Privacy Policy

1. Introduction

Y'alloha (“we,” “our,” or “us”) operates the website www.yalloha.com (the “Service”). This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

Y'alloha helps vacation rental owners automatically transform 5-star guest reviews into branded social media posts, operates an affiliate referral program connecting hosts with content creators, and provides patent-pending Guest Wallet Passes that deliver stay details to guests via Apple Wallet and Google Wallet.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, password
• Property Information: Property names, Airbnb connection credentials, or manually entered reviews
• Customization Settings: Direct booking URLs, hashtags, background images

2.2 Information From Third-Party Services

• Airbnb / Hospitable: We collect guest reviews, property data, and reservation information (including guest names, stay dates, and entry codes) when you connect your account. This data is used to generate social media posts and, where enabled, to populate Guest Wallet Passes.
• Facebook: When you connect your Facebook account, we collect:
  • Your Facebook Page IDs and names
  • Page access tokens (to post on your behalf)
  • Basic profile information

2.3 Affiliate Program Data

When you participate in the Y'alloha affiliate program (as a host or affiliate), we collect:

• Affiliate identity: Name, business name, email address, and any additional information provided during the application process (e.g., social media handles, content channels, audience descriptions)
• Payment details: Payout account information provided by the affiliate for commission settlement (e.g., PayPal email, Venmo handle, or bank account details)
• Referral activity: Click data (timestamps, referrer URLs), conversion data (booking values, check-in/check-out dates, property identifiers), and commission amounts earned and paid
• Attribution data: A first-party cookie (yalloha_ref) with a 30-day expiry is used to attribute bookings to the referring affiliate. Click timestamps and booking events are stored for commission calculation and dispute resolution

2.3.1 Data Shared with Hosts

The following affiliate data is shared with the Host whose program you have joined:

• Affiliate name and business name
• Aggregate and per-referral performance metrics (clicks, conversions, conversion rate)
• Commission amounts earned and payout status

Hosts cannot see your full email address (until they approve your application), your payment account details, or data from other Host programs you participate in.

2.3.2 Affiliate Data Retention

Affiliate program data (referral records, commission history, payout records, and audit logs) is retained for a minimum of 7 years after the last transaction to comply with IRS requirements for potential 1099-NEC reporting and state tax record-keeping obligations. Referral tracking cookies expire automatically after 30 days.

2.3.3 Affiliate Rights

As an affiliate, you have the right to:

• Access: Request a copy of all data we hold about your affiliate activity
• Correction: Update your profile information, business name, and contact details at any time through the dashboard
• Deletion: Request deletion of your affiliate data, subject to the 7-year legal retention requirement for completed financial transactions. Non-financial profile data can be deleted upon request

2.4 Referral Tracking

• First-party cookie (yalloha_ref): When a visitor arrives via an affiliate referral link (URL containing ?ref= parameter), we set a first-party cookie named yalloha_ref with a 30-day expiry. This cookie stores the affiliate identifier and is used solely for commission attribution.
• URL parameter: The ?ref= URL parameter identifies which affiliate referred the visitor.

2.5 Booking Conversion Data

When a host's booking platform fires a conversion event via Google Tag Manager, we receive:

• Booking value
• Check-in and check-out dates
• Guest count
• Property ID

We do not receive guest names, guest email addresses, or guest payment information through the conversion tracking pixel. This data is used exclusively to calculate affiliate commissions.

2.6 Guest Wallet Pass Data

When you enable the Guest Wallet Pass feature, we collect and store the following guest data on your behalf:

• Reservation data: Guest name, reservation ID, check-in/check-out dates, and entry codes received via your property management system integration
• Device push tokens: When a guest saves a pass to Apple Wallet or Google Wallet, the device registers a push token with Y'alloha. This token is used solely to deliver pass updates (e.g., entry code changes, checkout-to-loyalty transition) and is never used for marketing communications to guests
• Pass interaction data: Whether a guest has saved a pass and when pass updates are delivered

Guest data collected for Wallet Passes is used only to operate the pass feature. It is not sold, shared with third parties for marketing purposes, or used to contact guests directly. Hosts are responsible for ensuring they have appropriate authorization under their PMS agreements to share guest reservation data with Y'alloha.

