Legal · Privacy

Privacy Policy

Plain-English version: we collect what we need to run your marketing, we don't sell your data, and we explain every third party we share with below.

Last updated · October 12, 2026

01Who we are

STR Leads is operated by High Country Software LLC d/b/a STR Leads ("we", "us"), Denver, CO · USA. We provide marketing tools for short-term rental operators: STR Direct, a direct booking website with booking-source reporting, and STR Social, a social media content and scheduling tool. For privacy questions, email [email protected].

Website analytics

On str-leads.com we use PostHog, Google Analytics and the Meta Pixel to understand visits to our marketing pages, campaign sources, product-link clicks, and inquiry-form outcomes. They use a browser identifier and cookies or local storage to connect visits, including across our subdomains. Our explicit analytics events do not include the name, email, or message you enter in an inquiry. Session recording and automatic form-content capture are disabled on this marketing site. You can turn all three off with the control in section 04.

02What we collect

From you (account data)

  • Name, email, company name, and billing address.
  • Property details you import or enter — photos, descriptions, pricing, amenities.
  • Payment method, handled by Stripe (we never store full card numbers).

From the social accounts you connect

When you connect Instagram, Facebook, TikTok or YouTube to STR Social, we store:

  • the access token the platform gives us, encrypted at rest;
  • the IDs and names of the page, account or channel you connected;
  • the IDs and results (reach, engagement) of the posts we published for you; and
  • the content you ask us to publish.

We use this only to publish on your behalf and to show you your results. We don't use it for advertising and we don't sell it. You can revoke our access at any time from Settings → Channels in the app, from the platform's own connected-apps settings, and for Google at https://security.google.com/settings/security/permissions.

YouTube API Services. STR Social uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms) and Google's Privacy Policy (https://policies.google.com/privacy). Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Automatically (usage data)

  • IP address, browser type, device, referring URL, and pages visited on STR Leads domains.
  • Cookies and session-storage values required to keep you logged in and to remember preferences.

From your guests (if you enable tracking)

  • When a guest visits your direct-booking site, we record anonymized page views, click-throughs, UTM parameters, and — on checkout — the booking details you receive yourself.
  • If you enable Meta CAPI or Google Analytics on your site, we forward the same events to your own accounts with those providers on your behalf.

03Subprocessors

We only share data with the providers that help us run the service:

  • Cloudflare — hosting, content delivery and file storage.
  • Neon — database.
  • Railway — our content generation service.
  • Sentry — error reporting for the STR Direct sites.
  • Resend — transactional email.
  • Stripe — billing and payment processing. They see your card details; we don't.
  • OpenRouter, fal, PiAPI and ElevenLabs — AI generation of pictures, video and music from the photos and text you give us.
  • PostHog — product analytics.
  • Google Analytics and Meta Pixel — marketing analytics on str-leads.com only, not inside the app.

We do not sell personal data, rent mailing lists, or share data with ad networks for purposes other than measuring our own marketing site and your own attribution.

04Cookies and session storage

We use a small number of first-party cookies and session-storage entries:

  • Session — keeps you logged in.
  • Preferences — remembers things like dashboard view state.
  • Attribution — persists UTM parameters across pageviews so we can credit the right channel at booking time.
  • Marketing site analytics — on str-leads.com, Google Analytics (GA4), the Meta Pixel and PostHog set their own cookies or local storage to measure visits and campaigns.
  • Your direct-booking site — if you connect your own Meta Pixel or Google Analytics to your site, those set their own cookies there. You control these per-property.

Some of that marketing measurement can count as "selling" or "sharing" under US state privacy laws. To turn it off in this browser, use the button below. It sets a no-tracking=1 cookie for one year, and while it is set we don't load Google Analytics, the Meta Pixel or PostHog on our marketing site. We treat a Global Privacy Control signal from your browser the same way.

Our marketing pages may show embedded Instagram posts. Loading an embed connects your browser to Instagram, which may receive technical information and use cookies under its own privacy policy. Each example also links to the original post.

05How long we keep data

  • Account data: for as long as your account is active. When you delete your account, your content and media are removed immediately; invoices and payment records stay with Stripe and in our books for as long as tax law requires.
  • Booking and attribution data: 36 months, so year-over-year reporting works. You can request earlier deletion.
  • Email marketing consent: until you unsubscribe, plus 24 months of suppression to honour your preference.

06Your rights

Delete your account any time from Settings → Account in the app; everything you imported and made is removed immediately and your subscription ends. If you reached us through Meta's data-deletion flow, your request status is at https://social.str-leads.com/data-deletion.

You can also request a copy of the personal data we hold, correct anything inaccurate, or ask us to delete it. Email [email protected] from the address on your account. We'll respond within 30 days. Colorado residents can exercise their CPA rights the same way.

07Security

Data in transit is encrypted with TLS 1.2+. The access tokens for your connected social accounts are encrypted at rest. We ask each platform only for the permissions we need to publish and report, and we follow least-privilege principles for our own service credentials.

08Children

STR Leads is for business use. We don't knowingly collect data from anyone under 16.

09Changes to this policy

If we make material changes, we'll email account owners at least 14 days before they take effect, and post a notice here. Continued use after the effective date constitutes acceptance.

10Contact

Privacy questions: [email protected]
General: [email protected]
Mailing: High Country Software LLC d/b/a STR Leads · Denver, CO · USA