Privacy Policy

• We store your email address, your property names and the calendar feeds you connect.
• From those feeds we store booking dates — arrival, departure, and whether a date is blocked. We do not store guest names, guest contact details, prices or payouts, because the feeds do not need to give us them and we do not ask for them.
• We do not sell your data and we do not share it for advertising. The cleaner page runs no trackers, no analytics and no cookies at all.
• You can delete your account and everything in it yourself, at any time, from your account page.

For your own account details — your email address, your plan, your billing record — we are the data controller.

For the booking information inside the feeds you connect, you are the controller and we act on your instructions as your processor: we display it to whoever holds the cleaner link you created, and we do nothing else with it. Deciding to share a cleaner link, and with whom, is your decision and your responsibility.

Where the law requires that arrangement to be in writing, our data processing addendum sets it out, and the subprocessors page lists every other company that can see any part of your data.

• Account data. Your email address, your encrypted password, the time you signed up and last signed in, and your plan.
• Property data. The property names you type and the calendar feed addresses you paste.
• Booking dates. Arrival and departure dates, blocked dates and same-day turnovers, read from those feeds. Some platforms put a guest’s name in the feed’s summary line. We read that line only to tell a guest booking from a blocked period, and then discard it — it is not stored and never reaches a cleaner link.
• Cleaner links. The random address of each link you generate, and when it was created or replaced.
• Billing data. On a paid plan, our payment provider holds your card details and sends us the result, your plan, and a customer reference. We never see or store your full card number.
• Technical logs. Our hosting and database providers keep short-lived records of requests, which include IP addresses, for security and troubleshooting.

We run no advertising trackers. On our public pages we count visits with Vercel Web Analytics, which sets no cookies, records no IP address and cannot identify you; we strip the query string before anything is counted, and the cleaner page is excluded entirely — the measuring scripts are not even loaded there. We set two kinds of cookie: the ones that keep you signed in, and — if you arrived through a link that says where it came from — one that holds a short label such as “cleaner-page” for thirty days, so we can see which links bring people here. It carries nothing about you. The cleaner page sets no cookies at all and needs no account.

Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you (running your account and showing your calendar); our legitimate interests (keeping the service secure, preventing abuse, and improving it); complying with legal obligations (tax and accounting records); and consent, where we ask for it, which you may withdraw at any time.

In plain words: Four suppliers, each doing one job, each under contract not to use your data for anything else.

• Supabase — the database and the login system that store your account and your calendar data.
• Vercel — hosts the website and runs the code that serves each page.
• Resend — sends the emails the service has to send you, such as password resets and account confirmations.
• Our payment provider — processes subscription payments on paid plans.

We may also disclose data if the law requires it, to protect the rights or safety of people, or as part of a reorganization, merger or sale of the business — including moving SheetDay into a separate company that we own or set up to run it. In any of those cases your data moves with your account, the company receiving it is bound by this policy, and we will tell you by email.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

SheetDay is operated from the United States and our suppliers store data on servers in the United States and the European Union. If you are in the European Economic Area, the United Kingdom or Switzerland, this means your data may be transferred outside your country. Where that happens we rely on the European Commission’s Standard Contractual Clauses, or an equivalent approved mechanism, in our agreements with those suppliers.

• Account and property data: until you delete the property or the account.
• Booking dates read from a feed: refreshed continuously and removed when the property or account is deleted.
• Deleted accounts: removed from our live database immediately, and from routine encrypted backups within 30 days.
• Billing records: kept as long as tax and accounting law requires, which is generally seven years.
• Technical logs: kept by our providers for a short period, generally no more than 30 days.

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service in a portable form. You can also complain to your data protection authority.

If you are in California, you additionally have the right to know what we collect, to delete it, to correct it, and not to be treated differently for exercising those rights. We do not sell your personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of.

The quickest route to deletion is the button on your account page. For anything else, email hello@sheetday.com. We answer within 30 days and we do not charge for it.

A cleaner does not create an account and we do not ask them for anything. Opening a cleaner link stores no cookie and creates no profile. The page shows dates and property names, and nothing about the guests themselves.

A host who shares such a link is responsible for doing so fairly under the law that applies to them. Every cleaner page carries a short notice saying who the page is from and how to ask for it to stop.

Traffic runs over HTTPS. Passwords are hashed by our login provider and never visible to us. Access to the database is restricted at the row level so one host cannot read another host’s data. Cleaner links use long random addresses that cannot reasonably be guessed, and you can replace one at any time.

No service can promise perfect security. If a breach ever affects your data we will tell you and the relevant authority without undue delay, and within 72 hours where the law requires it.

SheetDay is for business use by adults. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to us and we will remove it.

If we change this policy in a way that matters to you, we will email you or show a notice in the product before the change takes effect. The date at the top always shows the current version.

Email hello@sheetday.com. By post: