Data processing agreement
Part of the Kleida terms of service. Last updated: 4 November 2026
1. Roles
You, the B&B, are the controller of your guests', cleaners' and staff's personal data in your Kleida. Kleida Inc. ("Kleida") is your processor. We process that data only to provide Kleida to you, and only on your documented instructions. Your use and settings of Kleida, and these terms, are those instructions.
2. What we process
| People | Data |
|---|---|
| Your guests | Name, email, phone, booking dates and party size, messages and emails, payment references (never card numbers), rental-agreement acceptance (name, time, IP address, device), check-in confirmations, ID-check results (never document images or numbers), and reviews |
| Your cleaners and staff | Name, email, phone, language, sign-in details, cleaning tasks and photos |
We keep it for as long as you keep it in Kleida. When you leave, we delete it within 60 days after your last paid month or year ends, and from backups within a further 6 weeks.
3. Our commitments
- We keep your data confidential, and only people who need access to look after Kleida have it. They are bound to confidentiality.
- We protect it with appropriate security: a separate Kleida and database for every customer, encrypted connections, hashed passwords, encrypted sensitive settings, mandatory two-step sign-in for our staff, and encrypted backups.
- We help you answer guests who use their privacy rights, such as access, correction and deletion, and with security and impact assessments where needed.
- We tell you without undue delay, and within 48 hours, if we become aware of a breach affecting your data.
- We give you the information you need to show you follow the GDPR, and answer reasonable audit questions.
- When the agreement ends, we let you download your data, then delete it, unless the law requires us to keep it.
4. Sub-processors
You authorise us to use these providers. We give you at least 30 days' notice by email before adding or replacing one, and you may object.
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean | Hosting your Kleida | Frankfurt, Germany, and Toronto, Canada |
| Cloudflare | Website delivery, spam protection, photo storage | Global; photos in Western Europe |
| Postmark (ActiveCampaign) | Sending and receiving your guest email | US |
| Telnyx | Text alerts to you and your cleaners | US |
| AI provider you choose, only if you switch the AI helper on | Summarising messages, suggesting next steps | Depends on the provider |
Some Kleidas run on our own servers in Toronto, Canada.
Stripe handles guest payments and ID checks through your own Stripe account, under your contract with Stripe, so it is not our sub-processor.
5. Transfers outside the EEA
Where a sub-processor is outside the EEA, we rely on an EU adequacy decision (such as Canada's or the EU–US Data Privacy Framework) or the EU Standard Contractual Clauses.
6. Contact
Privacy questions: hello@kleidaos.com.