Andora Privacy Policy

This policy explains what personal information we collect through Andora, how we use and share it, and the choices and rights you have.

In short:

• Andora is free software for vacation rental hosts, provided by Rove Ventures Inc.
• We handle guests' information mainly for the hosts who use Andora. We don't sell it, use it for advertising or market to guests, unless a guest chooses in Booking Pass to receive Rove Travel offers.
• Booking Pass may use biometric information to verify a guest's identity, only with the guest's consent, and we destroy it within 30 days after the verification attempt ends (section 5).
• For questions or requests, email support@andora.ai.

1. Who We Are and What This Covers

Andora is a brand of Rove Ventures Inc., a Delaware corporation ("we", "us" or "our"). This policy covers Andora, our software for running vacation rentals, and our Andora websites and apps (the "Services").

One account works on Andora and on Rove Travel, our vacation rental marketplace. Rove Travel has its own privacy policy, which covers Rove Travel bookings, including Booking Pass for them, and visitors to rovetravel.com.

This policy covers:

• hosts, the people and businesses who use Andora to run vacation rental properties, and their team members, the people a host gives access to its organization in Andora;
• visitors to andora.ai and our other Andora websites; and
• guests of hosts who use Andora: people who book, stay at or ask about a stay at a host's property through a channel other than Rove Travel (another website or app where the property can be booked), including when they complete Booking Pass. If you booked on Rove Travel, the Rove Travel privacy policy covers you, including when your host uses Andora for your reservation. It also covers you if you stay at a home we manage through Rove+, whatever channel you booked through.

"Personal information" means information that identifies, relates to or could reasonably be linked to you or your household, including business contact details.

2. Our Roles

Hosts, team members and visitors. We decide how and why we use information about hosts, team members and visitors, so we're responsible for it as its controller (or "business", as some state laws put it).

Guests' information we handle for hosts. When a host uses Andora, we handle its guests' information for the host, on its instructions, as its service provider or processor. The host decides how it uses that information and may have its own privacy notice. If you're a guest and want to see, correct or delete information a host holds through Andora, contact the host first. If you contact us, we may pass your request to the host or tell you how to reach them, and we help hosts respond.

Booking Pass screening. We're the controller for information from identity verification and screening in Booking Pass ("Booking Pass screening information"), so contact us about it directly (section 5).

Rove Travel offers. If you choose in Booking Pass to receive Rove Travel offers, we're also the controller for the information you give us for them, and we use it as sections 4 and 10 describe.

3. Information We Collect

We collect these categories of personal information, from these sources:

• Account and profile: name, email address, phone number, profile photo, sign-in details and settings. From you; from the host or admin who invites you; and, if you sign in through another service, the details you let it share with us, such as your name, email address and profile image.
• Organization and team: the organization you belong to, your role and permissions, and invitations. From you and your organization's admins.
• Properties, listings and reservations: listing content and photos, house rules, rental agreements, calendars, prices, reservations and reviews, including guests' names, contact details, dates and party size. From hosts and their teams, and from the channels and other services a host connects.
• Messages: messages between hosts, their teams and guests; hosts' instructions and settings for AI features; and what AI features write or do. From hosts, team members, guests and our AI features.
• Payments and payouts: for hosts, the identity, business, bank account and tax information needed to verify you and pay you, and records of payouts and deductions; for guests, records of payments, deposits and card holds we handle for a host, while card details go to our payment processors. From you, our payment processors and channels. Payouts go through Stripe, which also collects information from hosts under its own agreement and privacy policy.
• Identity verification and screening (Booking Pass): the details a guest gives in Booking Pass; images of their ID and the information on it, such as name, date of birth and ID number; a selfie, and biometric information made from it and the ID photo (section 5); the device and connection used; and screening results. From the guest and our identity verification providers and, for screening, from other sources, such as public websites and screening providers.
• Device, usage and cookie information: IP address and the approximate location it suggests, device and browser type, device identifiers, the pages and screens you view, what you click or tap, the site that sent you, errors, and recordings of how you use our websites and apps (section 7). Collected automatically on our websites and in our apps, including through cookies and similar technologies (section 7) used by us and our analytics and advertising partners.
• Support: what you tell us when you contact us, and what we learn while helping you. From you.
• Marketing preferences: whether you've agreed to or opted out of our marketing, including whether a guest chose in Booking Pass to receive Rove Travel offers, and how you interact with it. From you and from our marketing emails.

If you give us information about someone else, such as a team member you invite, make sure you're allowed to.

