Privacy policy
This document is a translation: only the French version is legally binding.
Last updated: 28 October 2026
Your data and your guests’ data are used to run OmniStay. They are never sold. Visits to this website are counted anonymously (audience measurement); advertising cookies are only set if you accept them (cookies).
Who is responsible?
LS FORMATION FZCO (Dubai, United Arab Emirates), publisher of OmniStay (see the legal notice), is the controller for the data of people who create an account and of visitors to this website.
For the data our clients record in OmniStay (guests, team, owners, properties, bookings, messages, requests received through the form on their showcase website), the controller is the client, and OmniStay acts on their behalf, as a processor.
What data, why, and for how long?
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Account: name, email, company, phone | Creating and managing your account, writing to you about the service | Contract | For the duration of the subscription, then 30 days |
| Billing (the bank card is held by Stripe, never by OmniStay) | Collecting the subscription, issuing invoices | Contract, legal obligation | Invoices: 10 years |
| Content of your account (properties, bookings, guests, team, owners, messages) | Providing the service, on your behalf | Contract (your instructions) | For the duration of the subscription, then 30 days for export |
| Technical logs and errors | Security, troubleshooting | Legitimate interest | 12 months |
| Questions asked to the assistant (“Ask OmniStay”, help centre), without any name or contact details (removed on your device, then again on our servers), with the answer given and your “helpful / not helpful” feedback; no account identifier, only a fingerprint of the company to count recurring questions | Improving the assistant, help and walkthroughs for all property managers | Legitimate interest | 13 months |
| Ideas suggested in the application, and votes | Choosing OmniStay’s improvements; an idea is only shown to other clients after review, without your name | Legitimate interest | As long as the idea is useful, at most for the duration of the subscription |
| Where your sign-up came from: referring site or link campaign (for example “Instagram”), link of the property manager who recommended OmniStay to you | Knowing which channels bring us clients | Legitimate interest | With the account |
| Referrals: your code, the accounts created with your link, their sign-up and first payment dates, your commissions and their payments | Calculating and paying referral commissions (article 12 of the terms and conditions) | Contract | With the account; after its deletion, without a name, for the time needed for payment and accounting (see Deleting your account) |
| Referrals: your bank details (IBAN), which we ask you for by email to transfer your commissions | Paying your commissions by bank transfer | Contract, legal obligation | The time needed for payment and accounting |
| Audience measurement for the website, the demo and sign-up, without cookies (our counters and PostHog, see below) | Counting visits, knowing which pages and links are useful | Legitimate interest (exempt from consent) | 25 months (our counters); 1 year (PostHog) |
| Measuring our ads and personalised advertising, only if you accept (one, the other or both): Google Ads and Meta pixel cookies on this website and on the app’s sign-up pages (the ad that brought you here, then whether you open the demo, create an account or activate a subscription; see Cookies) | Knowing which ads bring us clients; showing you our ads later, on Google, Facebook, Instagram and their partners | Consent (can be changed at any time: “Cookies”, at the bottom of every page) | Your choice: 6 months; Google cookies: 13 months at most; Meta cookies: 3 months after your last visit |
| The start of your free month and your first payment, sent to Meta by our servers, only if you have accepted both purposes: your hashed email address (turned into an unreadable string of characters), the identifiers of Meta’s cookies (_fbp, _fbc) and your browser, kept from your sign-up until that first payment (see Cookies) | Knowing which Facebook and Instagram ads bring us clients who subscribe | Consent (can be changed at any time: “Cookies”, at the bottom of every page) | Until the first payment, 6 months at most |
| Measuring use of the application, only if you accept: screens and buttons used, recordings of your sessions with all texts and fields masked, errors, AI assistant response times without the content of requests (see below) | Improving OmniStay, fixing bugs faster, testing improvements | Consent (can be changed at any time in My account) | 30 days for recordings; 1 year for the rest |
| Demo: your email, and if you provide them your first name and number of listings; whether you are a property manager or a host, and for a host their consent to receive our tips; the page from which you opened the demo, the referring site, the campaign or the referral link, phone or computer; a short summary of what you looked at (see The demo) | Knowing who has seen the demo, sending you a few relevant tips (one-click unsubscribe), pre-filling your sign-up | Legitimate interest (property managers); consent (hosts) | 3 years after the last demo you viewed, or until you ask for erasure; the summary is deleted as soon as you unsubscribe |
