Privacy Policy

Enlistr Ltd. ("Enlistr", "we", "us", "our") operates the platform at enlistr.net and the associated mobile and web experiences. This policy explains what personal data we collect when you use Enlistr, how we use and share it, the choices you have, and how to reach us with questions.

1. Data we collect

You give us

• Account profile: name, email, phone, profile image (via Clerk).
• Listing content: photos, descriptions, addresses, pricing, availability.
• Booking and transaction data: dates, party size, payment method type, billing address.
• Verification documents: government ID, proof of address, business registration (during KYC).
• Messages exchanged with hosts, guests, and our support team.
• Reviews, ratings, and listing inquiries.

Collected automatically

• Device and browser metadata, IP address, time-zone, approximate location.
• Usage telemetry (pages visited, search queries, listings viewed, clicks).
• Cookies and local storage - see our Cookie Policy.

From third parties

• Identity attributes from Clerk (auth provider).
• Payment status and dispute events from Stripe.
• Map tiles and geocoding from Mapbox.
• Photo storage events from AWS S3 and Supabase Storage.

2. How we use your data

• Operate the platform - render listings, run search, route bookings.
• Process payments, payouts, refunds, and disputes through our payment processors.
• Verify identity to combat fraud and meet regulatory KYC obligations.
• Communicate transactional notices (booking confirmations, payment receipts, message alerts).
• Improve performance and detect abuse via aggregated analytics.
• Comply with legal requests, audits, and law enforcement orders where required.

We do not sell personal data. We do not use your private messages or KYC documents to train machine-learning models. AI-assisted neighbourhood insights receive only a listing's location, with contact details removed and coordinates coarsened to roughly a kilometre; they never receive your messages, identity documents, or account profile.

3. Lawful bases (GDPR / UK GDPR)

If you allow analytics cookies, Google Analytics measures visits to our public pages using browser identifiers and device information. We do not send names, email addresses, phone numbers, search text, or private account and booking URLs to Google Analytics. Advertising features are disabled. You can withdraw this choice on our Cookie Policy page without signing in.

With the same analytics consent, Vercel Web Analytics measures public page visits. We omit query strings, URL fragments, and private account and booking pages, and replace listing identifiers with a page category. Both services honour Do Not Track and consent withdrawal.

• Contract: account creation, bookings, payouts.
• Legitimate interests: platform security, fraud prevention, improving the product.
• Legal obligation: KYC / AML, tax reporting, financial record keeping.
• Consent: optional analytics and marketing cookies, marketing emails (you can withdraw at any time).

4. Sharing

• Other users: hosts and guests see each other's display name, avatar, and messages tied to their booking.
• Service providers: Clerk (auth), Stripe (payments and KYC), Mapbox (maps), AWS S3 and Supabase (storage), Vercel (hosting), Resend / SES (email), Groq and Together AI (AI neighbourhood insights). Each operates under a data-processing agreement.
• Authorities: when compelled by valid legal process or to protect users and the public.
• Successors: in the event of a merger or acquisition, with notice to affected users.

5. Retention

We retain account data while your account is open and for up to 12 months afterwards. Booking, payment, tax, and dispute records are retained for at least 7 years to satisfy financial and tax obligations. Aggregated analytics may be kept indefinitely once stripped of identifiers.

6. Your rights

Subject to applicable law, you can request access, correction, deletion, portability, or restriction of your personal data; object to processing; and lodge a complaint with your supervisory authority.

• Export your data: Settings → Privacy → Download my data.
• Delete your account: Settings → Privacy → Delete my account. Booking + financial records are anonymised but kept for the retention window above.
• Withdraw consent: revisit the cookie banner or update your notification preferences.

7. International transfers

We may transfer data outside your country (e.g. processing in the US or EU). Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

8. Security

We use industry-standard controls including TLS in transit, encrypted storage, scoped database row-level security, signed webhook payloads, and least-privilege service accounts. No system is impervious - please report suspected vulnerabilities to security@enlistr.net.

9. Children

Enlistr is not directed at children under 18. We delete accounts identified as belonging to children on confirmation.

10. Changes

We will notify registered users of material changes by email at least 14 days before they take effect.

11. Contact

Data Protection Officer · privacy@enlistr.net
Enlistr Ltd. · Kingston, Jamaica

This document is provided for transparency. It does not constitute legal advice; speak with a qualified attorney for your specific situation.