CastorOS

Privacy Policy

Your privacy matters. Here's how we protect your data, in plain language.

Last updated: May 30, 2026

What we collect

To run CastorOS, we need certain information:

  • Your email address to create your account.
  • Your Airbnb or VRBO calendar data (dates, group names): only what is necessary to create and manage your stays.
  • Your guests' phone numbers, to send them welcome and follow-up SMS messages.
  • API keys for your smart devices (lock, thermostat), encrypted and never shared.

What we don't do

  • We do not sell your data to third parties.
  • We do not use your data for advertising.
  • We do not share your guests' information with anyone.
  • We do not use Google Analytics or any cookie-based tracking tool.

How we protect your data

All API keys and sensitive data are encrypted at rest (AES-256-GCM). Our servers are hosted in North America, with daily backups. We apply the principle of least privilege: each component of the system only has access to the data it needs.

Cookies

We use a secure session cookie to keep you logged in. No tracking cookies. No advertising. No data sharing with ad networks.

Retention and automatic anonymization

By default, the personal information of all guests (name, email, phone number) is automatically anonymized 72 hours after the end of their stay.

When guests arrive on the property page, they have the option to check the box "Keep me informed of late checkout offers and future discounts for this property." If the guest checks this box, their email address is retained so the host can send them future offers related to this property only. Name and phone are anonymized in all cases.

If the guest does not check this box, all of their contact details are fully anonymized after 72 hours. No commercial communication will be sent to them.

Your rights

In accordance with applicable privacy law, you may at any time:

  • Access the personal information we hold about you.
  • Request correction of inaccurate or incomplete information.
  • Request deletion of your data (right to erasure).
  • Withdraw your consent to the processing of your data.

To exercise these rights, write to privacy@castoros.app. We acknowledge receipt within 48 hours and process your request within 30 days.

Privacy officer

CastorOS has designated a privacy officer responsible for personal information protection:

All privacy complaints or questions should be directed to this person first. If you are not satisfied with our response, you may contact the relevant privacy authority in your jurisdiction. For Quebec residents: Commission d'accès à l'information du Québec (CAI).

General questions

Didn't find what you were looking for? Write to us: bonjour@castoros.app. We reply as people, not robots.