| Site chat (“Got a question?”): your messages and the AI assistant’s replies (email addresses and phone numbers written in a message are masked; passwords, cards and IBANs removed), your “helpful / not helpful” ratings, the page you wrote from and its language, phone or computer, the referring site, the campaign or the referral link, and whether an account was created from the conversation; your email only if you give it in the field provided (see The site chat) | Answering your questions about OmniStay, sending you the summary or getting back to you if you ask, improving the assistant’s answers | Legitimate interest; your request (email) | 12 months, then deleted automatically; the email you give, 3 years at most, as for the demo |
| Tip emails: what you have done in OmniStay (steps done or not yet done, bookings from the past month for “Your market”), the last link from our emails that brought you back to your sign-up, and the email or offer that led you to subscribe (see Our emails) | Writing you useful tips at the right time, knowing which emails really help | Legitimate interest | With the account; opened links are counted without a name, 25 months |
Where is the data, and who can access it?
The database is hosted in Paris. Only the people you authorise (your team, your owners, each for what concerns them) and our technical providers, for what they need, have access to it:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, login, files | Paris (EU) |
| Vercel | Hosting of the website and the application | Global network, US company |
| Stripe | Subscription payments; with the Payments add-on, your guests’ payments, into your own Stripe account | EU and United States |
| Resend | Sending emails | Sent from the EU, account in the United States |
| Platform connectivity partner | Connection to booking platforms (Airbnb, Booking.com…) | EU (hosting), UK company |
| Zernio (Spain) | WhatsApp and SMS messages to guests, if you take the add-on: the guest’s number and the text of the messages; identity check of your business for a new number | United Kingdom (London) and EU; telephone operator depending on the number’s country |
| Meta (WhatsApp) | Routing of WhatsApp messages, on your WhatsApp Business account | Worldwide (Meta Platforms Ireland for the EU) |
| Anthropic | AI assistant (if you take the add-on), help centre, site chat, analysis of anonymised questions | United States |
| Sentry | Error tracking | UE |
| PostHog | Cookie-free audience measurement of the website; in the application, only with your consent: usage measurement, session recordings (texts and fields masked) and error tracking | EU (Frankfurt, Germany), US company |
| Sign in with Google, if you choose it: Google sends us your name, email address and photo. Google Ads, only if you accept cookies on this website: measuring our ads (see Cookies) | EU (Google Ireland) and United States | |
| Meta (Facebook, Instagram) | Meta pixel, only if you accept both cookie purposes on this website: page views and the steps of your sign-up, then the start of your free month and your first payment, sent by our servers with your hashed email (see Cookies). Meta and OmniStay are joint controllers for this collection and transmission; Meta then uses this data under its own rules | EU (Meta Platforms Ireland) and United States |
| igloohome, Nuki | Smart locks, if you connect them: the code for each stay, its dates and the first name of the guest (or team member) | Singapore (igloohome), Austria (Nuki, EU) |
| PriceLabs | Dynamic pricing, if you connect it: the key you paste in PriceLabs gives it access to the calendar, prices and bookings of the chosen properties | United States |
| The tools you connect | Zapier, Make, your webhooks, an AI assistant such as ChatGPT, Claude or Gemini: only the data you choose to send them, to the address you specify | Depending on the tool chosen |
| IGN (Géoplateforme) | Address suggestions in France and its overseas territories: only the text typed into an address field is sent | France (EU) |
| French State (geo.api.gouv.fr) | Town suggestions in France and its overseas territories: only the name typed is sent | France (EU) |
| swisstopo | Address suggestions in Switzerland: only the text typed is sent | Switzerland |
| komoot (Photon, OpenStreetMap data) | Address suggestions in other countries, and places around a property for the guest guide: the text typed or the property’s location, sent by OmniStay (your IP address is not sent) | Germany (EU) |
| Overpass (OpenStreetMap data) | Places around a property, only if komoot doesn’t respond: the property’s location | Germany (EU) |
When data is processed outside the European Union, the transfer is governed by the European Commission’s standard contractual clauses or by the EU–US Data Privacy Framework. Each provider is bound by a data processing agreement. Google, Meta (for advertising), igloohome, Nuki, PriceLabs and the tools you connect yourself only receive data if you choose to use them, under their own terms.
