Back to homepage

Privacy Policy

Last updated: March 2026

1. Who we are

innbu is operated by innbu Ltd, a company registered in the United Kingdom. We provide an AI-powered property management platform for short-term rental hosts. When we say “innbu”, “we”, “us”, or “our” in this policy, we are referring to innbu Ltd.

2. Data we collect

We collect the following categories of personal data:

Account information

  • Name, email address, and password (via our authentication provider, Clerk)
  • Billing information and payment details (processed by Stripe)
  • Business information such as company name and property details

Guest data (processed on your behalf)

  • Guest names, contact details, and booking information received from OTA platforms (Airbnb, Booking.com, VRBO, etc.)
  • Guest messages and communication history
  • Check-in/check-out details and special requests

Usage data

  • Log data such as IP address, browser type, and pages visited
  • Feature usage and interaction patterns within the platform
  • AI agent performance metrics (response times, confidence scores)

3. How we use your data

  • To provide and maintain our AI-powered property management services
  • To process guest messages using AI agents on your behalf, including generating, reviewing, and sending responses to guests
  • To coordinate operational tasks such as cleaning schedules, pricing adjustments, and compliance checks
  • To process payments and manage your subscription
  • To send service-related communications (onboarding, feature updates, critical alerts)
  • To improve our AI models and platform features using aggregated, anonymised data
  • To detect and prevent fraud, abuse, and security incidents

4. AI processing of guest messages

Our platform uses AI agents to process guest messages on your behalf. When a guest sends a message through any connected channel (Airbnb, WhatsApp, email, SMS, etc.), our AI analyses the message content and may generate a response. Depending on your autonomy settings, responses may be sent automatically or queued for your review. All AI processing is performed within your isolated tenant environment, and guest data from one host is never accessible to another.

5. Legal basis for processing (GDPR)

We process personal data under the following legal bases:

  • Contract performance: Processing necessary to provide our services to you as a subscriber.
  • Legitimate interest: Platform improvement, security, and fraud prevention.
  • Consent: Marketing communications (you can withdraw consent at any time).
  • Legal obligation: Where required by law (e.g., tax records, regulatory compliance).

As a host, you act as a data controller for guest personal data. innbu acts as a data processor, processing guest data on your behalf and according to your instructions.

6. Data sharing

We share personal data only with the following categories of recipients:

  • Infrastructure providers: Cloud hosting (Railway, Vercel), database (Supabase), caching (Upstash).
  • AI model providers: Anthropic (for AI agent processing). Message content is sent to generate responses but is not used to train third-party models.
  • Payment processors: Stripe for subscription billing.
  • Authentication: Clerk for secure login and identity management.
  • Communication providers: Twilio (WhatsApp/SMS), SendGrid/Nylas (email) for message delivery.
  • Channel managers: To sync bookings and communicate with OTA platforms on your behalf.

We do not sell personal data to third parties. We do not share data for advertising purposes.

7. Data storage and security

Your data is stored on servers located in the European Economic Area and/or the United Kingdom. We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS) and at rest, tenant-level database isolation with row-level security, and regular security reviews. Each subscriber’s data is logically isolated and inaccessible to other subscribers.

8. Data retention

  • Account data: Retained for the duration of your subscription and up to 30 days after account deletion.
  • Guest data: Retained for as long as your account is active. You can delete individual guest records at any time.
  • Billing records: Retained for 7 years to comply with UK tax legislation.
  • AI conversation logs: Retained for 90 days for quality assurance, then automatically purged.
  • Usage analytics: Aggregated and anonymised data may be retained indefinitely.

9. Cookies

We use cookies and similar technologies to operate our platform. For full details, please see our Cookie Policy.

10. Your rights (GDPR)

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data (“right to be forgotten”).
  • Restriction: Request that we limit processing of your data.
  • Portability: Request your data in a structured, machine-readable format.
  • Objection: Object to processing based on legitimate interest.
  • Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at privacy@innbu.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

11. International transfers

Some of our service providers may process data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner, or the service provider being certified under an adequacy decision.

12. Children

Our services are designed for business use by property management professionals. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately.

13. Changes to this policy

We may update this privacy policy from time to time. We will notify you of material changes by email or through a notice on our platform. Continued use of our services after changes take effect constitutes acceptance of the updated policy.

14. Contact us

If you have questions about this privacy policy or our data practices, please contact us: