What Zugrow offers

Zugrow offers one app and three host services you can buy on their own, without the app:

The Zugrow app: software that runs your short-term lets on Airbnb and Booking.com: free for one property on Solo, a subscription per property on Pro and Max. Invite only for now.
Expert Reviews: a one-off paid report on an Airbnb listing, with clear fixes.
Photo Enhancement: a one-off AI enhancement of your listing photos, paid per photo.
Digital Guidebook: a web guidebook for your guests, paid by subscription.

1. Who we are

Zugrow ("we", "us", "our") operates the website zugrow.com and the Zugrow app. Zugrow is a trading name of Nebula Investments Ltd, a company registered in England and Wales under company number 15190983. Nebula Investments Ltd is the data controller responsible for your personal data.

We make software for short-term rental hosts: the Zugrow app, which connects to Airbnb and Booking.com and runs on the web at app.zugrow.com and on phones and tablets, and our listing services: the Free Listing Score, Expert Reviews, Photo Enhancement and the Digital Guidebook.

If you are a guest. When a host uses Zugrow to handle their guests' data, such as bookings and messages, the host decides how that data is used and we handle it on the host's behalf. To see, correct or delete that data, please contact your host first. You can also email us and we will help.

For any privacy question, contact us at: hello@zugrow.com

2. What data we collect

We collect the following personal data when you use our website and listing services. Section 11 explains what the Zugrow app collects.

Contact information: your name and email address, when you order a listing service, join our waitlist or contact us.
Listing data: your Airbnb listing link and the public information on that listing, such as its title, description, photos, amenities, prices and reviews. This includes the names shown on the listing and its reviews.
Photos: the listing photos you choose or upload for Photo Enhancement.
Payment information: processed by Stripe. We never see your full card number.
Usage data: only if you accept optional cookies, the pages you visit and how you use them (section 4).
Error reports: if a page on zugrow.com breaks in your browser, the error, the page, your browser, the page that sent you and a scrambled code made from your IP address. We do not store the IP address itself.
Communications: any messages you send us by email, through our contact form, in the chat assistant on zugrow.com or in the app's help chat. The chat on zugrow.com is answered by AI (section 5).

3. How we use your data

We use your personal data for the following purposes:

To provide the service you asked for: score or review your listing, enhance your photos, build your Digital Guidebook and run the Zugrow app.
To send you your report, guidebook, receipts, sign in emails and notifications.
To take payments for app plans and listing services.
To keep our services secure, prevent abuse, and find and fix faults.
To measure and improve our website, if you accept optional cookies.
To test and improve the AI agents in the app (section 11).
To answer your questions and give support.

Our lawful bases are: contract, to provide the service you asked for; legitimate interests, to keep our services secure, fix faults and improve our agents; consent, for optional cookies; and legal obligation, to keep tax and accounting records. When a host uses the app to handle their guests' data, the host chooses the lawful basis for that data.

4. Cookies

We use cookies and similar tools as follows:

zugrow.com: Google Analytics and Google Tag Manager (how visitors use the site), Google Ads measurement (whether our adverts lead to sign ups and orders) and Microsoft Clarity (recordings and heatmaps of how visitors use pages). We also remember which affiliate link brought you, for 90 days. None of these run until you click "Accept all" in our cookie banner. If you click "Reject all", or do not choose, they do not run at all.
The app on the web (app.zugrow.com): Google Analytics only. It sets analytics cookies only if you accept them in the app's cookie banner. Until then it runs without cookies. The app never uses Microsoft Clarity or any other session recording.
Our phone and tablet app: no analytics at all.
guides.zugrow.com: Google Analytics only, and only after you accept. It never runs on guest guides or on the pages hosts use to edit them.
Google News button: on blog posts and answer pages, a button lets you add Zugrow as a preferred source in Google News. It loads Google's script when the page opens, whatever you chose in the cookie banner, so Google receives the usual details of your visit to that page.
Essential cookies and storage: keep you signed in, remember your cookie choice and save your form progress. These do not need your consent.

You can also block or delete cookies in your browser settings at any time. Turning off analytics cookies does not affect your ability to use our services. Our Cookie Policy explains our cookies in more detail.

5. Who we share data with

These companies help us run our services. They may only use the data to do work for us, apart from where we say they act as a separate controller.

