Privacy Policy — VeykHostAgent (Beta)

Status: DRAFT v3 — Cowork-drafted 2026-04-11, revised 2026-04-11 late evening (v2: subprocessor list, legal entity, privacy contact), revised 2026-04-12 (v3: aligned with Terms of Service ownership model rewrite — "Your Content" unified concept replaced with "Your Materials" / "Generated Output" split per Admiral directive 2026-04-12. Your Materials = user-owned inputs; Generated Output = Daystrom-owned, licensed to user during active subscription. See TERMS-OF-SERVICE-DRAFT.md for the authoritative ownership language). Effective date: [TO BE FILLED ON MERGE — use the ship date of the Option D CODE-PROMPT] Last updated: [TO BE FILLED ON MERGE] Version: Beta 1.0

About this policy

VeykHostAgent is a private beta product operated by Daystrom Inc. ("we," "our," or "us"), a company incorporated in Canada. Daystrom Inc. is the parent entity that holds the core technology and licenses it to VeykHostAgent for the vacation rental vertical. This policy explains what personal information we collect when you use VeykHostAgent at veykhostagent.ai or the VeykHostAgent builder at veykhostagent.ai/builder, why we collect it, how we use and protect it, who we share it with, and what rights you have over it.

VeykHostAgent is a software tool that helps vacation rental hosts create marketing websites for their properties. VeykHostAgent does not accept guest bookings, process reservations, integrate with property management systems or channel managers, or handle any payment data for guest stays. Nothing in this policy should be read to cover booking or reservation processing, because we do not do any of those things.

Because VeykHostAgent is currently in private beta, this policy is a beta policy. Features, data flows, subprocessors, and retention periods may change during beta. When they change materially, we will update the "Last updated" date at the top of this page and, where the changes affect information you have already given us, notify you by email.

Definitions used in this policy

This policy uses two terms that are defined in detail in our Terms of Service and summarized here for convenience:

  • "Your Materials" means everything you provide to us: photos, voice recordings, property descriptions, text input, amenity lists, pricing information, and any other information you supply to the builder. You own Your Materials at all times.
  • "Generated Output" means everything VeykHostAgent produces using Your Materials: the HTML, CSS, written copy, design selections, page layouts, visual arrangements, and any other website content created by our AI systems for your property. Generated Output is the intellectual property of Daystrom Inc. and is licensed to you for use while your subscription is active. See the Terms of Service for the full ownership and licensing terms.

What personal information we collect

We collect only what we need to operate the beta and to provide the service you asked for. Specifically:

Your Materials (information you give us directly):

  • Your email address when you join the early-access waitlist
  • Your email address and optional display name when you create an account and sign in
  • Information you type, speak, or upload into the VeykHostAgent builder — this includes property descriptions, location, amenities, pricing details you choose to include, photos you upload, and anything you say or type while talking to the Casey assistant. All of this is "Your Materials" as defined above.
  • Feedback, bug reports, or support messages you send us

Information we collect automatically when you use the service:

  • Session and authentication cookies required to keep you signed in
  • Product usage events — which features you use, which builder phase you are in, which designs you pick, error messages you see — used to improve the product and debug issues
  • Technical information about your browser and device (browser type and version, operating system, screen size, IP address, approximate location derived from IP, referrer URL) collected by our analytics subprocessor
  • Logs generated by our hosting and database infrastructure for operational and security purposes

Information we do not collect:

  • We do not collect payment card numbers, bank account details, or government-issued identifiers
  • We do not collect guest reservations, booking data, or calendar availability
  • We do not collect information about your guests
  • We do not purchase, rent, or otherwise acquire personal information about you from data brokers

Why we collect it and what we do with it

We use the information above to:

  • Operate the beta waitlist and send you an invite when a spot opens
  • Authenticate you when you sign in
  • Run the VeykHostAgent builder on your behalf, including passing Your Materials (property descriptions, photos, voice and text input) to the AI models that produce the Generated Output
  • Host and serve the Generated Output so you can preview your website and, once deployed, so your guests and prospective guests can view it
  • Remember your builder sessions so you can resume where you left off
  • Understand how the product is being used so we can fix bugs, improve features, and decide what to work on next
  • Respond to your support questions and feedback
  • Send you occasional updates about the beta — new features, planned downtime, beta-ending notice. You can opt out of these updates at any time by replying to any beta email or by contacting us at the address below.
  • Protect the service, our users, and ourselves from abuse, fraud, and security threats
  • Comply with applicable law, respond to lawful requests, and enforce our Terms of Service

We do not use your personal information to train general-purpose AI models. Your Materials are sent to AI providers (see "Subprocessors" below) only to produce the Generated Output for your property, and we do not authorize those providers to retain Your Materials for their own training.

