Privacy Policy

CityStays ("we", "us", "our") operates a digital platform for workforce accommodation management, guest portals, booking systems, AI concierge services, and messaging integrations. We are committed to protecting the privacy and security of all personal data we process.

This Privacy Policy applies to all users of our platform, including property managers, administrators, guests, tenants, and corporate clients. It explains what information we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable Irish and EU data protection law.

Personal Data

• Full name
• Email address
• Phone number (including WhatsApp-capable numbers)

Booking & Property Data

• Booking details (dates, property assignments, guest counts)
• Property information and access credentials
• Payment and invoicing references

Communications

• In-app chat messages
• WhatsApp messages sent and received via the platform
• SMS messages
• Voice transcripts from AI concierge interactions

Technical Data

• IP address
• Device type and browser information
• Usage analytics and interaction data

We use the information we collect to:

• Provide and operate our accommodation management platform
• Manage bookings, guest access, and property assignments
• Power AI concierge responses and automated support
• Deliver customer support and resolve issues
• Send booking confirmations, portal credentials, and operational notifications
• Improve platform performance, features, and user experience
• Ensure security, prevent fraud, and detect misuse
• Comply with legal and regulatory obligations

We process personal data under the following legal bases:

• Contractual necessity: Processing required to fulfil our service agreements, manage bookings, and provide platform access.
• Legitimate interests: Improving our services, ensuring platform security, and conducting internal analytics.
• Legal obligation: Compliance with Irish and EU law, including tax, accounting, and regulatory requirements.
• Consent: Where applicable, such as for marketing communications or optional data sharing. You may withdraw consent at any time.

We may share personal data with the following categories of third-party service providers, strictly as necessary to operate our platform:

• Messaging providers: WhatsApp / Meta and SMS providers for guest communications
• AI providers: For powering concierge and automated support features
• Cloud infrastructure & hosting: For secure data storage and platform operation
• Payment processors: For invoicing and payment handling
• Automation tools: For workflow automation and operational integrations

All third-party processors are required to comply with GDPR and are bound by data processing agreements. We do not sell personal data to any third party.

Your data is stored on secure cloud infrastructure with industry-standard encryption at rest and in transit. We implement strict access controls, regular security reviews, and data minimisation principles to ensure only authorised personnel can access personal data.

While we take all reasonable measures to protect your data, no system is completely secure. We encourage users to keep their login credentials confidential and report any suspected security issues immediately.

We use cookies and similar technologies for essential platform functionality and analytics. These help us understand how users interact with the platform and improve performance.

We do not use invasive tracking technologies or share tracking data with third-party advertisers. You can control cookie preferences through your browser settings. Disabling cookies may affect some platform features.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to restriction: Request that we limit how we process your data.
• Right to data portability: Receive your data in a structured, commonly used format.
• Right to object: Object to processing based on legitimate interests or for direct marketing.

To exercise any of these rights, please contact us at support@citystays.io. We will respond within 30 days as required by law.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including providing our services, complying with legal obligations, resolving disputes, and enforcing agreements.

Booking and financial records may be retained for up to seven years to comply with Irish tax and accounting regulations. Communication logs are retained for the duration of the relevant booking period plus a reasonable period thereafter for support and audit purposes.

Your data may be processed by third-party service providers located outside Ireland or the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data to the standard required by GDPR.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated through the platform or via email. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a complaint about how we handle your data, please contact us:

Email: support@citystays.io

You also have the right to lodge a complaint with the Data Protection Commission (DPC) of Ireland at www.dataprotection.ie.