Privacy Policy

1.1 Account Information. When you create an account, we collect your name, email address, and password. If you sign in through Google, we receive your name and email address from Google.

1.2 Builder & Host Profiles. If you register as a builder, distributor, or TinyHomey host, we collect your company name, business type, business description, location (city and state), phone number, website URL, and any images you upload (such as logos or property photos).

1.3 Buyer Profiles. If you complete our Buyer Quiz, we collect your responses including intended usage type, grid preference, budget range, location preference, and desired features. We use this data to generate personalized recommendations using artificial intelligence.

1.4 Listing Content. Builders and hosts who create listings provide property details including title, description, price, specifications (square footage, bedrooms, bathrooms), location, images, features, and home type. This information is displayed publicly.

1.5 Communications. When you submit a contact inquiry, booking request, or message through the Platform, we collect your name, email address, phone number (if provided), and message content.

1.6 Reviews. If you leave a review, we collect your name, star rating, comment text, and the builder or host being reviewed.

1.7 Newsletter & Email Subscriptions. If you subscribe to our newsletter, we collect your email address and the source of the subscription.

1.8 Payment Information. Payment transactions are processed entirely by Stripe, Inc. We do not collect, store, or have access to your credit card number, bank account information, or other financial payment instruments. We receive only a transaction reference and the subscription tier selected.

1.9 Automatically Collected Information. We automatically collect certain usage information, including listing view counts (tracked per session to avoid duplication) and UI preferences (such as sidebar display state). We use session storage and a small cookie for these purposes.

1.10 Booking Data. If you make or receive a booking through TinyHomey, we collect guest names, email addresses, check-in and check-out dates, number of guests, total price, special requests, and booking status.

We use the information we collect for the following purposes:

• Platform Operations: To operate, maintain, and improve the Platform, including facilitating connections between buyers, builders, and hosts.
• Account Management: To create and manage your account, verify your identity, and provide customer support.
• Communications: To deliver messages between users, send booking confirmations, and provide in-app notifications regarding inquiries, reviews, and booking updates.
• AI-Powered Features: To provide AI-assisted services including listing description generation, pricing suggestions, buyer recommendations, review moderation, search query interpretation, builder profile scoring, and our AI chatbot assistant ("Homie"). These features process relevant Platform data through OpenAI's API. See Section 4 for details.
• Builder Verification: To evaluate and verify builder accounts for trust and safety.
• Marketing: To send newsletters and product updates to subscribers who have opted in. You may unsubscribe at any time by contacting us at hello@tinyhomies.com.
• Analytics: To understand how users interact with the Platform and to improve our services.
• Safety & Compliance: To detect spam, prevent fraud, enforce our Terms of Service, and comply with legal obligations.

3.1 Public Listings & Profiles. Listing details, builder profiles, host profiles, and reviews are publicly visible on the Platform. Your company name, location, description, and uploaded images are displayed to all visitors.

3.2 Between Users. When you submit a contact inquiry, your name, email, phone number (if provided), and message are shared with the relevant builder or host. When a booking is made, guest and host information is shared between the parties to facilitate the reservation.

3.3 Service Providers. We share information with third-party service providers who assist in operating the Platform, as described in Section 4.

3.4 Legal Requirements. We may disclose your information if required to do so by law, in response to a subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

3.5 Business Transfers. In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform of any such change in ownership or control.

3.6 With Your Consent. We may share your information for other purposes with your express consent.

The Platform integrates with the following third-party services. Each provider has its own privacy policy governing their collection and use of data:

• Supabase (Supabase, Inc.): We use Supabase for authentication, database hosting, file storage, and real-time data delivery. All account data, listings, messages, and uploaded files are stored on Supabase infrastructure. Supabase Privacy Policy
• Google OAuth (Google LLC): If you choose to sign in with Google, your name and email address are provided to us by Google's authentication service. Google Privacy Policy
• OpenAI (OpenAI, OpCo, LLC): We use OpenAI's API to power AI features on the Platform. Data sent to OpenAI may include listing details, review text, search queries, quiz responses, and conversation messages with our AI chatbot. We do not send passwords, payment information, or government identification to OpenAI. OpenAI processes this data pursuant to their API data usage policy, which states that API inputs and outputs are not used to train their models. OpenAI Privacy Policy
• Stripe (Stripe, Inc.): Payment processing for builder subscriptions is handled entirely by Stripe. We do not receive or store payment card data. Stripe Privacy Policy
• Pexels (Canva Pty Ltd): We use the Pexels API to source stock photography for the Platform. No personal user data is sent to Pexels.

The Platform uses limited browser storage mechanisms:

• Session Storage: Used to track listing view counts within a single browser session to prevent duplicate counting. This data is automatically cleared when you close your browser tab.
• Cookie (Sidebar Preference): A small cookie stores your sidebar display preference. This cookie does not contain personal information.
• Authentication Tokens: Supabase stores authentication tokens in your browser's local storage to maintain your login session. These are encrypted JWT tokens.

We do not use third-party tracking cookies, advertising cookies, or analytics cookies.

We retain your personal information for as long as your account is active or as needed to provide you services. Specifically:

• Account Data: Retained until you delete your account.
• Listings & Profiles: Retained until deleted by the account holder or upon account deletion.
• Messages & Inquiries: Retained for the duration of your account to maintain conversation history.
• Reviews: Retained indefinitely as part of the public record, unless removed for policy violations.
• Newsletter Subscriptions: Retained until you unsubscribe.
• Booking Records: Retained for a minimum of three (3) years after the booking date for record-keeping and dispute resolution purposes.

We may retain certain information as required by law or for legitimate business purposes (such as resolving disputes or enforcing our agreements).

We implement reasonable technical and organizational measures to protect your personal information, including:

• Encryption of data in transit via HTTPS/TLS.
• Password hashing through Supabase's authentication system.
• Row-level security (RLS) policies on our database ensuring users can only access their own data.
• Secure API endpoints with token-based authentication.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

Depending on your location, you may have the following rights regarding your personal information:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may update or correct inaccurate information through your account settings or by contacting us.
• Deletion: You may request deletion of your account and personal information by contacting us at hello@tinyhomies.com. Note that some information may be retained as required by law or for legitimate business purposes.
• Opt-Out of Marketing: You may unsubscribe from marketing communications at any time by contacting us at hello@tinyhomies.com.
• Data Portability: You may request a machine-readable copy of your personal data by contacting us.

To exercise any of these rights, please contact us using the information in Section 13.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information is collected, used, shared, or sold.
• The right to delete personal information held by us and by our service providers.
• The right to opt out of the sale of personal information. We do not sell your personal information.
• The right to non-discrimination for exercising your CCPA rights.

To submit a CCPA request, contact us at hello@tinyhomies.com or call +1 (385) 446-9445.

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 18, please contact us at hello@tinyhomies.com.

The Platform is operated from the United States. If you are accessing the Platform from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located and our central database is operated. The data protection laws of the United States may differ from those of your jurisdiction. By using the Platform, you consent to the transfer of your information to the United States.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Effective date" at the top. For material changes, we will provide notice through the Platform or via email. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: