Stays & Stripe App Privacy Notice

1. Who is responsible

OMNILION GROUP LTD, company number 17442958, registered office 41 Trowbridge, Stoke-on-Trent, ST2 0JJ, United Kingdom, is responsible for the information it uses to operate Stays and its Stripe app. Contact hello@omnilion.co.uk for privacy questions, rights requests or complaints.

Your accommodation provider is separately responsible for using reservation information to supply your stay and meet its own legal duties. Stripe has its own responsibilities when providing payment and account services, as explained in its Privacy Policy. Ask the named accommodation provider for its own privacy information.

The OMNILION Platform Privacy Notice additionally covers the business network and your platform account. Work and evidence functions have their separate privacy information. This Stays notice is separate from the cleaning website's contact-form notice.

2. Information we use and where it comes from

• Visitors and guests: your name and email address, selected property and room type, arrival and departure dates, number of rooms and guests, reservation reference and status, requests to change or cancel, and related correspondence. Email verification creates security and verification records. Private reservation links contain an access token and should not be shared publicly.
• Accommodation providers: the relevant platform user and business identifiers, ownership and permissions, property descriptions and photos, location, public contact details, room inventory, availability, prices, currency, payment requirements and booking terms, plus the agreed Operations recipient where applicable. Only information chosen for a published listing is displayed publicly. Photographs may contain metadata; remove information you do not intend to publish.
• Stripe connections: the connected Stripe account identifier, account display name, country and payment-readiness information; your app authorisation, its status and timing; and encrypted access and refresh tokens. Stripe supplies these after you authorise the app. The permissions requested are shown by Stripe before you accept.
• Booking payments: the saved price and terms, required full amount or deposit, total and remaining balance, currency, acceptance time, Checkout and payment references, payment status and relevant signed Stripe event information. These records come from your booking choices, the provider and Stripe. We receive payment status and transaction references; the Stays integration does not collect or store your full card number or card security code. Card and payment-method details are entered on Stripe's hosted payment page.
• Security and support: request and IP-related security information, rate-limit and access records, error and delivery records, and information you send when seeking help. Information comes directly from you, the provider, authorised platform members, Stripe and our infrastructure providers.

Do not enter passport details, entry codes, medical information or other unnecessary sensitive information into listing descriptions or support messages.

3. Why we use information

We use the information to publish the provider's chosen listing, verify enquiry email addresses, deliver enquiries to the provider, record and manage reservations and agreed terms, provide private reservation access, send service messages, connect the provider's Stripe account and verify the payment outcome. Where an agreed Operations route exists, we send the limited booking information needed to coordinate the stay.

Our lawful basis is performance of a contract, or steps requested before entering one, where you are the contracting individual. For business representatives and the coordination of a provider's reservation, we rely on legitimate interests in providing the requested accommodation platform and communications. We also rely on legitimate interests for proportionate security, fraud prevention, support, troubleshooting and defending claims, and legal obligations where a specific record or disclosure is required by law. We balance these interests against your rights.

Verification and booking emails are service messages, not a marketing subscription. Essential processing does not depend on blanket consent. If we ask for consent for another purpose, you can withdraw it without affecting earlier lawful use.

Verified payment can automatically confirm the reservation and trigger the agreed Operations delivery. It does not make a credit, employment or eligibility assessment about you. Contact us or the accommodation provider to request human review of an incorrect booking or payment status.

4. Who can see information

Published accommodation details and any public provider profile linked to them are visible to visitors. Guest names, email addresses, private access tokens and Stripe authorisation credentials are not published in the directory.

The authorised accommodation provider can access its enquiries and reservations, including guest contact details. An agreed Operations recipient receives the reservation reference, dates, unit details and status needed for the work. The automated Stays-to-Operations route does not send guest names or email addresses.

Authorised OMNILION personnel may access relevant records for service operation, security, support, rights requests and lawful claims. Cloudflare provides hosting, security, databases and file storage. Resend processes recipients, service-email contents and delivery metadata. Stripe processes payment and account-service data. We may disclose relevant information to professional advisers, regulators, courts or authorities where legally required or necessary for a lawful claim. We do not sell guest contact information or use private reservation data for advertising.

5. Stripe connection and accommodation payments

A provider chooses its own Stripe account and authorises the OMNILION Stays app on Stripe. The integration uses that authorisation to check the account, create and read the provider's accommodation Checkout sessions and verify relevant payment events. OMNILION does not need the provider's Stripe password. The integration does not initiate bank payouts, transfers or refunds.

Accommodation payments are created in the provider's connected Stripe account; OMNILION charges no booking commission. Stripe processing fees apply under the provider's Stripe arrangements. A required deposit confirms payment of that deposit, not payment of the whole stay. Any remaining balance and the provider's cancellation and refund terms remain separate.

You can remove the app's authorisation through Stripe or disconnect it through Stays where available. This stops new use of the connection but does not cancel a reservation, refund a payment or erase records already needed for the booking or a legal duty. Ask the accommodation provider about cancellations and refunds. OMNILION platform subscriptions are separate from accommodation payments.

6. International processing and safeguards

Our service providers and their subprocessors may process information outside the United Kingdom, including in the United States. We do not promise UK-only or EU-only processing. Applicable provider terms provide transfer safeguards such as recognised adequacy arrangements or standard contractual clauses with the UK Addendum where required. See Cloudflare's data-processing terms, Resend's data-processing terms and Stripe's privacy information. Contact us for information about the safeguards relevant to your data or how to obtain a copy.

7. Cookies, browser storage and security

Platform sign-in uses essential session and security cookies. Stays uses browser session storage and private links to maintain access to your reservation. Clearing that storage or using another browser can require your private email link again. Stripe's hosted pages use their own payment and security technologies under Stripe's policies. External booking links take you to the provider's own website, whose policies apply there.

We use access checks, restricted authorisation records, encrypted Stripe tokens and private guest links. No online service can guarantee absolute security. Tell us promptly about suspected unauthorised access and avoid forwarding your private reservation link.

8. How long we keep information

Retention depends on the record and purpose. We keep enquiry and reservation information while a stay, change, cancellation, balance, complaint or dispute needs handling. Afterwards we assess whether identifiable information is still needed for the provider's service, support, financial reconciliation, a legal obligation or a reasonably anticipated claim. Relevant transaction and dispute records may need to be kept for the applicable legal period; we do not keep every guest or security record for that full period automatically.

Provider listing and connection records are needed while active and afterwards only for an identified operational, security or legal purpose. Expired verification codes, session permissions and guest links cannot be used after expiry, but expiry does not itself erase the related database or delivery record. Revoked authorisations cannot be used to initiate new payments through Stays.

Deletion and retention reviews are operator-managed; we do not claim automatic deletion of all expired, disconnected or closed records. We assess a deletion request against ongoing bookings, shared records, other people's rights and documented legal needs, and explain any information retained. Recovery copies may persist until overwritten under the relevant provider's recovery lifecycle. Contact us for the retention decision for a particular record.

9. Your choices, rights and complaints

The name, email and stay details requested in an enquiry are needed to verify and deliver it; without them the enquiry or online booking cannot be completed. A provider must authorise its Stripe account to offer Stripe payments through Stays. You can browse public listings without connecting Stripe.

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal information. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent. Email hello@omnilion.co.uk to exercise a right or make a privacy complaint. We may need to verify your identity and consider other people's rights and applicable legal duties.

You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint, or to another competent supervisory authority where applicable. You do not have to contact us first. For information held independently by the accommodation provider or Stripe, their own privacy routes also apply.

10. Changes

We will update the date and version on this page when the notice changes and provide additional notice where a material change requires it.