Privacy Policy

Effective date: October 7, 2026

STR IQ Lab ("STR IQ Lab", "we", "us") is based in Ontario, Canada. This policy explains what personal information we handle when you visit www.striqlab.com or use the product at app.striqlab.com (together, the "service"), why we handle it, who else touches it, and the choices you have.

Our Privacy Officer is accountable for how STR IQ Lab handles personal information and can be reached at hello@striqlab.com.

The short version

• We collect what you give us to run your account: your email, your name, and the records of your rental business.
• Your records can include information about your guests. You are responsible for that information. We handle it only to provide the service to you.
• We do not sell personal information. We do not use it for advertising. We do not show one customer's records to another, and we do not pool customers' records to produce figures for other customers.
• We never see or store your bank login, and we do not hold your card number. If you connect a bank, you sign in on a screen run by Plaid.
• You can ask for a copy of your records or ask us to delete them at any time.

1. Two kinds of information

Your information. Information about you as our customer or as a visitor to our website. We decide how it is used, and this policy describes that.

Guest information. Information about your guests and other people that is inside the records you bring into the product, such as a guest's name on a booking. You decide what to bring in and what it is for. We handle it on your behalf and on your instructions, as our Terms of Service describe. If you are a guest of one of our customers and have a question about your information, please contact that owner. If you write to us, we will pass your request to them.

2. What we collect

Account details. Your email address and your name. You sign in with a code sent to that address. If you switch on the second sign-in step, our sign-in provider also stores the key that pairs your authenticator app with your account.

Your agreement. When you set up your account we record that you accepted our Terms of Service and this policy, with the date and the version you accepted. When you connect a bank we record that you agreed to it, and when.

Your rental records. What you enter and import:

• your homes: a name you choose, the community or area, the number of bedrooms, and the purchase, value, loan and cost figures you enter
• stays: guest names, check-in and check-out dates, amounts, the site the stay was booked on, and booking and cancellation dates
• calendar links, if you add one: the web address a booking site gives for a home's calendar, which our server reads to keep your stays current, and the nights it shows as booked or closed
• transactions: the lines of the bank or card files you import, and of any bank or card account you connect, which hold dates, amounts, payees and memo text
• bank connections, if you choose to make one: the name of the bank, and each account's name and last four digits. We do not receive your bank user name or password, an account or routing number, or a balance
• your budget, your settings and the choices you make in the product
• your brand kit: business name, logo, colors, links, social handles and hashtags
• photos of your property that you add, and the posts and captions made from them
• figures you type into the Deal Finder, which are kept private to your own sign-in

Payment details. Payments are taken by our payment processor, Stripe, on its own pages, and Stripe holds your card. We never receive your full card number. We keep the customer and subscription references Stripe gives us, the size and price of your plan, its dates, and the status of each payment. We also keep an identifier that Stripe assigns to a card, which does not reveal the card number, so that we can tell when the same card is used on more than one account.

Messages. What you send us when you write for support, by email or through the Messages screen in the product, and our replies. That includes a screenshot if you attach one, so look at what a screenshot shows before you send it. A bug report made from the product also records which screen you came from.

Referral details. Which account referred a new customer, and whether that customer has paid, so that we can apply referral credits. We use the card identifier described above to make sure one person counts as a referral only once.

Codes. Which discount or credit codes an account has redeemed, and when.

Where a home is. We ask for each home's street address and for the resort, community or town it is in. We use them to place the home on a map, so that the events and posts we publish for an area reach the homes in it. With an address the home is placed to about ten metres. Without one, or when the address cannot be found, it is placed by its resort, community or town, to about a kilometre. Our servers look the address or the place up with OpenStreetMap's search service and, for an address in the United States that it does not know, with the United States Census Bureau's address service. Only the address or the place is sent, with nothing that says whose home it is. The address is kept with the home's other details. It is shown to you and to our staff, never to other owners, and it is never put in a post. You can opt a home in or out of an area.

Post ideas you send us. You can send us an idea for the library of post ideas. We keep what you wrote with your account so that we can follow up, and an idea we add to the library is reworded by us and offered to other owners without your name.

Technical information. When you use the service our hosting provider processes your IP address, the type of browser and device, the pages requested and the time. We use it to deliver the service, to keep it secure and to count visits in aggregate. We also use the country and region your connection comes from to tell you, before you enter a card, whether the service is sold where you are.

