Privacy Policy

Last updated October 2, 2026

This policy explains what personal information Threshold (“Threshold”, “we”) collects when you use threshold.rentals, its booking pages, API and MCP server, how we use it, and the choices you have. We don't sell personal information.

What we collect

From hosts

• Account: your email address and sign-in activity, and your mobile number if you turn on text alerts, and, if you turn on notifications on a device, that device's notification address and a short device label (such as "iPhone").
• Listings: what you enter or import (descriptions, amenities, prices, rules, photos), the property address, any permit number, your calendar export links, check-in instructions and the phone number you give guests.
• Verification: the booking-site listing you use to prove control, and notes from our review.
• Payouts: Stripe collects your identity and bank details directly when you set up payments. We receive your Stripe account ID and status, not your bank or ID numbers.

From guests

• Booking details: name, email, optional phone number, party size, dates, any note to the host, and your booking's history (requests, payments, refunds, cancellations).
• Reviews and ratings: your review of a stay, and your host's rating of you as a guest (cleanliness, communication, following house rules, whether they'd host you again, and an optional private note), with any reply you add.
• Payment: Stripe processes your card or wallet. We receive limited details such as the card brand, last four digits and payment status, never your full card number.

From AI agents and developers

• The requests an agent sends (searches, quotes, bookings) and, if it sends one, a hashed form of its access token so its bookings stay linked to it.

Automatically

• Basic technical logs (IP address, browser or agent identifier, pages and API calls, errors) kept by our hosting provider for security and troubleshooting.
• When a booking site fetches a host's Threshold calendar link, the time and the fetcher's identifier, so hosts can see their calendars are connected.
• Visit counts for our public pages (which page, the site you came from, campaign tags in the link, device type and country), made without cookies and without storing your IP address. A visitor is counted at most once a day and can't be followed from one day to the next. If you sign up as a host, the campaign tag or site you arrived from in that visit is kept in that browser tab only (until it closes) and saved with your new account, so we know which of our outreach works. If your browser sends Do Not Track or Global Privacy Control, you aren't counted and nothing is kept. For AI agents, we count searches, quotes and booking requests by the kind of assistant making them.
• One cookie, to keep hosts signed in. We don't use advertising or analytics cookies, and no analytics data goes to anyone else.

How we use it

• To run bookings and payments: quotes, requests, confirmations, charges, refunds, payouts and check-in emails.
• To publish listings to guests, search engines and AI agents. Public listing pages and the agent API show listing details but never a host's email, the exact address or check-in instructions; the location shown is approximate.
• To verify hosts, prevent fraud, double bookings and abuse, and keep the Service secure.
• To send service emails (sign-in links, booking and payment notices) and, for hosts who turn them on, text alerts about their bookings. We don't send marketing emails or texts without asking. Mobile numbers and text-alert consent are never shared with third parties or affiliates for their marketing.
• To use AI tools on hosts' behalf: when a host imports a listing or asks for photo captions, the listing text or photos are sent to Anthropic's Claude to suggest details, which the host reviews before publishing.
• To comply with law, enforce our terms, and resolve disputes.

Who we share it with

• Hosts and guests, as needed for a booking. A host sees a guest's name, email, phone (if given), party and note when a request arrives. A guest receives the host's contact details (through email replies, and a phone number if the host provides one), the address and check-in instructions once the booking is confirmed and paid.
• Other Threshold hosts, for guest ratings. When you ask to book, the host sees ratings other Threshold hosts gave you after past stays (matched by your email or phone), with your replies: the number of stays, how many would host you again, and the star ratings. Hosts' private notes aren't shared with other hosts. Guest ratings are never public and never shared with AI agents. You can see your ratings on your booking page and ask us to access, correct or delete them.
• The AI agent that made a booking, which can see that booking's status, and anyone with a guest's private booking link.
• Service providers that process data for us under contract: Vercel (hosting), Neon (database), Resend (email), Twilio (text messages), Stripe (payments and payouts, including Stripe Link for agent payments), Anthropic (AI features) OpenStreetMap's Nominatim (turning a town into map coordinates), and, for hosts entering their address, Photon by komoot or Google Maps (address suggestions) and OpenStreetMap (map tiles); and, for hosts who turn on notifications, the push service of their device's maker (Apple, Google, Mozilla or Microsoft), which delivers the notification text.
• Booking sites that hosts connect: Threshold's calendar link shows them which dates are booked, without guest details.
• Legal and safety: when required by law, to protect people's safety, or to investigate fraud; and to a buyer or successor if Threshold's business is transferred, under this policy.

How long we keep it

We keep account and listing data while the account is open. We keep booking and payment records for as long as needed for taxes, accounting, chargebacks and legal claims, generally up to seven years. Sign-in links expire after 30 minutes. Logs are kept for a limited time by our hosting provider.

Your choices and rights

• Hosts can view and edit their listing at any time, pause or remove it, and disconnect calendars and payments.
• Anyone can ask to access, correct or delete their personal information, or ask how it's used, by emailing hello@threshold.rentals. We'll verify the request and respond within 30 days. We may keep records we're legally required to keep, such as payment records.
• Depending on where you live (for example, California or the EU/UK), you may have additional rights, such as to object to processing or to complain to a data protection authority. We honor these rights as the law requires and won't treat you differently for using them.

Security

We use encryption in transit, hashed sign-in and session tokens, unguessable booking links, and access controls. No system is perfectly secure; if a breach affects your information, we'll notify you as the law requires.

Children

The Service isn't for children under 16, and we don't knowingly collect their information. Hosts may record that children are in a guest's party, which is part of the booking.

Where data is processed

Threshold is based in the United States, and our providers process data in the US. By using the Service from elsewhere, you understand your information will be processed in the US.

Changes

We'll post any changes here with a new date, and email hosts about material changes.

Contact

Threshold
hello@threshold.rentals

Questions about this page? Email hello@threshold.rentals.