Effective: 18 October 2026 · Last updated: 20 October 2026
CielStay (cielstay.com) is operated by Ciel Group LLC ("CielStay", "we", "us"). This policy explains what personal information we collect, why, who receives it, how long we keep it, and the choices you have.
CielStay is a search and discovery service for vacation rentals and longer stays. We make the match, then step aside: we never take payment for a stay and we are not a party to any booking. When you book, you do so on the host's own website or on a booking platform you choose, and that site's privacy policy applies to what you give it.
1. What we collect
When you search or browse, without an account
- The words of your search, any dates, guest count and filters you choose, and the results we showed.
- A random identifier for your browser tab (stored in your browser's session storage, cleared when you close the tab), so we can tell which results led to a click. It is not linked to your name or email.
- Which listings and booking links you click.
- Technical information sent by your browser: IP address, browser type ("user agent") and the page you came from. We use the IP address for security and to limit abuse, and it appears in our server logs.
When you create an account
- Your name and email address, and a password (stored only in hashed form) — or, if you sign in with Google or GitHub, the basic profile those services share with us (name, email, profile picture).
- Your saved searches and preferences.
When you message a host, or a guest messages you
- The content of the messages, who sent them and when, and any dates and guest details included. These are stored so both people can read the conversation.
- If a host confirms or records a stay with you: the dates and guests, the total and currency, the host's payment link and payment note, the listing's cancellation policy, any request to change dates or cancel and its outcome, and a log of each step. CielStay never receives the payment or your card details.
- Where an inquiry came from: the tab session identifier, whether it arrived through the website or an AI assistant, and the page it was sent from. We use this, in aggregate, to see which parts of CielStay lead guests to hosts.
- If the host hasn't replied after 3 days, we email you once to say so and point you to the listing's booking links (you can turn these emails off in your account settings).
- If the home is in the United States (or a US territory), Canada, Australia or New Zealand, its host has not joined CielStay, and we have a business email address for its operator, we tell that address that a guest asked: your first name, the home, your dates and party size, and we may forward your message, with any email addresses, phone numbers and links removed. Never your email address or your phone number. We say so on the listing before you send. That address comes from the operator's public website and may not be the host.
If you are a host
- Information you add or correct about your listing, your contact details, and verification information you provide to show you control a listing. If you try to claim a listing another host has verified, we record the attempt and its outcome, and tell both of you.
- If you ask us to assign you many listings from your booking site: the site, the proof you send us (such as screenshots of your booking software or domain account) and what our reviewer noted about it, which listings moved to you and from whom, and the address on that site we told.
- If you connect PriceLabs, the API key you give us (stored encrypted; we show only its last four characters), which of your PriceLabs listings map to which CielStay listings, and the sync status. We use the key only to read your prices, minimum stays and availability, and we delete it when you disconnect or delete your account. Prices you enter yourself (from, typical, monthly) are shown on your listing.
- If you pay for CielStay Pro, your billing is handled by our payment processor (Stripe). We receive confirmation of payment and the last four digits of your card; we do not receive or store full card numbers. The founding offer needs no card.
When you suggest a host's booking site or contact us
- The web address you suggest and, if you give them, the place and your relationship to it; or the content of your message and your email address.
Listing information from public pages. Most listings on CielStay are compiled from information hosts and their booking software publish on public web pages (the property, its photos, location, rates and booking links). Our crawler identifies itself, follows each site's robots.txt and stops when asked (see cielstay.com/bot). This is information about properties; where it includes a host's or property manager's business name or contact details, a host can claim, correct or remove the listing at cielstay.com/opt-out.
Business contact details of property managers. Where an operator publishes a business email address or phone number on its own website, we may record it, with the page it came from, to contact the business about its listings. We never use it to create or sign in to an account or to verify ownership, we never use it for operators who have claimed a listing or asked to be removed, and any request to stop is permanent. When a guest asks about a home in the United States (or a US territory), Canada, Australia or New Zealand whose host has not joined CielStay, we may email that address to say so (the guest's first name, dates and party size, and their message without contact details) and invite the operator to claim the listing; every such email has a one-click unsubscribe, and we keep a record of what we sent and of where we found the address. If you reply asking us to stop, or tell us we have the wrong person, or an email to the address bounces or is marked as spam, we permanently stop emailing that address about listings; if you ask us to stop and do not say we have the wrong person, we also stop emailing every other address we hold for the same business. When you unsubscribe you can tell us why, if you want to; we keep that answer for 13 months. For operators in the EU, EEA, UK and Switzerland, we record contact details only when we are about to write to them, and our first message says where we found them and how to ask us to stop. If we assign many listings from a booking site to a host, we email the address published on that site to tell them, as a security notice.
Your location, only if you ask. The map's "Find location" button uses your browser's location feature, which asks your permission first. Your position stays in your browser: the map moves there and marks the spot; we do not receive or store your coordinates. The map then loads homes for the area on screen, and that request (the map area, not your exact position) appears in our server logs like any other map view. Your browser also remembers where you left the map, on your device only.
Cookies and browser storage. We set a cookie only when you sign in, to keep you signed in. Your browser also stores, on your device: the tab session identifier above and your current search (cleared when you close the tab), and the dates you last chose and where you left the map (kept until you clear them). None of these are advertising or third-party cookies.
We do not use advertising trackers. We run no third-party advertising or analytics scripts and do not sell personal information or share it for cross-context behavioural advertising.
2. How we use it
- To run the search, show results and booking links, and improve how well results match what people ask for.