Cookies and browser storage. The product sets one cookie that keeps you signed in. It is strictly necessary, it cannot be read by scripts on the page, and it is not used for tracking. A second cookie is set only if you arrive through a member's referral link: it holds that link's code for up to 90 days and is removed once your account is set up. The product also keeps a few things in your browser's own storage on your device, such as your light or dark setting and work you have not finished. Our website statistics are collected without cookies and do not follow you across other sites. We use no advertising cookies and no advertising trackers.

What we do not collect. We never ask you to give us a bank or card login. If you connect a bank, you sign in with Plaid, and the login is not passed to us. We do not ask for government identity numbers, health information or information about children, and our terms ask you not to upload them. We do not connect to your social media accounts. We do not buy information about you from data brokers.

3. How we use it

We use personal information to:

• provide the service: store your records, calculate your figures, and make the posts you ask for
• sign you in, and keep your account and the service secure
• bill you, apply credits, and prevent abuse of trials and referrals
• answer you when you ask for help
• send you service messages, such as sign-in codes, receipts, trial and renewal notices, and notices of changes to our terms
• find and fix faults, and understand in aggregate how the product is used so that we can improve it
• meet our legal, tax and accounting duties, and protect our legal rights

We do not use your records or guest information for advertising. We do not use them to train AI models, and we do not let our providers do so. We do not make decisions about you by automated means that have a legal or similarly significant effect on you.

Marketing email. We send marketing email only if you have agreed to receive it. Every such email has a working unsubscribe link, and unsubscribing does not affect service messages.

4. AI features

When you ask the product to design a post with AI, we send the words for the post, your brand colors and, where you choose it, a photo of your property to Google, which runs the AI model, so that it can produce the picture or text. We leave guest names and guest contact details out of what we send. The providers we use are engaged on terms under which they do not use that content to train their models.

5. Who we share it with

Service providers. We use other companies to run the service. They may handle personal information only to provide their service to us, under contracts that require them to protect it.

Plaid is used only if you choose to connect a bank or card. You sign in to your bank on Plaid's screen, and Plaid handles your login and account information under its own End User Privacy Policy, at plaid.com/legal. We tell Plaid an identifier for your account, never your name or email address. Before you connect, the product asks for your agreement.

We will update this list before we add a provider that handles personal information.

Legal reasons. We may disclose information if the law requires it, or if it is needed to protect the rights, property or safety of our customers, the public or us. Where the law allows, we will tell you before we answer a legal demand for your records.

A change of ownership. If the service is sold or merged, personal information may pass to the new owner, who must continue to honour this policy until it is changed with notice to you.

We do not sell or share personal information. We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in US state privacy laws. We have not done so in the past 12 months.

Tracking across sites. We do not track you across other websites, and we do not let other companies collect information about your activity over time and across sites through our service. Because of that, the service behaves the same way whether or not your browser sends a Do Not Track or Global Privacy Control signal.

6. Where it is kept

We are based in Canada. Our providers store and process information in the United States and, for network delivery, in other countries. Information held in the United States can be reached by US courts, law enforcement and national security authorities under US law, and information held in Canada can be reached in the same way under Canadian law. Those laws may protect your information differently from the law where you live. We hold contracts with our providers that require them to protect it. By using the service you understand that your information will be handled in Canada and the United States.

7. How long we keep it

• Your records and account: for as long as your account is open.
• After your subscription ends: for 90 days, so that you can come back to your records or ask for an export. Then we delete them from our active systems. If you ask us to delete your account sooner, we do.
• Backups: a copy of the database is made each night, kept encrypted, and deleted after 14 days. Something you delete can therefore remain in a backup for up to 14 days. Photo files are not part of the backup.
• Posts: the 25 most recent posts for each home are kept, and older ones are removed. Posts we publish for you are kept for three months.
• Messages with us, and any screenshots attached to them: for as long as your account is open.
• Archived homes: a home you archive keeps its stays, bills and budget for as long as your account is open. Its photos and posts are deleted 30 days after it is archived.
• Referral code: if you follow a member's referral link, the code in it is kept in a cookie and in your browser's storage for up to 90 days, so the referral is still there if you sign up on a later visit. It holds the code and nothing about you. It is removed once your account is set up.
• Referrals: if you sign up through another member's link or give their code, that member sees your first name, the first letter of your last name, the day you signed up and whether you are a paying member. They see nothing else about you or your account.
• Card identifiers: the identifier our payment processor assigns to a card is kept for two years after an account closes, so that the referral program cannot be used twice by the same person. It is then deleted.
• Your agreement: the record that you accepted our terms and this policy is kept after your account closes, as a date and a version beside an account reference that no longer leads to you.
• Imported files: a bank or booking file is read when you import it. We keep the lines read from it and discard the file itself.
• Bank connections: a connection lasts until you disconnect it, your plan ends or your account is deleted. We then have Plaid remove it, which ends our access to the bank. The transactions it brought in stay in your records and follow the schedule above.
• Billing and tax records: for as long as tax and accounting law requires, which is generally up to seven years.
• Activity record: the things done on your account are noted with the date and time: each sign-in with the country it came from, each download of your records, and each change to your homes, your plan, your connections and your records. A note says what was done and to how many records, such as "changed 12 transactions". It never holds what a stay or a transaction contains, and we do not record your network address in it. You can see the last 20 lines on the Account screen. Lines are kept for 12 months, and are removed within a day of your account being deleted. Notes about your plan, your agreement to our terms and the ending of a bank connection are kept longer, as described in this list.

