Privacy policy.

Staylist Pty Ltd — Sydney, Australia — is the data controller for the personal data described here. We are an Australian company and we serve hosts internationally, including in the European Economic Area and the United Kingdom.

Privacy contact: contact@staylist.company. Our founder, Paul King, is accountable for privacy questions and answers them personally.

When you generate a listing pack, the photos you upload are sent to OpenAI's API, where a vision-capable model reads them and returns the listing text. This is the core of the service — without sending the photos there is nothing to describe.

We do not use your photos to train our own models, and we do not have any models of our own to train. We use OpenAI's API under terms where submitted content is not used to train their models. Photos are not sold, licensed, or shared with any other third party, and no human at Staylist browses your library for any purpose other than a support request you have asked us to look into.

Your photos stay yours. They are stored in private storage scoped to your account, and you can delete a property — and its photos — at any time from your dashboard.

We keep the list short and each provider is a processor acting on our instructions: OpenAI (listing generation from photos and basics), our cloud database, authentication and file storage provider, our application hosting and content delivery provider, our payment processor for paid plans, and our email delivery provider for verification and account email.

Wherever you live, you can ask us to: give you a copy of your data (access), fix data that is wrong (correction), delete your data (deletion), send you your data in a portable machine-readable format (portability), restrict how we use it, or object to processing we base on legitimate interests. Where processing relies on consent, you can withdraw it at any time — including cookie consent, via the cookie policy page.

Email contact@staylist.company and we will respond within 30 days. We never charge for a request and never require a form or a phone call. You can also delete your account yourself in settings. We do not make automated decisions with legal effects about you, and we do not sell personal data.

Data is encrypted in transit (TLS) and at rest. Photos live in private buckets that are not publicly listable; access is row-level-scoped so one account cannot read another's properties, packs or files. Passwords are salted and hashed by our authentication provider. Server-side keys — including our OpenAI key — are stored as secrets and never shipped to the browser. Access to production data is limited to the people who need it and protected by multi-factor authentication. If a breach ever affects your data, we will notify you and the relevant regulator without undue delay and, where the law requires it, within 72 hours.

We are based in Australia and our providers operate in Australia, the European Union and the United States, so your data crosses borders. For transfers of EEA or UK data outside those regions we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) in our contracts with each provider, together with encryption in transit and at rest. Under Australian Privacy Principle 8 we take reasonable steps to ensure overseas recipients handle your data consistently with the Privacy Act 1988.

Staylist is a tool for property hosts and is not intended for anyone under 16. We do not knowingly collect data from children; if you believe we have, email us and we will delete it.

Please raise it with us first at contact@staylist.company — most things are a misunderstanding we can fix quickly.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC), the regulator for the Privacy Act 1988, at oaic.gov.au.

If you are in the EEA, you may instead complain to the data protection supervisory authority of the country where you live or work — the list is maintained at edpb.europa.eu. UK visitors can complain to the Information Commissioner's Office.

If we change how we handle data we will update this page and the date at the top, and for material changes we will email account holders before the change takes effect.