In effect from September 15, 2026
This addendum applies to every host who connects a calendar feed to ResLink and whose use of it is subject to the UK or EU General Data Protection Regulation, or to any other law requiring a written agreement of this kind. Nothing needs to be signed or requested: it forms part of the terms of service and takes effect when you accept them.
Where this addendum and the terms of service disagree about the handling of personal data, this addendum wins.
In plain words: Your guests’ booking dates are yours. We hold them for you and do nothing else with them.
For the booking information in the calendar feeds you connect, you are the controller and we are your processor. You decide to connect each feed, you decide who receives a cleaner link, and you are responsible for having the right to do both.
For your own account — your email address, your plan and your billing record — we are the controller, and the privacy policy covers it. This addendum is not about that data.
Subject matter and purpose. Reading the calendar feeds you connect, and showing the resulting cleaning schedule to whoever holds a cleaner link you have created.
Nature of the processing. Automated import on a schedule, storage, and display on request.
Types of personal data. Arrival and departure dates, nights occupied, whether a date is a guest booking or a period you have blocked, and the property name you chose. Some booking platforms put a guest’s name in the feed’s summary line; we read that line only to tell a booking from a blocked period and then discard it. Guest names, guest contact details, prices and payouts are not stored.
Categories of data subjects. Your guests, indirectly and by date rather than by name.
Duration. For as long as your account exists. Deleting a property removes its dates; deleting your account removes everything.
We process that data only to provide the service as described above, and only as you instruct us through the product — the feeds you add, the links you create, the links you revoke. We do not use it for our own purposes, we do not sell it, we do not use it to train anything, and we do not use it for advertising.
If we ever believe an instruction from you would break the law that applies to us, we will tell you rather than act on it. If the law requires us to process your data in some other way, we will tell you first unless the law forbids that.
Access to your data is limited to the people who need it to run or support the service, each of whom is under a duty of confidence that survives the end of their involvement. Today that is the owner of Centaury Hospitality LLC. Anyone added later is bound before they are given access.
In plain words: A cleaner link is a long random address that search engines are told to ignore, and you can replace it whenever you want.
The measures in place today:
Measures may change as the service changes, but not in a way that lowers the standard of protection.
You authorize us to use the suppliers listed on the subprocessors page. Today they are Supabase, Vercel, Resend.
Each is engaged under written terms imposing data protection obligations no weaker than these, and we remain responsible to you for what they do with your data. We will tell you by email before adding or replacing one, and if you object on reasonable data protection grounds you may end your subscription and receive a refund for the unused part of the period you have paid for.
The database is in Canada, in Montreal. Website hosting and our email provider are in the United States, and we are a United States company, so if you are in the UK or the EU your data is transferred out of it.
For those transfers, the European Commission’s Standard Contractual Clauses for controller-to-processor transfers, and the UK Addendum to them, are incorporated into this addendum and apply as if set out here in full. You are the data exporter and Centaury Hospitality LLC is the data importer; the subject matter and duration are those in clause 2, and the security measures are those in clause 5. Where a supplier is itself certified under the EU-US Data Privacy Framework, we rely on that certification for transfers to it.
If a guest exercises a right — access, correction, deletion, objection — you are the one who answers them, and we will help. In practice you can do most of it yourself: your own pages show every date we hold, deleting a property removes its dates, and generating a new cleaner link cuts off the old one. If you need something the product cannot do, ask us and we will do it within the time your own deadline requires.
We will also give you, on request, the information you reasonably need for a data protection impact assessment or a consultation with a regulator, insofar as it concerns this service.
If we become aware of a breach of security affecting your data, we will tell you without undue delay and in any event within 48 hours of becoming aware of it, by email to the address on your account. We will tell you what we know, what we are doing about it, and what we recommend you do — and we will keep telling you as we learn more. Notifying a regulator or your guests is your decision as controller, and we will give you what you need to make it.
You can delete your account yourself at any time from your account page, which removes your properties, feeds, links and booking dates from the live database.
If we end the service instead, we will delete your data within 30 days unless you ask us to hold it longer while you move. Encrypted provider backups age out on their own schedule, within 30 days, and are not used for anything else in the meantime. Where the law requires us to keep something, we keep only that and only for as long as required.
On request, we will give you the information you reasonably need to satisfy yourself that we are meeting this addendum — what we store, where, under what measures, and the terms our suppliers are under. Centaury Hospitality LLC is a small company and does not hold third-party audit certifications of its own; our hosting and database providers do, and we will point you at theirs. If your own regulator requires an inspection, we will cooperate with it at your cost.
Write to hello@res-link.com. Our company details and postal address are on the contact page. If you need this addendum as a countersigned document for your own records, ask and we will sign it.