Privacy policy

This policy explains what personal data BNB Suite™ handles, why, who helps us process it, how long we keep it and what rights you have. We wrote it in plain language. If something is unclear, write to help@mybnbsuite.com.

Who we are and our role

BNB Suite™ is software for short-term rental professionals: property managers, conciergeries and hosts. It is operated by Kensho Visual (NIF 73008219D), Calle de Juslibol 34, Zaragoza, Spain ("BNB Suite", "we", "us").

Because we are established in Spain, the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD) apply to our processing. When data concerns people in Morocco, we also follow Moroccan law 09-08.

We play two different roles, depending on whose data it is:

• We are the controller for the data of people who visit our website, create an account, contact us, order a service, apply to our affiliate program or send us a job application. We decide why and how that data is used.
• We are a processor (in Moroccan law, a sous-traitant) for the data an agency or host puts in BNB Suite about its guests, owners, team, suppliers and bookings. The agency is the controller: it decides what to collect and why, and it answers its guests' and owners' questions first. We only process that data on its instructions, as set out in our terms of service.

If you are a guest or an owner and you have a question about your data, please contact the agency that manages your stay or your property first. We will help them answer.

What we collect

When you visit mybnbsuite.com

Nothing is stored in your browser and there are no trackers. Like any website, our hosting provider records technical logs (IP address, browser, pages requested, time) to deliver the site and keep it secure.

When you contact us or apply

• Support, sales and services: what you write to us by e-mail or WhatsApp, with your name, e-mail address or phone number.
• Affiliate program form: full name, e-mail, phone or WhatsApp (optional), your profile, city and country (optional), website or social profile (optional) and how you would share BNB Suite. To limit spam we keep a one-way, salted fingerprint of your IP address, never the address itself.
• Job applications: what you send to careers@mybnbsuite.com, such as your CV and links.

When you use the app (account holders)

• Account: name, e-mail address, password (stored encrypted by our authentication provider, never readable by us), phone number, profile photo, language, role in the workspace and, if you connect it, your Telegram chat identifier for alerts. If you sign in with Google, we receive your name and e-mail address from Google.
• Workspace: agency name, city, contact details, logo and colours, CNDP declaration number, subscription plan and usage counters (for example, how many AI answers were used this month).

Data agencies manage in BNB Suite (we process it for them)

• Guests: name, number of guests, stay dates, booking code and amounts, the last digits of a phone number when a platform provides them, messages and requests sent from the guidebook or the guest portal, extras ordered, direct booking requests, and the house rules they sign (name, date and the text signed).
• Police forms (fiches de police): last and first name, sex, date and place of birth, nationality, profession, address, country of residence, identity document type, number, date and place of issue, date of entry to Morocco, where the guest comes from and goes to, arrival and departure dates, number of minors, e-mail and phone, consent date and typed signature. Optionally, and only if the agency turns it on, a photo of the identity document and a selfie.
• Owners: name, e-mail, phone, notes, the properties they own, stays, expenses, payments and receipts, statements and the management contract they sign (name, date, device information and the text signed).
• Team members and suppliers: name, phone, e-mail, trade, rating and the tasks, inspections and photos linked to their work.
• Booking e-mails: if the agency forwards Airbnb or Booking.com e-mails to its BNB Suite address, the content of those e-mails (sender, subject, text) and the details we extract from them.
• Conversations with the guest assistant on the guidebook, on Telegram or (when available) on WhatsApp, with the Telegram chat identifier or WhatsApp number used.

We do not collect bank card numbers or bank account details. BNB Suite does not take payments from guests.

Why we use it

We never use personal data for advertising, never sell it and never rent it.

Guests, police forms and ID photos

In Morocco, accommodation providers must register their guests with the police or the gendarmerie. BNB Suite helps agencies do this: guests fill in their form online before arrival, and the agency prints it (French and Arabic) or copies it into STDN, the DGSN platform. BNB Suite does not send anything to the authorities itself: there is no public connection to STDN, and the agency stays in charge of the declaration.