Security
Connections are encrypted, each account only sees its own data (access rules enforced by the database itself), access is kept to the strict minimum and data is backed up every day.
Cookies
OmniStay uses what is strictly necessary to keep you logged in, remember your display preferences and, if you gave your email to see the demo, remember it (see The demo). The site chat sets no cookies (see The site chat). In the application, and only if you accept, PostHog also keeps an identifier to measure usage (see Measuring use of the application).
Advertising cookies, only with your consent. On this website, a banner asks whether you accept that Google (Google Ads) and Meta (Facebook, Instagram) set cookies for two purposes, which you can choose one by one (“Let me choose”):
- Measuring our ads: knowing which ad made you discover OmniStay, then whether you create an account or activate a subscription;
- Reminding you about us: showing you our ads later, on Google, Facebook, Instagram and their partners, rather than others at random.
The Meta pixel serves both purposes at once: it only loads if you accept both. It counts page views on this website and on the app’s sign-up pages, and the steps of your sign-up (demo opened, account created, activation screen seen, move to payment, free month started), never your clicks or the content of the pages. The start of your free month and your first payment are also sent to Meta by our servers, with your hashed (unreadable) email address and the identifiers of its cookies, to know which ads bring us clients who subscribe; these identifiers are deleted from our servers as soon as that first payment is made, and 6 months at most after your consent.
Nothing is set until you have accepted, and refusing (“No thanks”) changes nothing on the website. Your choice is kept for 6 months on your browser, for this website and the application, after which you are asked again.
| Cookie | Set by | Why | Duration |
|---|---|---|---|
| omnistay-cookies | OmniStay | Keeping your choice (all, some or none) | 6 months |
| omnistay-mesure | OmniStay, only if you untick “Count my visits on this browser” (Audience measurement) | Remembering that this browser asked not to be counted, on this website and in the app. It only keeps this privacy choice: no consent is needed | 13 months |
| omnistay-compte | OmniStay, when you are signed in to the app | Telling this website that this browser is signed in to OmniStay: it offers you “Open my account”, and your visits are not counted. It only contains “oui” (yes), with no identifier and no email address. Tied to your sign-in: no consent is needed | Until you sign out, 13 months at most |
| _gcl_au, _gcl_aw, _gcl_dc, _gcl_gb, _gcl_ls | Google (Google Ads), only if you accept | Linking your visit to the ad that brought you here, counting the accounts created and subscriptions that result, and, if you accept, showing you our ads later | 13 months at most |
| _fbp, _fbc, _fbleid | Meta (Facebook, Instagram), only if you accept both purposes | Recognising your browser and the Facebook or Instagram ad that brought you here, counting the steps of your sign-up, and showing you our ads later | 3 months after your last visit (9 months at most: your consent is asked again after 6 months) |
| fr | Meta, on its own domain (facebook.com), only if you accept both purposes and if your browser allows it (for example if you are logged in to Facebook or Instagram) | Linking your visit to your Facebook or Instagram account, for advertising | 3 months |
Changing your mind: at any time, tap “Cookies” at the bottom of every page, or the button below. If you refuse everything, the Google and Meta cookies set on this website are deleted from your browser; if you withdraw one of the two purposes, Meta’s are deleted too. The fr cookie, kept by Meta on facebook.com, can only be deleted in your browser or your Facebook account. Google uses this data under its own rules (policies.google.com), Meta under its own (facebook.com/privacy/policy); transfers outside the European Union are governed as set out above. No data is sold, and the application shows no advertising.
