This agreement is between RentalBeam and you, the host. It covers the personal data of your guests that RentalBeam processes for you, and it forms part of our Terms of Service. Your own account data is covered by our Privacy Policy.

Roles

You are the controller of your guests' personal data and RentalBeam is your processor. Under California law, you are the business and RentalBeam is your service provider. You decide what your booking form collects and why. We process that data only as described here.

Processing on Your Instructions

We process guest personal data only on your instructions: the settings you choose in your dashboard, the fields on your booking form, the features you enable, and any written request you send us.

We do not:

sell or share guest personal data;
use or disclose it for any purpose other than providing the service to you;
combine it with personal data from any other source;
use it to train AI models.

If the law requires us to process guest data for another reason, we will tell you first unless the law prohibits it. If we can no longer meet these obligations, we will tell you, and you may instruct us to stop processing or return the data.

Confidentiality

Access to guest personal data is limited to the people who need it to operate and support the service, each bound by a confidentiality obligation.

Security

We protect guest personal data with measures appropriate to the risk, including:

encryption in transit and at rest;
access controls that keep your records separate from every other host's;
private storage for guest uploads, readable only by the host whose booking they belong to;
limits on the type and size of files a guest can upload;
optional two-step verification on host accounts;
automatic deletion of guest uploads when they are no longer needed for the booking.

Subprocessors

You authorize us to use the subprocessors listed at rentalbeam.com/subprocessors. Each is bound by data protection obligations no less protective than this agreement, and we remain responsible to you for their performance. A new subprocessor is posted there at least 30 days before it begins processing guest data, and you may object during that period on reasonable data protection grounds.

Guest Requests

If a guest asks you to access, correct, or delete their data, you can handle most requests from your dashboard, and we will assist with the rest. If a guest contacts us directly, we will refer them to you.

Data Breaches

If we become aware of a personal data breach affecting guest data, we will notify you without undue delay, give you the information you need to meet your own notification obligations, and assist with any related risk assessment.

Deletion and Return

You can delete guest data at any time from your dashboard, and on request we will provide you with a copy of it. When you delete your account, access ends immediately, your data is held unchanged for 30 days so you can restore it, and it is then permanently deleted. Invoices and payment records are the exception: they are kept for the minimum period accounting and tax law requires, counted from the end of the business year they belong to.

Audits

On request, we will provide the information reasonably necessary to demonstrate compliance with this agreement and cooperate with audits carried out by you or an auditor you appoint.

International Transfers

Where a subprocessor processes data outside the EU or UK, the transfer relies on a recognized safeguard such as the European Commission's standard contractual clauses or an adequacy decision.

Details of Processing

Subject matter: the RentalBeam widgets and the dashboard behind them.
Duration: the life of your account, then as set out under Deletion and Return.
Nature and purpose: receiving booking requests, checking availability, calculating prices, taking payments where you enable them, sending booking emails, and showing you your bookings.
Data subjects: your guests, and visitors to pages where your widget is embedded.
Personal data: name, email address, phone number, booking dates, guest count, messages, answers to custom fields you configure, files uploaded to those fields, payment records, and technical data such as IP address.
Sensitive data: the booking form is not designed to collect sensitive personal data such as health or biometric information.

Changes to This Agreement

We may update this agreement. A change that materially reduces your protections is posted here before it takes effect. The date at the top shows when it last changed.

Contact Us

Questions about this agreement? Contact us at info@rentalbeam.com.

Data Processing Agreement