Privacy policy
Last updated: 4 November 2026
The short version
- We collect only what we need to run your Kleida and help you set it up.
- We never sell your data, and this website uses no tracking or advertising cookies.
- Your guests' details belong to you. We look after them on your behalf, under our data processing agreement.
- You can ask us for a copy of your data, or to correct or delete it, at any time.
Who we are
Kleida is provided by Kleida Inc., a Canadian company. For anything about privacy, email hello@kleidaos.com.
We are the controller for information about our customers (B&B owners and their staff) and visitors to kleidaos.com. For information about your guests, we are your processor. You decide how it is used, and we handle it only on your instructions.
What we collect about you
| What | Why | Legal basis |
|---|---|---|
| Name, email address and password (stored as a secure hash) | To create and secure your account | Contract |
| Mobile number | To confirm it's really you, call you for your setup, and send booking text alerts if you want them | Contract; your choice for alerts |
| Business name, country, time zone, currency and web address | To set up your Kleida | Contract |
| Billing details: card, billing address, VAT number | To charge your subscription. Your plan is sold through Link, Stripe's checkout, which collects these on its own secure pages. We never see your card number. | Contract; legal obligation (tax records) |
| Support messages | To help you | Contract |
| Security records (sign-ins and important account changes) | To keep accounts safe and investigate problems | Legitimate interest |
We don't use your data for advertising, and we don't make automated decisions about you.
Your guests' information
Your Kleida stores what you need to run your B&B: guest names, contact details, booking dates, messages, payments, agreement acceptances and check-in details. You are responsible for telling your guests how you use their information, for example in your own privacy notice.
Guest ID checks: these are carried out by Stripe Identity through your own Stripe account. Your Kleida keeps only the result, such as "verified", the document's country and type, and an age check. It never keeps copies of ID documents, photos, document numbers or dates of birth.
Card payments: these go through your own Stripe account. Kleida stores payment references, never card numbers.
The optional AI helper
The AI helper is off unless you switch it on. If you do, guest messages and booking details are sent to the AI provider you choose (for example OpenAI) so it can summarise them and suggest next steps. You can switch it off at any time.
Who helps us run Kleida
We use these trusted providers, each bound by a contract to protect your data:
| Provider | What for | Where |
|---|---|---|
| DigitalOcean | Servers that run Kleida and your own Kleida | Frankfurt, Germany; our account service runs in Toronto, Canada |
| Cloudflare | Website delivery, protection against attacks and spam, and storage for your property photos | Global network; photo storage in Western Europe |
| Stripe | Subscription billing (through Link, Stripe's checkout), plus your own guest payments and ID checks | EU and US |
| Postmark | Sending and receiving email for Kleida and your guests | US |
| Telnyx | Text messages: sign-up codes and booking alerts | US |
| Your chosen AI provider (only if you switch it on) | The optional AI helper | Depends on the provider, e.g. US |
Some Kleidas run on our own servers in Toronto, Canada.
The public pages of your B&B website can show an OpenStreetMap map and use Cloudflare's spam check on forms.
International transfers
Some providers are outside the European Economic Area. Canada is recognised by the EU as offering adequate protection. For the United States, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the EU's Standard Contractual Clauses.
How long we keep data
- Account and business details: for as long as you're a customer, then up to 60 days after you leave.
- Invoices and billing records: 6 years after the end of the tax year, as Canadian tax law requires.
- Email message contents in our mail system: deleted within 24 hours of delivery to your Kleida.
- Security records: 180 days. Sign-in sessions: up to 7 days.
- Your guests' information: for as long as you keep it in your Kleida. When you leave, we delete it within 60 days after your last paid month or year ends.
- Backups: kept encrypted for up to 6 weeks, then deleted.
Cookies
This website (kleidaos.com) uses no cookies and no tracking. Your Kleida account and your Kleida use one essential cookie to keep you signed in. Your B&B website counts visits without cookies and without storing anyone's IP address.
Keeping data safe
Every B&B gets its own private Kleida with its own database, so your data is never mixed with another business's. Connections are encrypted (HTTPS), passwords are stored as secure hashes, sensitive settings are encrypted, staff accounts need two-step sign-in, and backups are encrypted.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or send it to another service. You can also object to how we use it. Email hello@kleidaos.com and we'll reply within one month. You can also complain to the data protection authority in your country. In Canada, that is the Office of the Privacy Commissioner.
If you are a guest of a B&B that uses Kleida, please contact the B&B first. They decide how your information is used, and we'll help them answer you.
Changes
If we make important changes, we'll tell customers by email before they take effect.