Steward Privacy Policy

Effective date: September 14, 2026
This policy applies to information we collect on and after this date, and to information collected from you before this date.
Steward is operated by Steward, LLC ("Steward," "we," "us"). Steward exists for one purpose: to help property operators run their businesses as efficiently as possible, with clean, polished reporting and performance insight. Everything we collect is intended to support that purpose, operate the service, protect users, and meet our legal obligations. This policy explains what we collect, how we use it, and the commitments we make about it. Questions any time: privacy@steward.host.

The short version

We never sell your data. Our business is helping operators run and report on their properties — not selling data. That's the whole model.
Your identifiable data is never shared with other operators. What's in your account stays in your account.
We hold as little guest information as the work requires, full card numbers never touch our systems (Stripe processes payments), and our team's access to your account is disclosed and constrained below.

Information we collect

Account information. Your name, email, company name, and login credentials (authentication is handled by our provider; we never see or store your password).

Your business data. The information you add or upload to run your operation in Steward: properties, listings and rentable configurations, owners, landlords, partners, prospects, team members, reservations, leases, stays, financial figures, expenses, payout information, performance metrics, reports, and files you upload for import. Uploaded files are stored so we can process and re-process your imports.

Guest and tenant information contained in your data. Reservation and lease data naturally includes information about your guests and tenants — typically names and stay or tenancy details. We process this on your behalf: your guests and tenants are your customers, not ours. We deliberately minimize what we ingest — our features are built on dates, amounts, and booking references, not on guest contact information.

Sensitive information we do not need. Steward is not designed to collect highly sensitive personal information. Please do not upload Social Security numbers, government ID images, full payment card numbers, bank account credentials, health information, background checks, or other sensitive information unless we specifically ask for it in writing. If an uploaded file contains information Steward does not need, we may ask you to remove or replace it, and we may delete unnecessary sensitive information where appropriate.

Report recipients and delivery. When you send reports through Steward, we process your recipients' email addresses and may store delivery status so you can see what was sent, to whom, and when.

Usage and technical information. Standard server logs (such as IP address, browser type, and timestamps) and, as we improve the product, records of how the application is used — which features are used, where people get stuck — so we can make Steward better. This is product improvement, not advertising.

Payment and billing information. Subscription payments are processed by Stripe. Full card numbers never touch our systems. We receive and may store billing metadata such as subscription status, billing contact, invoices, card brand and last four digits, and billing address.

How we use information

To provide the service: generating your reports, insights, and monthly close; processing your imports; delivering owner reports to the recipients you choose.
To support you and improve the product: our team may access account data when necessary to provide support, troubleshoot issues, onboard pilot users, maintain security, or improve Steward. Where possible, we use aggregated, de-identified, or limited-access information for product improvement.
To communicate: service messages (receipts, notifications, your reports), product updates, and — if you signed up for our list or events — occasional marketing, always with a working unsubscribe.
For security and legal compliance: protecting the service, our users, and meeting legal obligations.

What we never do

We never sell your data. To anyone. For anything.
We never disclose your identifiable data to other operators. We may use aggregated or de-identified information to improve Steward, develop benchmarks, and understand product performance — but never in a way that identifies you, your owners, guests, tenants, properties, or business.
We never contact your owners, guests, or tenants for our own purposes, or advertise to them.
We don't use advertising trackers or sell information to ad networks.

Your customers' data

For the personal information contained in your account — about your guests, tenants, owners, landlords, partners, and prospects — you are the data controller and Steward is your processor: we handle it only to provide the service to you, under your instructions. If one of them asks you about their data, we'll support you in responding — your data is exportable, and specific records can be corrected or removed. Where required, these obligations may be addressed in a Data Processing Addendum or other applicable agreement.

Team members

If you invite team members to your account, they can access your data according to the account settings and permissions available in Steward. You're responsible for managing who's on your team and what they can see.

AI features

Steward uses AI to help draft things like report narratives — always inside your own account, from your own numbers. Steward is designed to generate drafts using the information selected for that report or workflow. We do not use your business data to train AI models, and we do not opt in to AI model training or submit your business data as AI feedback for training purposes unless we have your permission. Our AI provider does not use content submitted through Steward to train its general models unless we expressly opt in or submit feedback through a permitted process. Our AI provider is listed below and processes this data as a service provider, not for its own purposes.

We use a small set of service providers to run Steward — currently: Supabase (database and authentication), Vercel (hosting), Google (workspace, email, and file infrastructure), Stripe (payments), Anthropic (AI drafting), and Resend (email delivery). Each processes data solely to provide their service to us, under contractual obligations. We may update this list as our infrastructure evolves; the current version always lives in this policy.

We may also disclose information if required by law, or as part of a business transaction such as a merger or acquisition (in which case this policy's protections travel with the data).

Integrations you connect

Steward can connect to services you already use, at your direction — today that includes iGMS and PriceLabs, and we are always working to improve the product, which may mean future connections to additional property management systems and tools (such as Guesty, OwnerRez, Lodgify, Hostfully, and others) as well as booking platforms and financial tools.

Two things stay true about every integration:

You connect it, and you can disconnect it. Data flows because you authorized it. Disconnecting an integration stops future syncing from that service; information already imported into Steward remains in your account unless you delete it or request deletion.
We read; we don't write. Steward pulls data from your connected systems to present clean, polished reporting and insight on your behalf — it does not modify, push to, or manage anything inside those systems. Your PMS runs your operation; Steward reports on it, and provides insights to help you run it more efficiently.

Cookies

We use cookies and similar storage for functionality: keeping you logged in, remembering preferences, and maintaining sessions. We may use privacy-respecting analytics to understand product usage. We do not use advertising cookies or third-party ad trackers.

Your choices

You may request access, correction, export, or deletion of your account data by contacting privacy@steward.host. We may need to verify your request, and we may retain certain information where required by law. Marketing emails always include an unsubscribe.

Retention and deletion

We retain your data while your account is active and as needed for legal, accounting, and security purposes. You can export your data at any time. To close your account or request deletion, contact privacy@steward.host and we'll act promptly; some information may be retained where required (for example, billing records), and deleted data may remain in backups or logs for a limited period before being overwritten or removed, unless we are required to retain it for legal, security, or accounting purposes.

Security

We use security measures such as encryption in transit and at rest, access controls, limited administrative access, monitoring, and review of key vendors. No system is perfectly secure, but we design to keep what we hold minimal, so there is less to protect. If we determine that a security incident requires notice, we will notify affected users without unreasonable delay and as required by applicable law.

Report recipients

If you receive a Steward-generated report, the Steward customer chose what to share with you; the report is theirs. Questions about your information in it should go to them, and we'll support them in answering.

Children

Steward is a business tool and is not directed to anyone under 18.

International users

If you use Steward from outside the United States, or provide data about individuals outside the United States, you understand that information may be processed in the United States and other countries where our service providers operate. Where required, we use appropriate transfer mechanisms.

Changes to this policy

We'll post updates here with a new effective date. For material changes, we'll present the updated policy in the app.

Contact

privacy@steward.host · Steward, LLC