4. How We Use It

We use personal information to:

• provide the Services, such as running accounts and organizations, syncing with channels, delivering messages, running AI features and Booking Pass, collecting payments for hosts and paying hosts, and giving support;
• improve the Services, by understanding how they're used, fixing problems and building new features;
• verify guests and screen bookings in Booking Pass, and give hosts the results for the stay (section 5);
• keep people and the Services safe, by preventing fraud, abuse and security incidents, and by reviewing activity and content in Andora to enforce our terms;
• communicate with you, such as about your account, reservations, payouts, security and changes to our terms;
• market our services to hosts and visitors, and Rove Travel to guests who choose in Booking Pass to receive Rove Travel offers, subject to your choices in section 10; and
• meet legal, tax and accounting obligations, and establish or defend legal claims.

AI. Some features use AI, including agents that act on a host's settings and instructions. To run them, we and our AI providers process messages, reservation details, listing content and hosts' instructions, and AI may write or send messages to guests for a host.

Guests' information. We use guests' information only to provide, support and improve the Services for hosts, for Booking Pass screening, to keep people and the Services safe, and to meet legal obligations. We don't use it to market anything to guests, except Rove Travel offers to guests who choose in Booking Pass to receive them, which never promote their host's own properties. Hosts may not send guests marketing through Andora.

Sensitive information. We use sensitive personal information, such as ID details, biometric information and bank account details, only to provide the Services, verify identity, pay hosts, keep the Services secure and meet legal obligations.

5. Booking Pass and Biometric Information

Booking Pass is our pre-arrival check-in process. It's set up and reviewed by the host, or by us on the host's behalf. This section covers Booking Pass for reservations made through channels other than Rove Travel. Your entry details and check-in instructions may be released only after your Booking Pass is complete and approved. The rental agreement, deposit and card hold in Booking Pass are handled for the host, like other guests' information (section 2).

Identity verification. Booking Pass may ask you to verify your identity with a photo of your ID and a selfie. To check that you're the person on the ID, we and our identity verification providers compare the two using facial geometry, which is biometric information.

Your consent. Before collecting biometric information, Booking Pass asks for your written consent to its collection, use, storage and disclosure to our identity verification provider, Persona, including reuse of the verification result for your later reservations, and we don't collect it without your consent. If you don't want to complete this step, or it doesn't work, contact us at support@andora.ai, and our team can verify your identity another way, such as a short video call.

How we use and share it. We use biometric information only to verify your identity in Booking Pass. We never sell, lease or trade it, or otherwise profit from it. We disclose it only to the service providers who perform the verification for us, or where the law requires.

Retention and destruction. This is our public retention schedule and destruction policy for biometric information. We and our identity verification provider permanently destroy biometric information within 30 days after your verification attempt ends, whether it succeeds, fails or is abandoned. We keep only the result of the check, such as whether your identity was verified and your verified name, and may reuse that result for your later reservations.

Screening. Booking Pass may also screen the booking for fraud and safety risk, using the details you give and information from other sources, such as public websites and screening providers. We screen each reservation separately and don't share screening results with other hosts. Your host receives the outcome of your Booking Pass and may ask us for a summary of it, whose details may vary. Hosts never receive your ID images, selfie or biometric information. Your host may use what it receives only for your reservation, as the Andora Terms of Service require. Results can be wrong. If you think one about you is wrong, tell us at support@andora.ai.

Questions and requests. We're responsible for Booking Pass screening information, so email us about it, including to ask us to delete it. We may keep what we need for that stay, a dispute, fraud prevention or the law, but biometric information always follows the schedule above.

6. How We Share It

We share personal information with:

• Service providers who process it for us, such as hosting, payments, communications, analytics, AI, identity verification and screening providers. Our contracts limit how they use it, and some, such as payment processors, also use it under their own privacy policies. Our current subprocessor list is at andora.ai/resources/subprocessors.
• Channels and other services a host connects, including outside AI tools. We exchange listings, calendars, prices, reservations, messages and guests' information with them as the host directs. Others run them, and their own privacy policies govern what they do with it.
• Hosts and their teams. Guests' information, including messages, the Booking Pass outcome and any summary the host asks for (section 5), goes to the host and the team members it gives access to.
• Rove Travel. Account details are shared across Andora and Rove Travel so one account works on both. If a host lists on Rove Travel, we send Rove Travel the host's listing content, calendars and prices and receive its Rove Travel bookings. The Rove Travel Privacy Policy describes Rove Travel's own use of listing hosts' information. We don't use information about guests from other channels for Rove Travel, except to send Rove Travel offers to guests who choose in Booking Pass to receive them.
• Advertising and analytics partners on our websites, who collect device, usage and cookie information through cookies and similar technologies and may use it for their own purposes, including to show you ads on other sites and apps. We also send advertising partners, in hashed form, contact details we hold about hosts and visitors, such as an email address, name and phone number, with events such as signing up, so they can measure our ads and show them to people likely to be interested. We never send them information about guests of reservations from other channels, including guests who choose to receive Rove Travel offers. Some state privacy laws may treat this as a "sale" or "sharing" of personal information, or as targeted advertising (section 10).
• Legal and safety recipients, when we reasonably believe it's needed to comply with the law or legal process, respond to government requests, enforce our terms, prevent fraud, or protect the rights, property or safety of anyone.
• A buyer or successor, as part of a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business.
• Others, with your consent or at your direction.

