Privacy Policy

1. Introduction

Welcome to Superhost. This Privacy Policy explains how Nuage ("we", "our", or "us") collects, uses, and shares information in connection with our B2B SaaS property management tool, Superhost.

Superhost serves as a unified operations hub for hospitality professionals. Our role under data protection law depends on the type of data:

• Guest data processed on behalf of customers (e.g., guest messages, booking details, contact information): Our customers (Property Managers and Hosts) are the Data Controllers and Nuage acts as a Data Processor.
• Account, billing, and platform-integration data (e.g., customer account details, payment information, and credentials or metadata provided to us directly by integration partners such as Meta — including Meta user IDs, WhatsApp Business Account identifiers, access tokens, and app secrets): Nuage is the Data Controller.

2. Data We Collect

Customer Data

We collect information from our customers when they register for an account, including name, business name, email address, payment information, and details about staff members they invite to the platform.

Guest Data

On behalf of our customers, we process data related to their guests. This includes messages originating from platforms like WhatsApp, Airbnb, Booking.com, and VRBO, as well as booking details, contact information, and special requests.

3. How We Use Data

We use the data we collect to provide, maintain, and improve the Superhost platform, including our unified inbox, translation services, and task management features.

4. WhatsApp & Meta Integration

Superhost operates as a WhatsApp Tech Provider under Meta's Embedded Signup program. This allows our customers to connect their WhatsApp Business accounts to the Superhost platform.

When facilitating communication via the WhatsApp Business API, we process messages securely and in strict compliance with the WhatsApp Business Terms of Service. We do not use WhatsApp message data for any purpose other than providing the unified inbox service to our customers.

For Platform Data that Meta shares with us directly through the Embedded Signup flow and the WhatsApp Business API — including Meta user IDs, email addresses, WhatsApp Business Account identifiers, phone-number IDs, access tokens, and app secrets — Nuage is the Data Controller. This data is used solely to provision, operate, and secure our customers' WhatsApp integrations, and is not shared with third parties except the subprocessors listed on our Subprocessors page.

5. Data Sharing & Third Parties

We use trusted third-party service providers, also called subprocessors, to help operate Superhost. These include providers for hosting, database, storage, messaging, transactional email, payments, support, error monitoring, and AI-assisted features.

These providers may process personal data only as needed to provide services to Superhost or our customers. A current list of subprocessors is available at our Subprocessors page.

6. Data Retention

We follow standard SaaS retention: customer data is retained while the account is active and deleted within 30 days after account deletion, unless we are legally required to retain limited records for tax, accounting, security, dispute-resolution, or booking/compliance purposes. Where required, those limited records may be retained for up to 7 years.

7. User & Guest Rights (GDPR)

Under the GDPR and other applicable privacy laws, individuals have rights regarding their personal data, including the right to access, correct, or delete their information.

For Guests: Because we process guest data on behalf of Property Managers (who are the Data Controllers), guests wishing to exercise their data privacy rights must contact the Property Manager directly. We will assist our customers in responding to such requests.

8. Cookies & Tracking

We use essential cookies to operate the Superhost platform (such as keeping you logged in). We may also use analytics cookies on our marketing site to understand how visitors interact with our content. You can manage your cookie preferences through your browser settings.

9. Requests from Public Authorities

From time to time, Nuage may receive requests from public authorities (including law enforcement, regulators, and national-security bodies) to disclose personal data. We handle such requests under the following principles:

• Legality review. Every request is reviewed to confirm it is issued by a competent authority, has a valid legal basis, and is sufficiently specific. We do not disclose data in response to informal or voluntary requests.
• Right to challenge. Where a request appears unlawful, overbroad, or inconsistent with the GDPR or other applicable law, we will challenge or seek to narrow it, including through legal counsel where appropriate.
• Data minimization. We disclose only the minimum personal data strictly necessary to comply with a valid request, and we object to requests for bulk or unspecified data.
• Documentation. We document each request received, the legal reasoning applied, the personnel involved, and our response, and we retain those records for audit purposes.
• Customer notice. Where we are legally permitted to do so, we will notify affected customers before disclosing their data so they may seek appropriate remedies.

We publish aggregate information about the volume of such requests we receive whenever we are legally permitted to do so.