Privacy Policy

Information you provide

• Account details — name, email, phone number, password (stored hashed), profile photo, optional bio.
• Identity verification — government-issued ID and selfies, processed by Stripe Identity. We receive a pass/fail signal and metadata; we do not store the document images.
• Listing content — titles, descriptions, photos, amenities, addresses, calendar availability, pricing rules.
• Booking details — check-in and check-out dates, guest counts, special requests, messages between hosts and guests.
• Payment information — collected and tokenized by Stripe; we receive payment metadata (last four digits, brand, status) but not full card numbers.

Information collected automatically

• Device and connection — IP address, device model, operating system, browser, app version, language, rough geolocation derived from IP.
• Usage — pages visited, features used, search terms, click events, error logs. We use this to improve the product.
• Cookies and similar technologies. See Cookies policy for the full list.

Information from third parties

• OAuth providers — if you sign in with Google, we receive your name, email address, and profile image.
• Stripe — payment status, payout status, identity verification results.
• Mapping providers — we use map tile providers to render listing locations; tile requests carry your IP and viewport.

• Operate the Service: create and manage accounts, run search, complete bookings, process payments, deliver messages, send transactional notices.
• Trust & safety: verify identities, detect fraud, investigate policy violations, respond to user reports, support law-enforcement requests where legally required.
• Improve the product: debug, analyze usage, ship features, run experiments.
• Communicate:send transactional email and SMS related to your bookings; send product updates and marketing if you've opted in.
• Comply with law: respond to subpoenas, meet financial reporting obligations, enforce our Terms.

We don't sell personal information. We share information only as follows:

• Other users when needed for the Service. Hosts see the guest's name, profile photo, and trip details once a booking is confirmed. Guests see the host's name, profile, and listing-relevant contact information after booking.
• Service providers we rely on — Supabase (database and storage), Stripe (payments and identity), Resend (transactional email), Twilio (SMS), Sentry (error monitoring), PostHog (product analytics), and the map-tile providers for the search map. Each is bound by contract to use data only as needed to provide their service.
• Legal and safety — to comply with legal process, enforce our agreements, or protect the rights, property, and safety of our users or the public.
• Business transfers — if Wheelhouse is involved in a merger, acquisition, or sale of assets, user information may be transferred as part of the deal, with notice and consent where required.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete personal information we hold about you, subject to legal exceptions (we'll keep booking and payment records as long as required by law).
• Port your information to another service.
• Object to or limit certain processing — for example, marketing emails.
• Withdraw consent for processing that's based on consent.
• Lodge a complaint with your data-protection authority.

To exercise any of these, write to privacy@getwheelhouse.com from the email address on your account. We respond within 30 days.

• Account data — kept while your account is active and deleted within 90 days after closure, except records we must keep for tax, legal, or accounting reasons.
• Booking and payment records — kept for at least seven years to comply with financial regulations.
• Messages — retained for the life of the account and deleted on account closure (with copies kept for trust & safety, dispute resolution, and legal compliance).
• Server logs — typically 30–90 days, longer if needed for fraud or security investigations.

We use industry-standard safeguards — encryption in transit and at rest, access controls, audit logs, periodic security reviews. No system is perfect; we encourage you to use a strong, unique password and enable two-factor authentication when it becomes available. If we discover a breach affecting your data, we will notify you and the relevant authorities as required by law.

Wheelhouse is operated from the United States. If you use the Service from outside the US, your information will be transferred to and processed in the US under standard contractual clauses where required. By using the Service you understand and consent to this transfer.

The Service is not directed to children under 18. We do not knowingly collect personal information from children. If we learn we have, we'll delete it. If you believe a child has provided information, contact privacy@getwheelhouse.com.

We may update this policy. Material changes will be announced by email or in-app notice at least 30 days before they take effect.

Privacy team: privacy@getwheelhouse.com. Postal mail to our designated privacy officer is available on request.