We may share any category in section 3 with these recipients as needed for the purposes in section 4, but section 5 limits how biometric information is shared. Apart from what we share with advertising and analytics partners as this section describes, we don't sell or share personal information as state privacy laws use those words. We never sell guests' information, Booking Pass screening information or biometric information, or use them for advertising, and we don't share mobile phone numbers or text messaging consent with third parties or affiliates for their marketing.

7. Cookies and Similar Technologies

We and our partners use cookies, pixels, local storage and similar technologies on our websites and in our apps to:

• keep you signed in and make the Services work;
• remember your settings;
• understand how the Services are used and fix problems; and
• measure our advertising and show our ads to people who have visited our websites.

We and our service providers may record how you use our websites and apps, such as clicks, scrolls, typing and pages viewed, to fix problems and improve the Services.

We also send hashed contact details to advertising partners from our servers, as section 6 explains.

You can block or delete cookies in your browser settings, and limit ad personalization in the settings of the ad platforms you use. Blocking some cookies may stop parts of our websites from working. Our websites don't respond to Do Not Track signals.

8. How Long We Keep It

We keep information as long as we need it for the purposes in this policy, then delete or de-identify it. We keep de-identified information in that form and don't try to re-identify it, except as the law allows. How long depends on the type of information, whether you have an account, and what the law requires. We may keep information longer where we need it to resolve disputes, enforce our terms, prevent fraud or abuse, or meet legal, tax or accounting obligations. When a host's account or organization closes, we delete guests' information we hold for the host, unless the law requires us to keep it or we need it to resolve disputes or prevent fraud. Biometric information always follows the schedule in section 5.

9. Security

We use administrative, technical and physical safeguards suited to the information. No system is perfectly secure. If a security breach affects your personal information, we'll give notice as the law requires.

10. Your Choices and Rights

Your account and information. You can update some account details in Andora. To ask for access to, a copy of, correction of or deletion of your personal information, or to close your account, email support@andora.ai. Because one account works on Andora and Rove Travel, closing it closes it on both. We may keep information as section 8 allows. If you're a team member, closing your account doesn't delete the host's information, such as messages you sent for the host.

Guests. For information a host holds through Andora, contact the host first (section 2). For Booking Pass screening information, contact us. Andora sends guests notifications about their reservation and their host's messages according to each guest's notification preferences, which guests set in their account settings. Reply STOP to stop texts.

Marketing. To stop marketing emails, use the unsubscribe link in any of them or email us. If you chose in Booking Pass to receive Rove Travel offers, you can withdraw that choice the same way. We send marketing texts only with your consent; reply STOP to stop them. We'll still send messages about your account, reservations, payouts and security.

Texts and push notifications. Reply STOP to stop texts from us; we may then send required messages another way. You can turn off push notifications in your device settings.

State privacy rights. Depending on where you live, the law may give you the right to:

• know what personal information we collect about you and how we use and share it, and get a copy of it;
• correct it;
• delete it; and
• opt out of the "sale" or "sharing" of your personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects.

To opt out of the sale or sharing of your personal information or of targeted advertising, use the privacy settings in your account, or contact us as described below. We also treat a Global Privacy Control signal from your browser as a request to opt out for that browser. Opting out in your account settings also stops us from sending your contact details to advertising partners.

How to make a request. Email support@andora.ai or call us toll-free at +1 (877) 510-7683, and tell us which right you want to use. We'll verify your identity, for example by asking you to confirm details we hold or to write from the email address on your account. Someone else can make a request for you with your written permission, and we may still verify your identity. We won't treat you differently for using your rights. If we decline your request, you can appeal by replying to our decision; if we still decline, you can contact your state attorney general. For information we hold for a host, we may pass your request to the host (section 2).

11. Where Information Is Processed

Andora is for properties in the United States, and we're based in the United States. We and our service providers may store and process information in the United States and in other countries where they operate.

12. Children

Andora is for adults. You must be at least 18 to have an account, and Andora isn't directed to children. If we learn that someone under 18 has an account, we'll close it, and we'll delete information we collected from a child under 13. Reservation details may include information about children traveling with a guest, which we handle for the host. We don't knowingly sell or share the personal information of anyone under 16.

13. Changes and Contact

Changes. We may change this policy. We'll post each version here with its effective date. If a change is material, we'll also tell you before it takes effect, by email or in Andora, where we can. If a change would let us use information we already hold in a materially different way, we'll ask for your consent where the law requires it.

Contact. Email support@andora.ai with questions or requests about this policy. Our postal address is Rove Ventures Inc., 169 Madison Ave, #2028, New York, NY 10016.