Privacy Policy

Introduction

Airflow (“we”, “our”, “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website and services.

By using Airflow, you agree to the collection and use of information in accordance with this policy.

Information We Collect

Information you provide

  • Account information (name, email address)
  • Business information (property details, platform credentials)
  • Payment information (processed securely via Stripe — we never store card details)
  • Communications (support messages, feedback)

Information collected automatically

  • Usage data (pages visited, features used, session duration)
  • Device information (browser type, operating system)
  • Log data (IP address, access times, referring URLs)

Information from third-party services

When you connect platforms (e.g., Airbnb, Xero), we receive data necessary to provide our service — such as booking details, financial transactions, and guest information. We only access what’s needed and never use this data for purposes beyond operating Airflow for you.

Data About Your Guests and Clients

To operate your bookings, you may provide to us, or sync into the Service, personal data about your guests, clients, and property owners (such as names, contact details, and stay information). For this data:

  • You are the controller of your guests’ and clients’ personal data, and Airflow acts as a processor handling it on your instructions in order to provide the Service.
  • You are responsible for having a lawful basis to collect this data and share it with us, and for providing any privacy notices required by law to the individuals concerned.
  • We process this data only to provide the Service to you and in accordance with this policy.

How We Use Your Information

  • To provide and maintain the Airflow service
  • To sync data between your connected platforms
  • To process transactions and manage billing
  • To send service-related communications
  • To improve our product and user experience
  • To comply with legal obligations

Automated Processing & Artificial Intelligence

Airflow uses artificial intelligence and automated systems to provide core features — for example, reading booking-related emails and documents to extract details, drafting messages, invoices, and replies, and generating reports. To do this, the relevant content (which may include booking, guest, and financial information) is processed by trusted AI service providers acting on our behalf.

  • We share only the content needed to perform the requested task.
  • We select providers whose terms do not permit using your content to train their general models, and we do not use your content to train models for unrelated purposes.
  • AI output is generated to assist you and may contain errors; it should be reviewed before it is relied upon. See our Terms of Service for more on the limits of AI-generated content.

Data Sharing

We do not sell your personal information. We share data only in these circumstances:

  • Service providers: Trusted third parties that help us operate (hosting, payment processing, analytics, and AI processing)
  • Connected platforms: Data flows to/from platforms you’ve explicitly connected
  • Legal requirements: When required by law, regulation, or legal process

Data Security

We use industry-standard security measures including encryption in transit (TLS) and at rest, secure authentication, and regular security audits. While no system is 100% secure, we take every reasonable step to protect your data.

Data Retention

We retain your data for as long as your account is active or as needed to provide our services. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law. Backups are purged within this same period.

International Transfers

We and our service providers may process your data in countries outside the United Kingdom and European Economic Area, including the United States. Where we do, we take steps to ensure your data remains protected by appropriate safeguards as required by applicable data protection law.

Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Export your data in a portable format
  • Withdraw consent for data processing
  • Lodge a complaint with a supervisory authority

Google API Services Disclosure

Airflow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access and why

When you connect your Google account to Airflow, we request access only to the specific services you choose to integrate:

  • Google Sheets: Airflow reads and writes to a designated spreadsheet in your Google Drive to sync your booking data, revenue figures, and guest records. This allows you to maintain a live backup or use Sheets as your accounting ledger. We only access the specific spreadsheet you authorise — we do not access other files in your Drive.
  • Google Calendar: Airflow reads your calendar events to check availability and prevent double bookings. We can also write new events when bookings are confirmed. We only access calendars you explicitly connect.
  • Gmail (optional): If you connect Gmail, Airflow reads incoming booking confirmation emails to automatically extract guest details, dates, and pricing. We only read messages matching booking-related patterns — we do not read, store, or process unrelated personal emails.

How we use this data

Data received from Google APIs is used exclusively to provide the Airflow service to you — specifically, to sync bookings, prevent scheduling conflicts, and automate data entry. We do not use Google user data for advertising, market research, or any purpose unrelated to operating Airflow.

Data storage and sharing

Google user data is stored securely on our infrastructure (Supabase) with encryption at rest and in transit. We do not share Google user data with third parties except as necessary to operate the service (e.g., processing a booking sync you initiated). We do not sell Google user data.

Revoking access

You can disconnect your Google account from Airflow at any time via Settings > Connections in your portal. You can also revoke access directly from your Google Account permissions page. When you disconnect, we stop accessing your Google data immediately and delete cached Google data within 30 days.

Cookies

We use essential cookies to operate the service and analytics cookies to understand how our site is used. We do not use advertising cookies. You can control cookie settings in your browser.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice on our website. Continued use of Airflow after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us at [email protected].

Last updated: Mon Jun 15 2026 00:00:00 GMT+0000 (Coordinated Universal Time)