2.7 Automatically Collected Information

• Log data (IP address, browser type, pages visited)
• Usage patterns and feature interactions
• Error logs for troubleshooting

3. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Automatically generate social media posts from your guest reviews
• Post approved content to your Facebook and Instagram accounts on your behalf
• Send you notifications about new reviews and pending posts
• Improve and optimize the Service
• Provide customer support
• Comply with legal obligations

3.1 Affiliate Program Use

For the affiliate program specifically, we use your information to:

• Operate the affiliate program: track referrals, calculate commissions, notify parties of earned commissions, and maintain settlement records
• Verify affiliate identity and payout eligibility
• Generate and deliver affiliate wallet passes (Apple Wallet and Google Wallet cards containing your referral link and QR code)
• Maintain an audit log of referral activity, commission calculations, and payout status for dispute resolution

4. Data Sharing and Disclosure

We do NOT sell your personal information. We may share your information with:

• Third-Party Services: Facebook (to post on your Pages), Airbnb (to retrieve reviews), Anthropic (for AI caption generation)
• Service Providers: Hosting (Vercel), database (Supabase), authentication, and analytics providers
• Legal Requirements: When required by law or to protect our rights

4.1 Affiliate Program Information Sharing

Within the affiliate program:

• Hosts can see: Affiliate name, business name, referral activity (clicks and bookings), commission amounts, and payout status
• Hosts cannot see: Full affiliate email addresses in the public directory (email is revealed only after the host approves an affiliate's application)
• Hosts cannot see: Affiliate payment account details (bank account, Venmo, PayPal, etc.)

5. Cookies

We use the following cookies:

5.1 Essential Cookies

• Authentication cookies: Required to maintain your logged-in session

5.2 Affiliate Referral Cookie

The yalloha_ref cookie is not used for advertising, profiling, or cross-site tracking. It is set only when a visitor clicks an affiliate referral link and is used solely to attribute a subsequent booking to the correct affiliate for commission calculation.

6. Data Storage and Security

Your data is stored securely using industry-standard encryption:

• Database hosted on Supabase with encryption at rest
• Secure HTTPS connections for all data transmission
• Access tokens encrypted and stored securely
• Regular security audits and updates

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your data for as long as:

• Your account is active
• Needed to provide the Service
• Required by law

7.1 Affiliate Program Data Retention

• Affiliate program data (referral records, commission history, payout records, audit logs) is retained for a minimum of 7 years after the last transaction per IRS requirements for potential 1099-NEC reporting
• Referral tracking cookies (yalloha_ref) expire automatically after 30 days
• Affiliate account data is retained until the affiliate requests deletion, subject to the 7-year minimum retention period for completed financial transactions

7.2 General Data Retention

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we must retain it for legal compliance or the minimum retention periods specified above.

8. Your Rights and Choices

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update or correct your information through Settings
• Deletion: Request deletion of your account and data
• Revoke Access: Disconnect Airbnb or Facebook at any time through Settings
• Export Data: Download your data in a portable format

To exercise these rights, email us at support@yalloha.com or use the Settings page.

9. Facebook-Specific Information

9.1 Facebook Login

When you connect your Facebook account, we request the following permissions:

• pages_show_list: To display your Facebook Pages for selection
• pages_read_engagement: To verify Page access
• pages_manage_posts: To publish approved posts to your Pages

9.2 What We Store from Facebook

• Your Facebook Page IDs
• Page access tokens (required to post on your behalf)
• Page names (for display purposes)

9.3 Disconnecting Facebook

You can disconnect your Facebook account at any time from Settings. This will:

• Remove your Facebook Page access tokens from our database
• Stop all future posting to your Pages
• Not affect posts already published

You can also revoke app access from your Facebook Settings at facebook.com/settings → Apps and Websites.

10. Children's Privacy

Our Service is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe we have collected information from a child, please contact us immediately.

11. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the Service. Your continued use after changes constitutes acceptance.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us:

• Email: support@yalloha.com
• Website: www.yalloha.com