This Privacy Policy describes how Familiar Guest, a service operated by Baja Investors LLC (“we,” “us”), collects, uses, shares, and protects information about visitors to famguest.com, property owners (“Owners”), guests (“Guests”), and caretakers who use the Familiar Guest platform (together, “you”).
This policy is written to address requirements under multiple privacy frameworks relevant to our Users, including the EU/UK General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), and Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (“LFPDPPP”). A Spanish-language aviso de privacidad summary is provided in Section 12.
| Category | Examples |
|---|---|
| Account & profile | Name, email, phone number, country, language preference, payout currency preference |
| Identity verification | Collected directly by our payment processor (Stripe) for Owner KYC — legal name, date of birth, address, last 4 digits of SSN/government ID where required, and bank account details. Familiar Guest does not receive or store full government ID numbers, ID documents, or full bank account numbers — these are held by Stripe. |
| Property & ownership documents | Listing details, photos, GPS coordinates (required for Mexico properties), and — for public listings — an ownership document (e.g., tax statement, deed, utility bill, insurance declaration, fideicomiso, or Mexican corporate documents) |
| Booking & guest information | Guest name, contact details, stay dates, party size, special requests, messages with the Owner, signed rental agreements |
| Payment information | Processed by Stripe; Familiar Guest receives transaction metadata (amounts, dates, status) but not full card numbers |
| Guest screening (optional) | Where an Owner or Guest opts into screening, identity and risk-assessment information collected by our screening partner (currently Truvi) under its own privacy practices |
| Communications | Messages sent through the platform, support requests, and survey responses |
| Category | Examples |
|---|---|
| Device & usage data | IP address (used to derive approximate location/country), browser and device type, pages viewed, links clicked, referring/exit pages, and timestamps |
| First-party analytics identifiers | An anonymous device/browser identifier and a session identifier, stored in first-party cookies, used to group page-view and click events (see Section 4) |
| Bot & security signals | Signals used to distinguish human visitors from automated traffic, and to detect abuse |
Legal bases (GDPR/UK GDPR): we process personal data on the bases of contract performance (providing the Service you request), legitimate interests (e.g., security, fraud prevention, and core product analytics), consent (e.g., marketing cookies/pixels and, where required, analytics cookies — see Section 4), and legal obligation (e.g., tax recordkeeping).
Where you provide a mobile number and opt in, Familiar Guest sends transactional and account-related text messages (and, where enabled, WhatsApp messages) through our messaging provider, Twilio — such as booking confirmations, pre-arrival and check-in instructions, and reminders. Message frequency varies based on your booking activity.Message and data rates may apply. You can opt out at any time by replying STOP to a text message, and reply HELP for assistance. Opting in to text messages is not a condition of booking or purchasing any service. We do not sell or share your mobile number or SMS consent with third parties or affiliates for their marketing purposes; it is used only to deliver the messages you have requested, and shared only with the messaging provider that transmits them on our behalf.
We use first-party cookies to operate the Service (e.g., to keep you signed in) and to capture anonymous browsing analytics (page views and clicks) to a database that Familiar Guest’s team can query directly. Where you consent, we also enable Google Analytics/Ads and (in the future) Meta Pixel for marketing measurement. A cookie banner lets you choose your preferences for analytics and marketing cookies on first visit, and you can change your choice at any time. See our Cookie Policy for the full list of cookies and categories.
We do not sell personal information. We share information with the following categories of recipients as necessary to provide the Service:
| Recipient | Purpose |
|---|---|
| Stripe (payment processing & identity verification) | Process payments, payouts, and Owner KYC |
| Supabase (database & authentication hosting) | Store account, listing, booking, and analytics data |
| Vercel (application hosting) | Host and serve the Service, including security/bot-protection features |
| Resend (transactional email) | Send booking confirmations, sign-in links, and other transactional emails |
| Twilio (SMS/WhatsApp messaging) | Send opted-in text/WhatsApp reminders and check-in messages |
| DocuSeal (e-signature) | Generate and store signed rental agreements |
| Truvi (guest screening, optional) | Identity and risk screening for bookings where this add-on is used |
| Anthropic (AI features) | Generate AI-assisted listing descriptions and translations from Owner-provided text |
| Google (Analytics/Ads), Meta (planned) | Marketing measurement, where you have consented |
| The other party to a booking | An Owner and Guest necessarily share certain information with each other (e.g., name, contact info, stay details) to complete a booking |
| Caretakers | Where an Owner grants scoped caretaker access, limited information (e.g., check-in schedules, house manual) is shared with that caretaker |
| Legal & safety | Where required to comply with law, enforce our Terms, or protect the rights, property, or safety of Familiar Guest, our Users, or others |
| Business transfers | In connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality obligations |
[Note for counsel: maintain a current subprocessor list and execute Data Processing Addendums with each subprocessor above as part of our GDPR/LFPDPPP compliance program.]
Familiar Guest serves Owners and Guests in the United States, Canada, Mexico, and other countries, and uses service providers located in the United States. Where personal data is transferred from the EU/UK, Mexico, or Canada to the United States or another country, we rely on appropriate safeguards required by applicable law (such as standard contractual clauses), to the extent applicable.
We retain personal data for as long as needed to provide the Service, comply with legal obligations (including tax and accounting recordkeeping, which may require retaining booking and payment records for several years), resolve disputes, and enforce our agreements. Signed rental agreements are retained permanently for both parties’ records unless deletion is requested and permitted by law. Analytics events are retained for an initial operational period and may be aggregated or deleted thereafter.
If you are located in the EU or UK, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability. You also have the right to withdraw consent (e.g., for marketing cookies) at any time and to lodge a complaint with your local data protection authority.
If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the “sale” or “sharing” of personal information (Familiar Guest does not sell personal information; where consented marketing pixels are enabled, this may constitute “sharing” for cross-context behavioral advertising under CPRA, which you can opt out of via the cookie banner).
If you are located in Canada, you have the right to access your personal information, request corrections, and withdraw consent for certain uses, subject to legal and contractual restrictions.
If you are located in Mexico, you have ARCO rights — to Access, Rectify, Cancel, and Object (Acceso, Rectificación, Cancelación y Oposición) to the processing of your personal data. See Section 12 for our aviso de privacidad summary and contact information for exercising these rights.
You can exercise these rights by contacting info@famguest.com. We may need to verify your identity before fulfilling certain requests.
We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, row-level security on our database, and the use of payment-processor hosted components so that sensitive identity and payment data does not pass through or get stored on our servers. No system is completely secure, and we cannot guarantee absolute security.
The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.
We may update this Privacy Policy from time to time. Material changes will be notified as described in our Terms of Service.
For privacy questions or to exercise your rights, contact info@famguest.com.
Familiar Guest recaba y trata datos personales de propietarios, huéspedes y cuidadores (nombre, contacto, datos de la propiedad, información de reservas y, a través de nuestro procesador de pagos, datos de verificación de identidad y pago) con el fin de operar la plataforma, procesar pagos y reservas, generar contratos de arrendamiento, calcular y, en su caso, retener y enterar impuestos de hospedaje aplicables, y mejorar el servicio. Usted tiene derecho a Acceder, Rectificar, Cancelar u Oponerse (derechos ARCO) al tratamiento de sus datos personales, escribiendo a info@famguest.com.
[Note for counsel: this Spanish summary requires review by Mexican counsel for completeness under LFPDPPP, including whether a full standalone aviso de privacidad (integral) is required versus this simplified version.]