7 days. Accounts nobody has signed in to for 12 months, and that have no active paid plan, are deleted automatically with all their data. You can delete your account yourself at any time in Your account: we then erase your account, your email address, the workspaces where you're the only member, and your customer record at Stripe (invoices are kept as tax law requires), and confirm by email. The portal uses no tracking or advertising cookies: it sets one strictly necessary session cookie and stores your chosen workspace in your browser. On our website (getflare.net) we use Google Analytics, to see which pages help visitors, only if you accept it in the cookie banner (legal basis: consent). Until you do, nothing is loaded from Google. You can change your choice at any time through Cookie settings at the bottom of the page; withdrawing removes the analytics cookies. Analytics data is kept for [14 months, to confirm in Google Analytics settings]. The early-access form is protected against bots by Cloudflare Turnstile.
4. Data from your PMS and website (we are processor)
When you connect Guesty, we read configuration such as users, their permissions and email addresses (in memory only, to spot people you marked as having left), webhooks, channel status, payout settings, owners' email and phone, listing descriptions and access details (such as door codes, wifi and check-in instructions), refund amounts on recent reservations, and message templates, and the guest messages exchanged since our last check. Messages are read in memory only, to spot guests reporting suspicious payment requests (including messages from someone posing as you on WhatsApp or similar apps), payment requests sent from your account, and instructions aimed at AI assistants; their text is never stored. Listing texts, owner contact details and refund amounts are likewise only read in memory and turned into fingerprints. Door codes and wifi passwords from your listings and bookings are also read in memory only, to spot codes that are shared, easy to guess, visible before booking or never changed; they are never stored. If an owner turns on real-time checks, your PMS also notifies us when a new guest message arrives (and, for Guesty, when a listing changes). We use the notification only as a signal to run the usual check straight away: we don't store its content, only the time of the last notification. We keep only:
- Your PMS API key, in daily monitoring mode only, encrypted with a key unique to your company. In live-check-only mode the key is used in memory for that one check and discarded.
- Fingerprints: one-way codes (keyed hashes) that tell us something changed, never what it says. A fingerprint is updated only when the item changes, and deleted when the item disappears or you disconnect.
- Change timeline: which kind of item changed (a user, webhook, payout setting, owner, listing, refund or message template) that a guest message was flagged, or that the share of your system's API allowance in use jumped, whether it was added, changed or removed, coarse flags such as “became an admin”, “access details changed” or “large refund”, and when. Items are identified only by one-way codes. Kept for 90 days. It lets us spot patterns such as a new admin followed by a payout change.
- People who left: when you start a "Someone left" checklist, a masked version of the person's email (for example ma•••@example.com), a fingerprint of it to compare with your PMS team, and which checklist items were ticked and when. Kept until you delete it, or 12 months after it's closed.
- Links in messages: to judge whether a link in an incoming message leads to a fake site, we look at the website's name in memory and may ask the public domain registry when that website was registered. Only the website's name is sent, never the message, the sender or your business.
- Finding summaries: which check fired, how serious it is and how many items. Kept for 12 months after the finding is fixed.
- Connected apps: which apps receive your data through webhooks, as the app's name or, for apps we don't recognise, the domain it sends to (never the full address), plus apps you tell us you use, when we first saw them and who confirmed them. Kept until you delete the workspace. We use this list to tell you about new apps and about security incidents at apps you use; across customers we only count how many use each app, never who.
We never keep guest names or contact details, messages, reservations, prices, refunds or payouts, bank details, owner contact details, listing texts or door codes, or your team's names or emails from the PMS, and we never keep raw API responses. We only read; we never change anything in your PMS. Users and owner payout settings are checked every 5 minutes, webhooks and new guest messages every 30 minutes, more closely for a few hours after any change, and everything else nightly, all within a request budget that leaves most of your API quota to your other tools.
For websites you have verified through DNS, we look only at what any visitor's browser can see. If we spot an exposed secret key, we store and show it only in masked form.
5. Who we share data with
We don't sell personal data. These service providers handle personal data for us, under their data processing terms:
| Provider | What for | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, background jobs, DNS lookups, forwarding email sent to our addresses | Global network; Cloudflare, Inc. in the USA (Data Privacy Framework) |
| Resend, Inc. | Sending email (sign-in codes, invites, alerts, reports) | Sent from the EU (Ireland); Resend, Inc. in the USA (Data Privacy Framework) |
| Google Ireland Ltd (Google Analytics) | Website visit statistics, only if you accept analytics cookies | Google Ireland Ltd; may transfer to Google LLC in the USA (Data Privacy Framework) |
| Paddle | Sells the subscription as Merchant of Record: payments, tax and invoices (an independent controller under its own privacy policy (paddle.com/legal)) | Paddle.com Market Limited, UK; may transfer to its affiliates, including in the USA, under its data transfer terms |
| Your browser's push service (Apple, Google, Mozilla or Microsoft, depending on your device) | Delivering alerts to devices where you turned them on. The alert is encrypted so that only your device can read it. | Depends on your device's provider |
If you connect Slack, we send alerts to the Slack workspace you choose; that's your own tool, under your agreement with Slack.
Where data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.
6. Security
We protect data with encryption in transit and at rest, a separate encryption key per company, mandatory two-step verification for every user, role-based access, an audit log, and monitoring that warns us of unusual use of stored PMS keys. No system is perfectly secure, but if a breach affects your personal data, we'll tell you without undue delay.
7. Your rights
You can access, correct, export or delete your data, object to or restrict processing, and withdraw consent. Most of this you can do yourself in Your data & privacy and Your account. Otherwise, email support@getflare.net and we'll reply within one month. You can also complain to your data protection authority; in Portugal this is the CNPD (cnpd.pt).
8. Changes
If we change this policy in a material way, we'll email account owners at least 30 days before the change takes effect.