Legal bases (for users in the EU, UK, and EEA)

Where the General Data Protection Regulation (GDPR) or UK GDPR applies, we rely on the following legal bases:

  • Performance of a contract when you ask us to run the builder, generate a website, or host a site you deployed
  • Consent when you join the waitlist, opt into beta email updates, or allow analytics cookies
  • Legitimate interests when we operate product analytics to improve the service, protect the service from abuse, or send you service-related communications that are not marketing
  • Legal obligation when we need to respond to lawful requests or preserve records for compliance

You may withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing that happened before you withdrew.

Subprocessors and who we share information with

We share your information only with the service providers and subprocessors that help us operate VeykHostAgent, and only to the extent needed for them to provide their service to us. We do not sell, rent, or trade your personal information. We do not share your information with advertisers.

Our subprocessors during beta are:

  • Supabase, Inc. — database, authentication, and file storage. Stores your account, waitlist entry, builder sessions, and uploaded photos. US-hosted.
  • Vercel, Inc. — hosting and content delivery for the VeykHostAgent website, the builder, and any sites you deploy through the builder. US-hosted.
  • PostHog, Inc. — product analytics. Collects product usage events and technical information about your browser and device. Configured to mask all form inputs so your typed content is not captured. US-hosted.
  • Upstash, Inc. — rate-limit and request-throttling storage. Receives your IP address and endpoint identifiers to prevent abuse of our API routes. Does not store personal content. US/EU-hosted.
  • Anthropic, PBC — AI model provider for parts of the builder pipeline (primary site generation, design, review). Receives your property description, voice transcripts, uploaded photos, and conversational input only to generate your output. US-hosted. Contractually prohibited from retaining inputs for general model training.
  • OpenAI, L.L.C. — AI model provider for parts of the builder pipeline (ensemble ideation). Same scope and same retention prohibition as Anthropic. US-hosted.
  • Google LLC (Gemini API) — AI model provider for parts of the builder pipeline (ensemble ideation). Same scope and same retention prohibition as Anthropic. US-hosted.
  • xAI Corp (Grok API) — AI model provider for parts of the builder pipeline (ensemble ideation). Same scope and same retention prohibition as Anthropic. US-hosted.
  • Deepgram, Inc. — voice-to-text transcription. Receives the audio stream from your microphone only while you are using the voice-input feature in the builder, and returns a transcript. Audio is not stored by us after transcription. US-hosted.
  • ElevenLabs, Inc. — text-to-speech synthesis. Receives the text that the Casey voice assistant speaks to you, and returns audio. Does not receive your microphone input. US-hosted.

Transactional email provider: We do not currently use a third-party transactional email service. During beta, invite emails are sent manually from the Daystrom Inc. operator mailbox (federation@landcgreen.ca). When we adopt a transactional email provider (likely Resend, Postmark, or AWS SES — not yet decided), we will update this list before switching and notify waitlist and beta users by email.

If we add, remove, or change subprocessors during beta, we will update this list and update the "Last updated" date at the top of this page.

We may also share your information in these limited situations:

  • To comply with law — when we reasonably believe disclosure is required by a court order, subpoena, search warrant, or other lawful request
  • To protect rights and safety — when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, to investigate fraud, or to respond to a security incident
  • In a business transfer — if we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of the transaction, subject to the receiving party's commitment to honor this policy

International data transfers

VeykHostAgent is operated by Daystrom Inc., a Canadian company. Our subprocessors are primarily US-based, with some EU-hosted infrastructure at Upstash. When you use VeykHostAgent from outside the US, your information will be transferred to, stored in, and processed in the US and other countries where our subprocessors operate. These countries may have data protection laws that differ from the laws of your country.

Where required by law (for example, for EU or UK users), we rely on appropriate transfer mechanisms — such as the EU Standard Contractual Clauses — to safeguard your information during transfer.

How long we keep your information

We keep your information only as long as we need it for the purposes described in this policy or as required by law.