The demo
To see the live demo, we ask for your email address; your first name and number of listings are optional. We also keep the page from which you opened the demo, the referring site or the link campaign (for example “Instagram”) and the type of screen (phone or computer).
You also tell us whether you are a property manager or a host (a person who rents out their own properties). During the demo, OmniStay records a short summary of what you look at: the parts of the demo viewed or opened (calendar, messages, team app…), the step reached and the time spent, never a click-by-click record or the time of day. This summary stays with us (no tool from another company) and is only recorded if you can receive our emails: property manager, or host who ticked the box.
Why: knowing who has seen the demo, and sending you a few tip emails (5 at most, over two weeks) suited to what you looked at, if you haven’t created an account. They stop as soon as an account is created with the same address; we can see this, to know whether the demo was useful to you. Your email is never sold or transferred. Legal basis: for a property manager, our legitimate interest (you requested the demo for your business); for a host, your consent, given by ticking the box, never pre-ticked: without it, you receive none of these emails.
How long: 3 years after the last demo viewed with this address, after which everything is deleted automatically. The database is hosted in Paris; emails are sent through Resend (see the providers above).
Advertising: if you have accepted both cookie purposes (see Cookies), Meta counts that a demo was opened, without receiving your address.
On your device: OmniStay only keeps, in your browser’s storage (not a cookie), the fact that you have already given your email, the address itself (the demo doesn’t ask for it again and your sign-up is pre-filled) and, if you can receive our emails, the token linking the demo summary to your address. Clearing the site’s data in your browser removes them; unticking “Count my visits on this browser” (below) also stops the summary.
Your choices: to stop receiving our emails, tap “Unsubscribe” at the bottom of each one (one click is enough): your demo summary is deleted, and a host’s consent withdrawn. To have your email removed from our list, write to bonjour@omnistay.ai from that address: we delete it within one month at the latest and confirm it to you. Your other rights are detailed below.
The site chat
Added on 26 October 2026. The “Got a question?” bubble, at the bottom of every page of this site, opens a conversation with OmniStay’s assistant. It is an artificial intelligence (Claude, by Anthropic), not a person: it can make mistakes, and it cannot see any account.
What we keep: your messages and the assistant’s replies, your “helpful / not helpful” ratings, the page you wrote from and its language, the type of screen (phone or computer), the referring site, the campaign or the referral link, and whether an account was created from the conversation. Before being kept and read by the AI, email addresses and phone numbers written in a message are masked, and passwords, cards and IBANs removed. Your IP address is never kept: a fingerprint that changes every day is used only to limit abuse, and it is deleted after 2 days.
Your email, only if you give it in the field provided: to send you the summary of the conversation or to get back to you. It is added to our demo list (see The demo), with no tip emails until you have seen the demo. If you have accepted the cookies that measure our advertising, Google Ads counts that someone left their email, and so does Meta if you have accepted both purposes, without receiving the address.
Why: to answer your questions about OmniStay, and to improve the assistant’s answers (“Your messages help us improve our answers”, below the chat). The OmniStay team reads conversations to correct an inaccurate or incomplete answer; every night, the AI reads the previous day’s conversations to suggest better answers and spot questions missing from our help. Legal basis: our legitimate interest; for the email, your request.
How long: 12 months, after which the conversation is deleted automatically. No cookies: the current conversation follows your visit from page to page in your browser tab’s storage, which is cleared when you close it. It goes through our servers (database hosted in Paris) and through Anthropic for the AI’s reply (see the providers above); it is never sold or used for advertising.