Supabase (databases and file storage): stores app workspaces, your orders, reports and photos. The app's database is in London, UK.
Vercel (hosting): runs our website, our APIs and the app. The app runs in London, UK. zugrow.com and guides.zugrow.com run in the USA.
Anthropic (AI models, USA): writes our listing reports, answers the chat assistant on zugrow.com (what you type there and the last few messages of that chat), and in the app reads guest messages and booking details to draft replies, translate messages and review booking requests (section 11). Anthropic's commercial terms do not allow it to train its models on the data we send. Anthropic deletes what we send within 30 days, or keeps it for up to 2 years if its systems flag it as breaking its usage policy.
Channex (Channex.io Ltd): the channel manager that carries bookings, availability, prices and guest messages between the app and Airbnb and Booking.com. A UK company whose platform is hosted in EU data centres.
Brevo (emails and text messages): sends sign in emails, notifications, reports and guidebook emails. EU based.
Stripe (payments): takes payments for app plans and listing services, and holds guests' cards for security deposits on hosts' own Stripe accounts. Stripe is also a separate controller for its own fraud and legal duties.
Google (USA): Firebase Cloud Messaging, which delivers notifications to the app on phones and tablets; Google Analytics, Google Tag Manager and Google Ads measurement, only as section 4 describes; the Google News preferred source button (section 4); and Google Maps and Places, for maps and nearby places in guidebooks.
Apple: delivers the app's notifications to iPhones and iPads.
Microsoft Clarity: recordings and heatmaps of how visitors use zugrow.com, only if they accept optional cookies. Never used in the app. Microsoft acts as a separate controller for Clarity.
Didit: guest ID checks, only when a host turns them on (section 11).
An AI image editing provider (outside the UK): Photo Enhancement, only for photos you send us to enhance. Transfers are made with UK transfer safeguards.
AirROI, Apify, HasData and Wextractor (listing data services): fetch the public information on a listing so that we can score and review it.

Airbnb and Booking.com receive the messages, prices and availability that a host, or an agent working for the host, sends through the app. They are separate controllers under their own privacy policies.

We do not sell your personal data to any third party.

6. How long we keep data

The Zugrow app. We keep your workspace data, including your guests' data, while your workspace is open. When the owner deletes the workspace, we delete its records, the photos stored with its messages, the screenshots added to its help chats and every login in it, apart from payment records (below).

These time limits are applied automatically:

Report files (PDFs) we make for you: deleted after 90 days.
Photos you upload, or that we copy from your listing, for Photo Enhancement: deleted after 30 days.
Crash and error reports from the app: deleted after 90 days.
Failed sign in records: deleted within a day.
Updates that channels send the app: the full copy is emptied after 90 days, and the rest is deleted after 18 months. New review updates are kept while the workspace is open, so that the app can check a returning guest's earlier reviews with the same host.
Agent test copies (section 11): deleted after 120 days, unless we keep one in a named test set. They are also deleted when the workspace is deleted.

Payment records. We keep payment and invoice records for at least 6 years, as UK tax law requires.

Everything else. Some records do not have an automatic time limit yet, such as the records of your Free Listing Score, Expert Review, Photo Enhancement and Digital Guidebook orders, and error reports from our website. You can ask us to delete them at any time (section 7).

7. Your rights (UK GDPR)

Under UK data protection law, you have the right to:

Access: request a copy of the personal data we hold about you.
Rectification: request correction of inaccurate data.
Erasure: request deletion of your data ("right to be forgotten").
Data portability: request your data in a machine-readable format.
Objection: object to processing based on legitimate interest.
Withdraw consent: withdraw your consent at any time.

To exercise any of these rights, email us at hello@zugrow.com. It is free. We may ask you to prove who you are, and we will reply within one month.

You also have the right to complain to the UK data protection regulator, the ICO, at ico.org.uk.

8. Data security

We take appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), passwords stored only in scrambled form (as a hash), and database rules that keep each workspace's data separate, so a host can only reach their own workspace.

Photos sent or received in guest messages are stored at long, hard to guess web links, because the channels need to fetch them. Anyone who has one of those links can open that photo. Screenshots added to help chats are kept in private storage.

No system is completely secure, so we cannot guarantee that your data will never be accessed without permission.

9. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

10. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at: hello@zugrow.com

Nebula Investments Ltd, trading as Zugrow. Registered in England and Wales, company number 15190983.

