Relaxtay Security – Privacy Policy

Effective date: November 5, 2026

Relaxtay Security (the “App”, at https://security.relaxtay.com and in the Android/iOS apps) lets authorized Relaxtay staff watch the outdoor security cameras and manage the smart door locks of the vacation rental homes Relaxtay manages. It is operated by RELAXTAY INC (“Relaxtay”, “we”, “us”) in the United States. It is for authorized staff only.

Information we collect

• Staff accounts: email address, name, role; Google name/email if you use Google sign-in. Passwords are stored only as a salted one-way hash; two-step sign-in secret. An audit log of sign-ins and actions.
• Camera data from Relaxtay's Ring camera account: near-live snapshots and a picture per camera event (motion, doorbell, person, vehicle, package, animal), with the event labels Ring reports. Live video streams directly between your device and Ring and is not stored by us. Cameras marked indoor are hidden and never captured by the App.
• Face recognition (optional, switched on per home by Relaxtay): runs only on Relaxtay's server. It stores a numeric face code and small face pictures per sighting, plus names/roles staff assign (e.g. cleaner, maintenance, owner). Unnamed faces and guest faces are deleted automatically after a set number of days (30 by default).
• Smart lock data from Relaxtay's Schlage account: locks, access codes and their names, and lock activity (which code opened which door, when).
• Guest stay information (read-only from Relaxtay's property management system via the Guidebook): stay dates and times, guest first name, guest count, booking channel and the last digits of the guest's phone number used for door codes.
• Alert settings and contacts: your notification choices, the mobile number and email you choose for alerts, push subscriptions, and alert contacts (name, email, role) added by admins.
• We do not collect your device's contacts, location or advertising IDs.

How we use it

We use this information only to run the App for Relaxtay's team. We do not sell personal information, we do not show ads, we do not use advertising IDs, analytics or tracking SDKs, and we do not use the data to train AI models.

Sharing and service providers

• Ring (camera provider) and Schlage (lock provider): the App reads from and sends commands to Relaxtay's own accounts with them. Ring traffic passes through Cloudflare's network.
• Telebroad (phone carrier) to send alert text messages to staff who turn texts on; email delivery (Relaxtay's mail server/provider) for sign-in and alert emails (door codes are never included).
• Push services (Google Firebase Cloud Messaging, Apple, or your browser's push service).
• Google for Google sign-in.
• Relaxtay's own Guidebook and My Tasks apps (stay dates and cleaning times).
• Face recognition and camera pictures are processed only on Relaxtay's server and are not sent to any AI or outside service. Otherwise we share data only when required by law.

Storage and security

All traffic to and from the App uses encrypted HTTPS connections only (plain HTTP requests are redirected to HTTPS). Data is stored on Relaxtay's own server in an encrypted database; passwords are stored only as salted one-way hashes, and keys for connected services are stored encrypted. Access is limited to authorized Relaxtay staff, with optional two-step sign-in.

Retention

Camera event pictures are kept for the number of days set by Relaxtay; lock activity for up to 13 months; notification logs 30 days; unnamed and guest face data 30 days by default. Encrypted database backups roll off within 14–30 days.

Deleting your account and data

Anyone captured by the cameras (for example a guest or contractor) may also ask us to delete face data or pictures about them; staff can also use “Delete all face data” in the App.

To request deletion of your account or personal information, email info@relaxtay.com from the email address on your account (or ask your Relaxtay administrator in the App). We switch off the login right away on request and delete the account and its personal information within 30 days, and confirm by email. Some business records (for example messages or work items you posted for the team) may be kept where we are legally required to or where they are needed for Relaxtay's business records; you may ask us to remove them too.

Deleted data is removed from the live database; encrypted backups roll off within 30 days.

Children

The App is for adult staff only and is not directed to children under 13. We do not knowingly collect information from children.

Changes

If this policy changes we will update this page and the effective date above.

Contact

RELAXTAY INC · 2 Ralph Blvd Unit 102, Monsey, NY 10952, USA · info@relaxtay.com · relaxtay.com