• The guest is shown a notice under law 09-08 before sending the form: who is responsible (the agency), why (declaring guests to the authorities, nothing else), who receives it, how long it is kept and how to exercise their rights, with the agency's CNDP declaration number when it has entered one.
• Retention: each form is kept for the period the agency sets, never less than 365 days after departure (law 80-14, article 38) and never more than five years, then deleted automatically every night.
• Passport reading: when a guest scans the machine-readable zone of their passport, the photo is read on their phone. The image is not uploaded for this; only the fields the guest confirms are sent.
• ID photos and selfies are optional and off by default. When an agency turns them on, files are stored in a private space that only that agency's team can open, through links that expire after one hour. They are deleted automatically on the same date as the form.
• Each morning at 7 a.m., if the agency turns it on, the day's register is e-mailed to the agency as a file, so it can complete STDN.

Artificial intelligence

Some features use Claude, a model provided by Anthropic, through its commercial API. Under those terms Anthropic does not use this data to train its models. The features and what they send:

• Guidebook translation and "Complete with AI": the text of the guidebook.
• Guest assistant (guidebook, Telegram and, when available, WhatsApp): the guest's message, the recent conversation and the guidebook. When it doesn't know, it passes the question to the agency. It never replaces emergency services.
• Agency assistant (Pro plan and trial): a summary of the agency's figures prepared by the app, which can include property and owner names, guest names for upcoming arrivals and guest requests.
• Booking e-mails: the subject and text of forwarded Airbnb or Booking.com e-mails, to read the guest name, dates and amounts.

AI answers can be wrong. The agency should check anything important before relying on it. Usage is capped every month; above the cap, the guest assistant answers by searching the guidebook without AI.

Who we share it with

We use a small number of providers ("sub-processors") to run BNB Suite. They only receive what they need for their task and act on our instructions.

BNB Suite also reads the calendar links (iCal) an agency adds from Airbnb, Booking.com or other sites, and opens WhatsApp, Google Maps or Telegram when you tap a link to them. Those services then apply their own privacy policies.

We may also disclose data when the law requires it, to answer a valid request from a court or authority, or to protect the rights and safety of our users. If BNB Suite is sold or merged, data would move to the new operator under the same commitments, and we would tell you first.

International transfers

We are based in Spain and our main database is in the European Union (Paris). Data collected in Morocco, for example police forms filled in by guests, is therefore transferred to the EU, which the CNDP recognises as offering an adequate level of protection.

Some providers listed above are based in, or may access data from, the United States and other countries outside the EU. We only use them where it is necessary to provide the service, and each transfer is covered by an appropriate safeguard under the GDPR: the provider's certification under the EU-U.S. Data Privacy Framework, or the European Commission's standard contractual clauses. You can ask us for a copy of the relevant safeguards.

How long we keep it

How we protect it

• Every agency's data is separated at database level: each request is checked against the workspace and the role of the person asking (admin, manager, field team, owner). A field team member, for example, never sees amounts.
• All traffic is encrypted (HTTPS). Passwords are never stored in readable form.
• Documents, receipts and ID photos are kept in private storage and opened through links that expire after one hour.
• Public pages (guidebook, guest portal, booking page, supplier page) only work with a long, secret link, and only show what that page needs. Public forms are limited per hour against abuse.
• Keys to external services are kept in an encrypted vault, not in the code.

No system is perfectly secure. If a breach affects your data, we will inform the agencies concerned and, where the law requires it, the authorities, without undue delay.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time when we rely on it. Moroccan law 09-08 gives people in Morocco the rights to be informed, to access, to correct and to object for legitimate reasons.

• Account holders and people who contacted us: write to help@mybnbsuite.com. We answer within 30 days. We may ask you to confirm your identity. You can also export most of your workspace data yourself (CSV and PDF) from the app.
• Guests and owners: contact the agency that manages your stay or property; it is responsible for your data and we help it answer. If you can't reach it, write to us and we will pass your request on.

You can complain to the Spanish data protection authority, the AEPD (aepd.es), to the data protection authority of the EU country where you live, or, in Morocco, to the CNDP (cndp.ma).

Children

BNB Suite is made for professionals and is not intended for anyone under 18. Guest police forms only record how many minors are in a group (under 15, and 15 to 18), as the authorities require; minors are registered by the adult responsible for them.

Features coming soon

Changes to this policy

We will update this policy when the service changes. For important changes, such as a new type of data or a new provider for existing data, we will tell account holders in the app or by e-mail before they take effect.

Contact

Controller: Kensho Visual (NIF 73008219D), Calle de Juslibol 34, Zaragoza, Spain.

E-mail: help@mybnbsuite.com · WhatsApp: +212 7 77 46 54 37

Lead supervisory authority: Agencia Española de Protección de Datos (AEPD), aepd.es.