Privacy Policy

Overview

This Privacy Policy describes how Workcuit AI ("we", "us", "our") collects, uses, and protects information across three products:

• The Staycuit AI website (this site): trial and demo requests.
• The Staycuit AI hotel-operations platform: the software our customer properties' staff use every day, on the web, as an installable web app (PWA), and as the StayCuit iPhone app. See Staycuit AI platform and the StayCuit app.
• The Staycuit PMS Bridge Chrome browser extension: a helper that hotel front-desk staff install to sync data between their Property Management System (PMS) and Staycuit AI. See the dedicated section below.

Website: information we collect

• Contact details (name, email, phone) that you provide in our forms.
• Property details (hotel/property name, number of rooms) that help us qualify your request.
• Message content you provide (optional) so we can respond accurately.

Website: how we use information

• To respond to trial/demo requests and provide product information.
• To improve the site and understand which features prospects care about.
• To communicate about onboarding, scheduling, and support.

Sharing

We do not sell your personal information. We may share information with service providers who help us operate the website and respond to requests (for example, email delivery).

Security

We use reasonable administrative and technical safeguards to protect information, but no method of transmission or storage is 100% secure.

Staycuit AI platform and the StayCuit app

This section covers the Staycuit AI platform used by hotel and motel staff: the web app, the installable web app (PWA), and the StayCuit iPhone app. Accounts are created by a property (usually by its manager) for the people who work there. The platform is not intended for hotel guests or for children.

Who decides how data is used

For data about a property's guests, rooms and operations, the property (our customer) decides why and how it is processed, and Workcuit AI processes it on the property's behalf under its agreement with us. For staff account data, we act for the property and also to run, secure and support the service.

What we collect from staff users

• Account details: name, work email, phone number (if provided), role and the properties you belong to.
• Work records: shifts and schedules, clock-in and clock-out times, timecards and payroll summaries, cash drawer and cash-drop records, time-off requests, housekeeping and maintenance activity, requests, tasks, projects, chat messages and notes you write.
• Location (only at clock-in and clock-out): when your property checks location for shift punches and you allow it, the app reads your precise location once, at the moment you clock in or out, and stores the coordinates, their accuracy and the distance from the property with that punch. We do not track your location at any other time or in the background. If you don't allow location, you can still clock in by entering a reason.
• Photos and files: photos you take or choose (for example, a work photo on a maintenance request) and files you upload to a task. The app uses the camera and photo library only when you choose to add one.
• Push notifications: if you turn notifications on, we store a device token for your device so we can send work alerts (for example, a task update or a clock-out reminder). Turn them off any time in the app or in your device settings.
• Technical data: sign-in records, security logs and diagnostic information from the services that run the app (for example, Google Firebase), used to keep the service secure and working. We don't use advertising or third-party analytics in the app.

Guest data handled by staff

Front-desk staff use the platform to check guests in. That can include guest names, contact details, stay dates, vehicle details, ID details and signed registration cards. This data belongs to the property, is visible only to staff with the right role at that property, and is kept as described in "Data retention" below.

How we use platform data

• To run the service: show the right work to the right person, keep rooms, requests, tasks and shifts in sync, and send the notifications you've turned on.
• To support your property's timekeeping and payroll, including checking that shift punches happen at the property when the property has turned that on.
• To secure the service, prevent misuse and fix problems.
• To provide support when you or your property contacts us.

We do not sell personal information, use it for advertising, or track you across other companies' apps or websites.

Service providers

We use these providers to run the platform. They process data only on our instructions:

• Google Cloud and Firebase: sign-in, database, file storage and push delivery. Data is stored in the United States.
• Apple Push Notification service: delivers notifications to iPhones.
• Render: hosts the Staycuit application server.
• Microsoft 365: sends service emails, such as invitations.

Data retention

• Account and work data is kept while your account is active and your property subscribes to Staycuit AI, then handled under the property's agreement with us.
• Time, payroll and cash records may be kept after an account is deleted, for as long as employment, tax and accounting laws require (in the US, typically 2 to 3 years or more for payroll and time records).
• Guest and registration records are kept as described in the extension section below and in the property's agreement with us.

Deleting your account

• In the StayCuit iPhone app: open More → Profile → Delete account.
• Anywhere else: email contact@workcuit.ai from the email address on your account, and we'll confirm within 5 business days.

