Privacy policy
This is an English translation provided for convenience. The Korean version is the official policy and governs in case of any difference.
In accordance with Article 30 of the Personal Information Protection Act of Korea, the Operator establishes and publishes this policy to protect the personal information of data subjects (guests, service users and site visitors) and to handle related complaints promptly.
Separately from Articles 1 through 11, which apply to guests and service users, the scope of an operator-only personal tool that uses the same Google connection settings is described below.
Operator-only card statement tool
Data use notice · Published 2026-09-21
In addition to Starry Steward's sign-in and past-booking restoration features, this Google project includes a personal tool the Operator uses to organize the Operator's own card statements. This tool is not provided to guests.
Information read and purpose of use
The card statement tool uses read-only Gmail access approved by the user. The collection code looks up emails and related attachments from designated card company senders and extracts the information needed for bookkeeping, such as card company, card name, date of use, merchant and billed amount. It does not send, modify or delete email.
Storage and processing
The retrieved statements and extracted transactions are stored in access-restricted storage and a local ledger on a Mac owned by the Operator. Information contained in the original statements may be stored as well. No external AI service is called during collection, parsing or duplicate checking.
Retention, deletion and revoking access
Original statements and the ledger are kept for the Operator's record-keeping until deletion is requested. On a deletion request, the storage locations of the originals, transaction records and related backups are checked and handled together. If access for the app is revoked in the Google account, email lookups stop from then on, and deletion of records already imported to local storage can be requested separately. Contact details are the same as the Operator contact in Article 10 below.
This description covers the scope of the Operator's personal tool only. It does not change the existing purposes of processing or retention periods for guest information.
Article 1 — Purposes of processing
- Receiving and managing bookings (check-in, check-out, rates, settlement)
- Communicating with guests (responding to inquiries, sending and receiving messages, translation, assistance with writing replies)
- Managing cleaning and facility operations, and confirming check-out
- Facility safety and prevention of fire and theft (video monitoring of common areas)
- Analysis of revenue and operating statistics (mainly de-identified aggregates)
- Responding to product inquiries on this site
Article 2 — Personal information processed and how it is collected
| Category | Items | Collection method |
|---|---|---|
| Guest booking information | Name, phone number (where provided by the booking channel), country and language, check-in and check-out dates, number of guests, amount paid, booking channel | Indirect collection through booking platforms (OTAs) such as Airbnb and a channel management service (Beds24) |
| Guest conversations | Message content, review content | Booking platform message integration |
| Facility safety | CCTV footage of common areas such as property entrances | Fixed video information processing devices (see Article 9) |
| Check-out confirmation | Device information of devices connected to the property Wi-Fi (MAC address, device name, signal strength) | Property router |
| Service users (operating staff) | Google sign-in email, service usage records (audit logs) | Collected automatically at sign-in |
| Trial applications and inquiries on this site | Required: name, email · Optional: number of properties operated, listing URL, plan of interest, message | When the trial application or inquiry form is submitted (forwarded to the operating staff's notification channel; not stored in a separate database) |
* Guest personal information is collected indirectly through platform integration from the information guests provided to the booking platform (Article 20 of the Act). Resident registration numbers, passport numbers and payment card numbers are not collected or stored. This service is not intended for children under 14 and does not knowingly collect children's personal information.
Article 3 — Retention period and destruction
| Item | Retention period | Basis |
|---|---|---|
| Booking and payment records | 5 years after check-out, after which names are de-identified (first letter only) and phone numbers are deleted | Act on Consumer Protection in Electronic Commerce (contract and payment records: 5 years) |
| Guest conversations and inquiries | Deleted after 3 years | Act on Consumer Protection in Electronic Commerce (consumer complaint and dispute records: 3 years) |
| Service audit logs | Deleted after 2 years | Standards for measures to ensure the safety of personal information (access logs kept for at least 1 year) |
| Wi-Fi device information | Deleted within 90 days of last detection | When the purpose of check-out confirmation is achieved |
| Check-out detection records | Deleted after 1 year | When the purpose of operational confirmation is achieved |
| CCTV footage | Deleted automatically by cyclic overwriting on the storage device (usually within 30 days). Where needed, for example to investigate an incident, only the relevant segment is kept separately | Video information processing device operating policy |
The service performs the above destruction automatically every day. Personal information past its retention period is deleted in a way that cannot be recovered, or de-identified so that it can only be used for statistical purposes.