- To operate accounts and deliver messages between guests and hosts.
- To understand, in aggregate, which searches lead to bookings sites being visited, and to measure our service.
- To keep the service secure, prevent abuse and enforce our Terms.
- To send service emails you need (sign-in, message notifications).
- To comply with law.
Legal bases (for people in the EU, EEA and UK): performing our contract with you (accounts, messages, Pro); our legitimate interests in running, measuring, improving and securing a free search service (search logs, click measurement, security logs, listing information from public pages); and your consent where we ask for it.
3. Who receives it
We share personal information only with service providers who process it for us, under contract:
- Cloudflare — website delivery, security and our AI-agent (MCP) server.
- Stripe — CielStay Pro billing.
- Resend — sending email.
- Google Workspace — our email: messages you send to inquiries@cielstay.com (or any other @cielstay.com address), and our replies. Our own server reads that mailbox to answer you and to add the homes hosts send us, and keeps a log of the email we send (recipient, subject, time). Messages about legal matters, safety, disputes, large accounts or partnerships are also forwarded in full to our founder, including to a personal Google (Gmail) account.
- Google and GitHub — only if you choose to sign in with them.
- PriceLabs — only if you are a host and connect your own PriceLabs account: we call PriceLabs with your key, at your request, to read your prices, minimum stays and availability.
- Image hosts — listing photos load directly from the servers that host them for the property's booking site (for example, the host's booking software or its cloud storage), and some guide images from cloud storage. Those servers receive your IP address, as with any web request. We send them nothing else.
- Map tile providers — when you view a map, your browser loads map images directly from OpenFreeMap and Amazon Web Services (terrain), and from OpenStreetMap only when your browser can't display our maps, which receive your IP address as with any web request. We send them nothing else.
- OpenStreetMap's address lookup (Nominatim) — when a host adds or moves a listing, our server sends the address they enter to find its place on the map. It is sent from our server, not your browser, and with nothing else about you.
- AI model providers — the text of a search is sent to an AI model to understand the request (for example, which place and which features you mean). Today that is GitHub Copilot (Microsoft), which routes the request to the underlying model, and Anthropic. We do not send your name, email or account details with it.
And, at your direction, with hosts (when you message one) and with the booking sites you click through to (they receive the visit, as with any link).
We may also disclose information if required by law, to protect people's safety, or in connection with a sale or reorganisation of our business (with notice to you).
4. How long we keep it
| Information | Kept for |
|---|---|
| Search text, filters and results shown | 13 months, then deleted or reduced to counts with no identifiers |
| Tab session identifier linking searches to clicks | 13 months, together with the searches above |
| Server and security logs (incl. IP address) | Up to 90 days |
| Account information | While the account is open; deleted within 30 days of a deletion request |
| Messages, and any stay recorded in the conversation | While the host's account is open. If a guest deletes their account, the host keeps the conversation, but without the guest's name, email address or phone number. If a host deletes their account, their conversations are deleted with it, including the guest's copy (you can download your messages first from your account page) |
| Email you send us, and our replies | In our mailbox while useful to answer you; our log of sent email (recipient, subject, time), 13 months |
| Suggested sites (the URL itself) | Kept as long as useful; any contact details you add, 13 months |
| Record of an inquiry we passed to a host's business address (which address, which listing, when, delivery status) | 13 months |
| Record of an attempt to claim a listing another host had verified (who, which listing, the outcome) | 3 years from the attempt |
| Record of changes of a listing's owner, and ownership disputes | 3 years from each change, or from a dispute's resolution; the change that gave the current owner the listing is kept for as long as they hold it |
| Record of listings we assigned to a host from a booking site (site, the reviewer's note of the proof, listings moved and from whom, address notified) | While the assignment stands, and 3 years after it was made |
| An address that asked us to stop emailing it, bounced, or marked our email as spam | Permanently, so we never email it about listings again |
| Why you unsubscribed, if you told us | 13 months |
| A host's PriceLabs API key (encrypted) and listing mapping | Until you disconnect PriceLabs or delete your account |
| Pro billing records | 7 years (tax and accounting) |
| Record of an account we closed or suspended (name, email, the listings involved and the reason) | 3 years, to judge appeals and recognise a returning fraudulent account |
| Backups | Deleted data can remain in encrypted backups for up to 6 months before they expire |
5. Your choices and rights
You can:
- Use CielStay without an account, and close your tab to clear the session identifier.
- See, correct or delete your account information, and download your message history, from your account page, or by emailing us.
- Unsubscribe in one click from any email we send that is not about your account or your messages.
- As a host, claim, correct or remove a listing (cielstay.com/opt-out).
Depending on where you live, you may also have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain uses, to withdraw consent, and to complain to your local data protection authority. We do not sell personal information. To exercise a right, email inquiries@cielstay.com; we will respond within 30 days (or as the law requires) and may need to confirm it is you.
6. Children
CielStay is for people 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
7. Security and international transfers
We use encryption in transit, access controls and hashed passwords. No service is perfectly secure. We are based in the United States, and our providers may process information in the US and other countries; where the law requires, we rely on appropriate safeguards for transfers from the EU, EEA and UK, such as our providers' certification under the EU–US Data Privacy Framework or Standard Contractual Clauses.
8. Changes and contact
We will post changes here and update the date at the top; for material changes we will give notice on the site or by email. See also our Terms of Service.
Contact: Ciel Group LLC, 30 N Gould St, Suite # 57239, Sheridan, WY 82801, USA (postal mail only) · inquiries@cielstay.com · contact form