Privacy Policy

HoldGuarantee provides card-hold security deposits for venues, studios, and rentals. For account data you give us directly, HoldGuarantee is the controller. For guest details a host enters to create a deposit link, the host is the controller and HoldGuarantee processes that data on the host's instructions.

Guests enter card numbers in Stripe Elements. The primary account number and CVC go to Stripe and are not stored on HoldGuarantee servers. Stripe is a PCI-DSS Level 1 service provider. We keep the PaymentIntent id, card brand, and last four digits so a host can recognize the authorization later.

Host accounts include name, company, email, phone, properties, and billing status. Deposit records include the guest's name, email, phone, booking reference, hold amount in USD, status, and timestamps. Damage claims may include photos and invoices the host uploads. Webhook receipts in stripe_events are server-only and are not available to browsers.

We process host data to provide the service, take payment for the subscription, and keep the account secure. Guest data is processed to place, renew, release, or capture a hold the host requested. The legal bases are contract, legitimate interest in preventing fraud and documenting claims, and consent where a cookie choice is optional.

If you are in the EEA, the United Kingdom, or Switzerland, you can ask to access, correct, delete, or export personal data we hold about you, and you can object to or restrict certain processing. Hosts can export deposit logs from the dashboard. To make a request, email privacy@holdguarantee.com. You may also lodge a complaint with your local supervisory authority.

Guests who want their booking data changed or deleted should contact the host first. We will help the host complete that request. We do not sell personal data.

Essential cookies keep a signed-in session and remember your cookie choice. We do not set advertising cookies. You can accept optional storage or keep essential cookies only from the notice on the homepage.

We keep deposit and claim records while the host account is open and for as long as needed to resolve a dispute or meet tax and accounting duties. Stripe and our infrastructure providers may process data in the United States. Where required, those transfers use the provider's standard contractual clauses.