  • Waitlist entries: kept until you are invited to beta and either accept or decline, or until we close beta — whichever comes first. You may ask us to delete your waitlist entry at any time.
  • Account data: kept for as long as your account is active, plus up to 90 days after you delete your account, to allow for account recovery and backup expiry.
  • Your Materials (builder sessions, uploaded photos, text, voice input): kept for as long as your account is active, plus up to 30 days after cancellation or termination to allow you to request a copy (see the Terms of Service for the retrieval window).
  • Generated Output (websites, designs, copy): kept for as long as your subscription is active. Generated Output remains hosted while your subscription is in good standing. If your subscription ends, Generated Output is taken offline within 30 days and may be deleted after the wind-down period described in the Terms of Service. Generated Output is the intellectual property of Daystrom Inc.; retention and deletion are at our discretion after your subscription ends.
  • Analytics events: kept in aggregated form for up to 24 months. Individual events tied to your account are purged when you delete your account.
  • Support messages and bug reports: kept for up to 24 months after the issue is resolved.
  • Logs: operational and security logs are kept for up to 90 days.

When beta ends, we will notify users in advance of any bulk deletion or migration and give you an opportunity to retrieve Your Materials. Generated Output will transition to the post-beta terms announced at that time.

Your rights

Depending on where you live, you may have the following rights over your personal information. We honor these rights regardless of where you live, subject to reasonable verification.

  • Access — ask what personal information we hold about you and get a copy
  • Correction — ask us to correct information that is inaccurate or incomplete
  • Deletion — ask us to delete your personal information (note: deletion of Your Materials does not require deletion of Generated Output, which is Daystrom's intellectual property; however, we will delete Generated Output associated with a deleted account after the wind-down period described in the Terms of Service)
  • Export / portability — ask us to provide Your Materials (photos, text, property information, and other inputs you provided) in a machine-readable format. Export of Generated Output (websites, designs, copy produced by our AI systems) is not included in the portability right because Generated Output is Daystrom's intellectual property, not your personal data. See the Terms of Service for the full ownership terms.
  • Restriction / objection — ask us to stop or limit how we use your information, or object to certain processing
  • Withdraw consent — withdraw consent where we relied on it to process your information
  • Lodge a complaint — file a complaint with your local data protection authority if you believe we are mishandling your information

To exercise any of these rights, contact us at the address below. We will respond within 30 days (or sooner where required by law) and may ask for information to verify your identity before acting on your request.

For users in California: The rights above satisfy the access, deletion, correction, and opt-out requirements of the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). We do not sell your personal information and we do not share it for cross-context behavioral advertising. You may designate an authorized agent to exercise these rights on your behalf.

For users in Canada: This policy is written to satisfy our obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. You may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca if you believe we are not handling your information properly.

For users in the EU, UK, and EEA: The rights above satisfy our obligations under GDPR and UK GDPR. If you believe we are mishandling your information, you may lodge a complaint with your local supervisory authority.

Security

We take reasonable technical and organizational measures to protect your information from loss, misuse, unauthorized access, disclosure, alteration, and destruction. These include encryption of data in transit and at rest, access controls, audit logging, and regular security review of our subprocessors. No system is perfectly secure, and we cannot guarantee absolute security. If we discover a security incident affecting your information, we will notify you and applicable regulators as required by law.

Children

VeykHostAgent is not directed to children under 16 and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

Cookies and similar technologies

We use cookies and similar technologies for three purposes only:

  • Authentication — keeping you signed in after you log in. Required for the service to work.
  • Preferences — remembering your theme selection (light/dark) and similar UI preferences.
  • Analytics — measuring how the product is used, via PostHog. Configured to mask all form inputs.

We do not use advertising cookies, do not share cookie data with third-party ad networks, and do not operate any cross-site tracking. You can disable non-essential cookies in your browser; doing so may affect some product features but will not prevent you from signing in or using the builder.

Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes — especially changes that affect information we have already collected — we will also notify you by email if we have your address on file, or by a prominent notice on the site.

How to contact us

For any question about this policy, to exercise any of the rights above, or to report a privacy concern, contact us at:

Email: federation@landcgreen.ca Mailing address: [DAYSTROM INC. MAILING ADDRESS — to be filled by Admiral before merge. Minimum required: street or PO box, city, province, postal code, Canada.]

If you do not receive a response within 30 days, or if you are not satisfied with our response, you may escalate the matter to your local data protection authority.