11. The Zugrow app

The Zugrow app helps short-term rental hosts and their teams run their homes: one inbox for Airbnb and Booking.com guest messages, AI agents that help with replies and booking requests, bookings and calendars, and notifications for new messages and bookings. It runs on the web at app.zugrow.com and as an app for phones and tablets. To provide it, we collect and process:

Your account: your name, email address, company name if you give one, and your password, stored only in scrambled form (as a hash). For teammates, the name, email address and role of each person invited to a workspace.
Billing: your plan and payments. Stripe takes your card details.
Your workspace: properties, channel connections, calendars, prices, rules and settings, agent settings, notes, and a history of actions showing who took them.
Guest data from bookings: the guest's name, and their phone number and email address where the channel shares them, the channel's guest ID, language, number of guests, pets, dates and amounts. These come from Airbnb and Booking.com through Channex.
Messages: messages between you and your guests, including photos either side sends, and translations of those messages.
Notification device tokens: the devices you allow to receive notifications, and your notification choices. Notifications are delivered by Firebase Cloud Messaging (Google) and, on iPhone and iPad, by Apple. They can show a guest's name and up to 140 characters of a new message.
Crash and error reports: if the app hits an error, the error and its technical details, the screen it happened on (with any sign in or invite codes removed), your browser or device type and, if you are signed in, your workspace.
Support: your chats with the app's AI help assistant, the bug reports you send and any screenshots you add.
Guest ID checks, if a host turns them on: a guest confirms their identity through our provider Didit by scanning an ID document and taking a selfie. Didit checks the document, checks that a real person is present and that their face matches the document. The thorough check also screens the guest against sanctions and anti money laundering lists. Didit holds the document image and the selfie. We store only the status and a summary: the name, document type, issuing country, expiry date, the match scores and the screening result. Checks like this use biometric data, which the law treats as especially sensitive. The host decides whether to use them.
Security deposits, if a host takes one: the guest's card is saved by Stripe on the host's own Stripe account and is charged only if there is damage. We never see the full card number.

AI in the app. The app's AI features use Anthropic's AI models (section 5). They read guest messages, booking details and the host's settings to draft replies, and to send them where the host allows it, to translate messages and to review booking requests. They also answer hosts' questions in the help chat. Anthropic's commercial terms do not allow it to train its models on the data we send.

Agent test copies. To test and improve our agents, we keep a copy of what the agents that review booking requests and draft guest replies were given, and what they produced. Before a copy is kept, door codes, key box codes and wifi passwords are replaced, links to guest photos are removed and references to other guests are taken out. If that cannot be done safely, nothing is kept. Copies are used only to test and improve our agents, are never shown to other hosts, and are deleted as section 6 explains.

Analytics. Our phone and tablet app uses no analytics. On the web, the app uses Google Analytics only as section 4 explains, and never records sessions.

You can turn notifications off for a device at any time on the app's Account page.

You remain in control of your data. On the app's Account page, the owner can permanently delete the whole workspace using "Delete workspace" (section 6 explains what this removes). A team member can delete just their own login using "Delete my login", without affecting the rest of the workspace; their name in the workspace's history then becomes "Former team member". Deleting a workspace does not cancel a paid plan, so please cancel your plan in Billing first. To get a copy of your workspace data, email hello@zugrow.com.

12. Zugrow Multi-Calendar Sync for Hosts (Chrome extension)

This section covers our free Chrome extension, "Zugrow Multi-Calendar Sync for Hosts", which is separate from this website and from any Zugrow account.

The extension collects nothing. It has no account and no sign-in, it sends no data to Zugrow or to any third party, and it contains no analytics, no advertising, no session replay and no tracking of any kind. None of the cookies or processors described elsewhere in this policy are used by the extension.

What it stores, and where:

The list of properties you create and the calendar links you paste in are saved in Chrome's extension settings storage. Chrome replicates that list to the other computers where you are signed in to the same Chrome profile, in the same way it syncs your bookmarks. It is held in your Google account, not ours, and we cannot read it.
The booking dates fetched from those calendar links are cached in your browser on the device that fetched them, and are not synced anywhere.
Removing a property, or uninstalling the extension, deletes this data.

Network access: the extension only ever contacts the calendar addresses you paste in, to download the .ics calendar file. Chrome asks your permission for each website at the moment you add a link, and you can withdraw that permission at any time from your browser's extensions page. The extension makes no other network requests.