Your choices: don’t write personal information in the chat. To delete a conversation, write to bonjour@omnistay.ai stating the day and the page where you had it: we delete it within one month at the latest. Your other rights are detailed below.
Our emails
After you sign up, OmniStay may write to you with tips: until your subscription is activated, then during your first days, when an important step is still missing (for example listings not yet connected), once a month with your figures compared with similar properties in your area (“Your market”, based on your bookings and public data), and every two weeks with the new features that are useful to you. They are written based on what you have done in OmniStay, at most one a day, and each has its “Unsubscribe” link (one click is enough). Important emails about your account (alerts, invoices, help replies) keep arriving.
Our emails contain no tracking pixel: we don’t know whether you open them. When you tap one of their links, it goes through OmniStay, which counts “a link opened” for that email, without your name or your address. If you then create your account or activate your subscription, we note which email (and which offer) you came from, to know which emails are useful. Legal basis: our legitimate interest.
Audience measurement
To know how many people visit this website and which pages are useful to them, every page view is counted, anonymously: the day, the page or button tapped, the site you came from (for example Google or Instagram) or the campaign indicated in the link, and whether the screen is a phone or a computer. No cookie, nothing is stored on your device, neither IP address nor identifier: we cannot recognise you from one visit to the next. These counters stay with us (database hosted in Paris) and are deleted after 25 months. In addition, PostHog (hosted in Europe) counts the pages viewed and buttons tapped on the website, the demo and sign-up, also without cookies and without storing anything on your device: your IP address is only used to compute a fingerprint that changes every day, and is then deleted. Your visit is not recorded. This measurement is exempt from consent (CNIL).
If you create an account, we keep with it where you came from (the referring site or link campaign, or the link of the property manager who recommended OmniStay to you), to know which channels bring us clients.
When unticked, the box keeps your choice on this browser, for this website and the application (“omnistay-mesure” cookie, see Cookies), and your visits are no longer counted.
Measuring use of the application
When you’re logged in to OmniStay, a card asks whether you agree to help us improve it. Nothing is measured until you say yes, and you can change your mind at any time in My account › Help improve OmniStay.
If you accept, PostHog (hosted in Europe) receives the screens and buttons you use, the errors encountered, the AI assistant’s response time (never the content of requests or answers), and a recording of your sessions showing the layout and clicks, with all texts and all fields masked: neither the names, nor the messages, nor the amounts of your guests and owners appear in it. Your account is designated by an identifier, without your name or email. Recordings are kept for 30 days, the rest for 1 year at most. Nothing is sold or used for advertising.
This measurement never exists in the application used by your guests, your team or your owners, nor in the application installed on iPhone or Android.
OmniStay mobile app (iPhone and Android)
The OmniStay app for iPhone and Android is for people who already have an OmniStay account: property managers, their teams and their owners. It shows the same data as the web version and follows the same rules: everything above also applies to it. Here is what it does in addition on your phone.
What the app uses on your phone, and when
- Notifications: only if you allow them. Your phone then gives OmniStay an identifier specific to the app, which we keep with your account to send you your alerts (new booking, cancellation, cleaning assigned…). It is deleted when you remove the device from your alerts or when you delete your account. Alerts go through Apple’s notification service (iPhone) or Google’s (Firebase Cloud Messaging, Android), which receives this identifier and the text of the alert (for example the name of the property and the guest), only to deliver it to you.
- Camera and photos: only when you tap a button to take or attach a photo (end of cleaning, condition of a property, incident, dispute). Permission is requested at that moment, not before, and only the photos you choose are sent, to your company’s private space.
- Face ID, Touch ID or fingerprint: only if you turn on unlocking in “My account”. The check is done by your phone, which only answers “yes” or “no” to the app: your biometric data never leaves your phone, and OmniStay never has access to it.