Deleting your account removes your sign-in, your access to every property, your notification settings and your device tokens. Work records your property must keep by law (such as shifts, time and pay records) stay with the property. Content you created for your property (for example, requests, tasks and messages) stays with the property's records. If you are the last owner or manager of a property, you'll need to hand that role to someone else first.

Your choices and rights

• Ask your property manager, or email us, to see, correct or delete your information.
• Turn location access, camera and photo access, and notifications on or off in your device settings at any time.
• Depending on where you live (for example, California), you may have additional rights. Contact us to use them. We won't treat you differently for doing so.

Staycuit PMS Bridge — Browser extension

Staycuit PMS Bridge is a Chrome extension installed by hotel front-desk staff at properties that subscribe to Staycuit AI. It bridges data between a hotel's existing PMS (currently HotelKey and SynXis Property Hub) and Staycuit's check-in workflow. This section describes how the extension handles data, in addition to the general policy above.

Who is this extension for?

Front-desk staff at our customer properties — not hotel guests. Guests' personal data flows through the extension because the FD staff is processing their check-in on the PMS, but guests do not interact with the extension directly.

What the extension reads

When a signed-in user is on a supported PMS page (currently *.hotelkeyapp.com and sph.synxis.com), the extension reads:

• Reservation data shown on the page: confirmation number, guest first/last name, phone, email, mailing address, ID number, arrival and departure dates, room number, room type.
• The registration card PDF generated by the PMS, when the user clicks the "Send to Staycuit" button the extension injects on that page.

The extension does not read:

• Pages on any domain other than the configured PMS hosts.
• The user's browsing history, bookmarks, downloads, or other tabs.
• Any data on the system that isn't on the active PMS page.

What the extension sends

Data is sent to the Staycuit backend (staycuit-ai-prod.onrender.com), scoped to the property the signed-in user has selected, and stored in Staycuit's Firestore database under that property's records. Specifically:

• Reservation / guest data is attached to an existing Staycuit check-in session or used to create a new one for that property.
• The reg-card PDF is uploaded to that session's storage so it can be signed digitally on the iPad or a workstation.
• Stay changes the staff member performs in the PMS and confirms in the extension (stay extensions, room moves, checkout status) are recorded in the property's Staycuit account so both systems stay in sync.
• The extension does not send data to any third-party server, ad network, or analytics service.

Authentication

Users sign in to the extension popup with their Staycuit credentials. Authentication is handled by Google Firebase Auth. The extension stores a Firebase session token locally in the browser's extension storage so the user doesn't sign in on every page; signing out clears that token immediately.

What we do NOT do

• We do not sell data to third parties.
• We do not share data with advertisers or analytics platforms.
• We do not track the user's browsing outside of supported PMS pages.
• We do not read or modify any other websites.
• We do not collect data when the user is signed out.

Data retention

Reservation, guest, and reg-card data sent through the extension is stored in the property's Staycuit account for as long as the property maintains its subscription, subject to the Staycuit master service agreement with the property's operator. Retention and deletion of that data is governed by the property's own agreement with Workcuit AI, LLC and by applicable hospitality and legal record-keeping requirements (typically 7 years for registration documents in the US).

To delete your own Staycuit staff account (not the guest data), see Deleting your account.

How to stop the extension from sending data

• Sign out via the extension popup — stops all data flow immediately.
• Uninstall the extension at chrome://extensions — removes it entirely from the browser.

After either action, the extension cannot read or send any data until the user reinstalls and signs back in.

Permissions and why we need them

• storage — persist the Firebase session token, the selected property, and a short-lived retry queue for confirmed updates that could not be delivered while Staycuit was unreachable.
• alarms — a periodic heartbeat that retries queued updates and keeps the check-in session listener alive after Chrome suspends the extension's background worker.
• offscreen — run Firebase Auth in a hidden DOM context (Manifest V3 service workers cannot run Firebase Auth directly).
• scripting — inject the autofill helper into the PMS page so it can fill the FD form.
• Host: *.hotelkeyapp.com, sph.synxis.com — the PMS surfaces we read from and inject into.
• Host: staycuit-ai-prod.onrender.com — Staycuit's backend, where the data is sent.
• Host: Firebase / Google APIs — authentication and Firestore reads.

Contact

Questions? Email contact@workcuit.ai.