Article 4 — Provision to third parties
The Operator does not provide guest personal information to third parties. When syncing the booking calendar with external booking channels, only booking dates and statusare transmitted; names and contact details are not included.
Article 5 — Outsourcing of processing and overseas transfer
To operate the service, processing is outsourced to the companies below, and some processing takes place overseas (Article 28-8 of the Act). Data subjects may refuse overseas transfer by contacting us at the address below; in that case, provision of the service related to the affected function may be limited.
| Processor (country) | Items transferred | Purpose | Timing and method of transfer | Retention period |
|---|---|---|---|---|
| Beds24 Ltd (United Kingdom) | Booking information, guest names and contact details, messages | Integrated management of booking channels (channel manager) | Network transmission when bookings occur and messages are sent or received | For the term of the outsourcing contract |
| Cloudflare, Inc. (United States, etc.) | All data stored in the service | Service hosting and database | Continuously while the service is used | For the period of service use (destruction criteria in Article 3 apply) |
| Anthropic PBC (United States) | Booking information and guest conversations referenced by AI features | Generating AI responses and reports (only when the operator has turned on the Claude engine) | Network transmission when AI features are used | Destroyed without delay after the response is generated (not used for model training) |
| Google LLC (United States) | Booking notification emails (read-only, when the past-booking import feature is used) | Restoring past booking data | When the feature runs | Access permission removed after the import is complete |
| Slack Technologies (United States) | New booking notifications (name masked, dates and property) and the content of site inquiries | Real-time notifications to operating staff | When a booking or inquiry occurs | Notification channel retention policy |
* The default AI (Steward AI) runs on equipment owned by the Operator; the transfer to Anthropic above occurs only when the Claude engine has been explicitly turned on.
Article 6 — Rights of data subjects and how to exercise them
Data subjects may at any time request access to, correction, deletion or suspension of processing of their personal information. If you make a request to the contact below, we will act without delay (within 10 days) and inform you of the result. Rights may also be exercised through a representative. The exercise of rights follows Articles 35 to 37 of the Act, and deletion of records that laws require to be kept may be restricted for that period.
Article 7 — Measures to ensure safety
- Access control: Google account two-step sign-in plus access limited to approved operating staff emails (Cloudflare Access), with data separated per account
- Access records: every data change is recorded in audit logs, kept for 2 years
- Encryption: integration credentials (tokens) are stored encrypted, and all traffic is sent over HTTPS
- Automatic destruction: data past its retention period is automatically deleted or de-identified every day
Article 8 — Automated decisions and AI features
AI features (rate recommendations, reply drafts, operations reports) are tools that produce reference information to help operating staff review, and they do not make decisions with legal effect on guests automatically without human involvement.
Article 9 — Operation of fixed video information processing devices (CCTV)
- Purpose of installation: facility safety, prevention of fire and theft, check-out confirmation
- Installation locations and recording range: common areas such as the entrance of each property (not installed in spaces where privacy could be infringed, such as inside rooms or bathrooms)
- Retention: follows the CCTV criteria in Article 3, and notice signs are posted in recorded areas
- Viewing rights: viewing footage is limited to the Representative alone; other operating staff and service users have no access
- Person responsible: the same as the privacy officer in Article 10
Article 10 — Privacy officer
Privacy officer: Dongju Lee (Representative, Sterry House)
Contact: doorman (at) starrysteward.com
Other reports and consultations on privacy infringement: Personal Information Infringement Report Center (118, no area code · privacy.kisa.or.kr), Personal Information Dispute Mediation Committee (1833-6972 · kopico.go.kr)
Article 11 — Changes to this policy
When this policy changes, we will post a notice on this page 7 days before the change takes effect (30 days for material changes).
v1 · Effective 2026-08-10
v1.1 · Revised 2026-10-07 — Aligned the "Trial applications and inquiries on this site" item in Article 2 with the actual form (added number of properties operated, listing URL and plan of interest, and removed the phone number, which is not collected). The information actually collected and how it is processed did not change.