- Data kept on the phone: so you can work offline, the app keeps the day’s bookings, the calendar, cleaning jobs and photos waiting to be sent on your phone. Logging out deletes your session; deleting the app deletes the data it kept for working offline.
The app accesses neither your contacts nor your location.
No advertising, no tracking
The app contains no advertising, tracking or analytics module from another company, and this website’s audience measurement is switched off in it. We don’t track your activity in other apps or on other websites. As on the web, questions asked to the assistant are kept without names or contact details, to improve it (see the table above).
Error reports
When the app encounters an error, it sends our servers a short technical report: the error message, the screen concerned and the app version. This report contains neither your name, nor your email, nor your account identifier; it is used to spot and fix faults, and it is deleted after 30 days. If you write to the help centre or report a problem from the app, the list of the latest errors and failed server calls on your device (never the content of those calls) is attached to your request, so that we can help you.
Sign in with Google or Apple
If you choose “Continue with Google” or “Sign in with Apple”, Google or Apple only send us your name and email address (Google adds the link to your profile photo), to link you to your OmniStay account. We never receive your Google or Apple password. With Apple’s “Hide My Email” option, we receive a relay address (ending in @privaterelay.appleid.com) that forwards our emails to yours; as it doesn’t match any existing account, sign in instead with your OmniStay account’s email address. You can remove OmniStay at any time from the apps linked to your Google account or Apple ID, in their settings.
Deleting your account
You can delete your OmniStay account and erase all your data yourself, at any time: it is your right to erasure (article 17 of the GDPR).
- on app.omnistay.ai: open Settings › Danger zone, tap “Erase all my data”, then type EFFACER to confirm;
- in the app: open “My account”, tap “Delete my account” (the same steps), then type EFFACER to confirm;
- by email: write to bonjour@omnistay.ai from your account’s address. If you can log in, we tell you where to do it yourself. Otherwise, our team first checks that the account is really yours, then starts the erasure and confirms it to you by email, within one month at the latest (article 12 of the GDPR).
Immediately: your subscription stops (nothing more is charged, and the period already paid is not refunded), you are logged out of all your devices and your access is removed. If you are the only account holder of your company, its team and owners no longer have access, syncing with booking platforms and automatic messages stop, without changing anything on the platforms, and your website and your guests’ pages are taken offline.
30 days to change your mind: the permanent erasure takes place 30 days after your request, and an email gives you the date. Until then, log in again and tap “Cancel the erasure”: everything comes back as before, except the subscription, which you can resume if you wish. Before confirming, export what you want to keep (your invoices, for example): the steps offer it to you.
What is erased after 30 days, permanently: your login account (email address, password, link with Google or Apple), your access, your settings and the devices registered for your alerts. If you are the only account holder of your company, the whole company is erased with you: properties, bookings, guests, team, owners, messages, photos and documents, and its website. Your exchanges with our support team are anonymised. A final email confirms the erasure.
If you share your company with another account holder, if you are an invited manager there, if you are part of its team or if you own a property it manages, only your account and your access are deleted: the information the company holds about your work or your properties (jobs, reports, invoices) remains its own. To have it erased, contact the company (see “Who is responsible?”).
What is kept: invoices already issued by OmniStay, kept for 10 years as required by law (article L123-22 of the French Commercial Code), with our payment provider. For referrals, commissions that have already arisen (amounts, dates, invoice numbers), without your name or account identifier, for the time needed for their payment and accounting; if you still have a commission to receive, your account’s email address, only to arrange the transfer, until it is made. Deleted data also disappears from our backups, within 30 days at the latest. What cannot identify you (anonymised questions asked to the assistant, error reports without an account) and technical logs follow their own retention periods, stated above.
Your rights
You can access your data, correct it, erase it, export it, object to processing or ask for it to be restricted, by writing to contact@formationconciergerie.com. For data managed by a client company (for example as a guest), contact that company first; we will help it respond to you. You can also contact the CNIL (cnil.fr).