You can delete a home, a stay, an import or a photo yourself at any time. Deleting your account removes everything in it on the schedule above.

8. How we protect it

We use measures suited to the sensitivity of the information, including:

• encryption of information in transit, and encryption at rest by our hosting providers
• access rules in the database itself, so that each account can reach only its own records, tested automatically before every release
• sign-in without passwords, with a session that scripts on the page cannot read, and a way to sign out of every device at once
• no bank logins and no card numbers held by us
• read-only access to a bank you connect, stored encrypted with a key kept apart from the database, and available only to an account with a second sign-in step switched on
• access to customer records limited to the people who need it to run or support the service, with two sign-in steps on our admin site

What our staff can see. Our admin site shows an account's name, email address, plan, homes, messages with us, and counts of its records. It also shows the activity record described in section 7. It does not show the contents of your stays or transactions. To help when you write to us, and to check that screens lay out properly, staff can open a copy of your screens in which every amount, payee, guest name and street address has been replaced before it reaches them. In that copy they see the names of your homes, your dates and categories, your posts and brand kit, and how many rows you have. They cannot change anything there. Each time a member's account or its screens are opened, a line is written to that record. The person who runs the service can also reach the database itself, and looks at an account's records only to answer that owner's request for help or to fix a fault.

No system is completely secure, and we cannot guarantee that information will never be accessed, disclosed, changed or lost. If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and report it to the Office of the Privacy Commissioner of Canada and any other regulator the law requires, as soon as we reasonably can. If it affects guest information in your records, we will tell you so that you can meet your own duties.

9. Your choices and rights

Whoever you are and wherever you live, you can ask us to:

• give you a copy of the personal information we hold about you. You can also download your records yourself at any time from the Account screen
• correct information that is wrong
• delete your information or close your account
• stop sending you marketing email
• explain how we have handled your information

Write to hello@striqlab.com from the email address on your account. We may need to confirm that the request comes from you. We answer within 30 days, and it is free. We will not treat you differently for making a request. If we cannot do what you ask, for example because the law requires us to keep a billing record, we will tell you why.

Canada. You may withdraw consent to our handling of your information at any time, subject to legal and contractual limits, though we may then be unable to provide the service. If you are not satisfied with our answer to a privacy concern, you may complain to the Office of the Privacy Commissioner of Canada.

United States. Depending on your state, you may have rights to know, access, correct, delete and obtain a copy of your personal information, to appeal a decision we make about your request, and to opt out of sale, of sharing for targeted advertising, and of certain profiling. We do none of those three things. To appeal, reply to our decision and say that you are appealing. You may use an authorised agent to make a request. We do not knowingly collect sensitive personal information.

Europe and the United Kingdom. Paid plans are not offered in the European Union or the United Kingdom at present, and the service is not aimed at people there. If their data protection law applies to information we hold about you, you have the rights of access, correction, deletion, restriction, objection and portability, and the right to complain to your data protection authority. We rely on our contract with you, on our legitimate interests in running and securing the service, on your consent where we ask for it, and on our legal obligations.

10. Children

The service is for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to us and we will delete it.

11. Changes to this policy

We may change this policy. If a change is material, we will tell you by email or in the product at least 30 days before it takes effect. The date at the top shows when the policy last changed.

12. Contact

STR IQ Lab, attention: Privacy Officer

Email: hello@striqlab.com