Privacy Policy.

Who is responsible for your data

The controller, the company that decides how your personal data is used on this website, is:

Company

Cloudsource LTD

Trading as

MSM Rentals

Website

https://www.msmrentals.com

Contact form

https://www.msmrentals.com/contact

Registered office

Strovolou 77, STROVOLOS CENTER, Office 401, 2018 Strovolos, Nicosia, Cyprus

Company registration

HE 478194

VAT number

CY60185107T

Controller or processor: which one we are

For this website, for enquiries you send us, and for bookings you make directly with us, MSM Rentals is the controller: we decide what is collected and why.

MSM also manages homes on behalf of the people who own them. Whether we act as controller or as processor for guest data arising from a particular home depends on the management agreement for that home.

What we collect, and when

There is no advertising pixel and no profiling. What the site does put on your device is listed, item by item, in the Cookie Policy.

You give us personal data only when you choose to:

• Write to us, by email or through the contact form on our website. We receive your email address, your name if you sign it (the contact form asks for it), and whatever you tell us. We use it to reply and to continue that conversation. A message sent through the contact form goes to MSM's own inbox, where only MSM staff read it, and we keep it as we keep other enquiry records, without a defined deletion schedule. We cannot check that the email address typed into the form really belongs to the person who sent it: a message is filed under the address it gives, and if someone uses your address, that message is included when you ask us for your data.
• Book a stay directly. We collect the name, email address and telephone number of the person booking, the dates and the home, and any details you add about your party. Payment is taken by Stripe: your card number is entered inside Stripe's own secure frame and never reaches MSM.
• Use the Guest Companion for a stay. Opening your personal Companion link creates a session so the site knows which stay is yours. What you see there is information about your stay and your home.
• Ask us to review your property. The owner enquiry form sends us, by email, your name, email address, telephone number and location, what you tell us about your property and your situation, any listing link and message you add, and the language you were reading in, so that we can see whether we are a good fit and reply to you.
• Ask about availability for a home. The availability enquiry sends us, by email, your first and last name, email address and telephone number, the home, your dates, the number of guests and pets, any message you add, and the language you were reading in, so that we can reply to you. It makes no reservation and takes no payment.
• Use the Owner Portal or the Guest Portal. Your account holds your email address, your name, your password (stored only in a one-way, unreadable form), your settings, such as your language, and when you last used each portal. Signing in creates a session so the portal knows it is you.

When a booking reaches us, we set up a Guest Portal account for its main guest. It holds the guest's name from the booking, with no email address and no password. If we decide not to accept further bookings from someone, we record that on their account, with a reason category (conduct, payment, damage or other) and, where needed, a short staff note.

Bookings made through a channel such as Airbnb or Booking.com reach us from that channel, through our property management system. What they share with us is decided by them; some channels share only a first name.

Why we use it, and on what basis

• To arrange and deliver a stay you have booked, because it is necessary to perform that agreement with you.
• To answer you in the assistant chat, where a stay offers it and you use it, because we have a legitimate interest in helping you with your stay, and you choose whether to use it.
• To reply to an enquiry you have sent, including a request to review your property, a question about availability or a message through our contact form, because you asked us to, and we have a legitimate interest in answering.
• To protect the contact form from automated abuse we keep a keyed, one-way hash of the sending network address (pseudonymised, not anonymous) for a limited period only; we do this because we have a legitimate interest in keeping the form secure.
• To give you an Owner Portal account and sign you in: for owners, because it is necessary to perform our management agreement with you; for people an owner authorises to use the portal on their behalf, because of our and the owner's legitimate interest in letting them do so; and for former owners, who keep read-only access to the bookings and work of their own ownership period for a limited time after it ends, because of our and their legitimate interest in letting them look back at that period.
• To keep a single record for the main guest of each booking we hold, our system sets up a Guest Portal account when the booking reaches us. It holds only the guest's name from the booking, no email address and no password, so it cannot be used to sign in, and setting it up sends you nothing. It is the account the guest would use if we offer them the portal in future. We do this because we have a legitimate interest in keeping each guest's record together in one place. You can object to this at any time; we will delete the automatic account and stop it being recreated from the booking records it came from. Future bookings under those same records will then not be linked to you automatically, though our team may still link them by hand where appropriate.
• To take a payment and to prevent fraud, because it is necessary to perform the booking, and because Stripe must be able to detect fraudulent card use.
• To load optional parts of the website, such as the interactive map, only with your consent, which you can withdraw at any time.

Short-term rental accommodation is also subject to statutory obligations in some places, including reporting guest details to the authorities.

Who else is involved

• Stripe: takes card payments for direct bookings. Stripe processes payments outside the European Economic Area.
• OwnerRez: our property management system. It holds reservations and the photographs of the homes, which are delivered to your browser from its image service.
• OpenStreetMap Foundation: supplies the map tiles, and only if you have allowed the map.
• The Cloudsource AI platform, and Anthropic as the provider of its AI model: only for a stay where the assistant chat is switched on, and only when you use it.
• Our email and hosting providers, which carry and store the messages and the website itself.

We do not sell personal data, we do not share it for advertising, and we have no advertising or analytics technology running on this website.

The assistant chat in the Guest Companion

The Guest Companion can offer an AI assistant chat for a stay. It appears only where we have switched it on for that stay. If yours offers it and you use it, this is what happens.

• What you write in the chat is processed to answer you.
• Facts about your own stay are made available to the assistant, limited to a fixed set: your first name, the home and its area, the dates and number of nights, your party, the booking status, the check-in and check-out times and the time zone. Never door or access codes, access instructions, Wi-Fi passwords, payment details, contact details, your surname or internal reference numbers.
• Information about the home that we prepare for guests, and what our website publishes about our homes, is made available to the assistant too.

The chat is provided through the Cloudsource AI platform. Its replies are generated by an AI model from Anthropic, which processes your messages to do so. We use Anthropic's model under Anthropic's commercial terms, which include its data processing addendum. That processing is not limited to the European Union and may take place outside the European Economic Area.

Chat platform operator

Cloudsource LTD, the same company as the controller

We offer the chat because we have a legitimate interest in helping you with your stay. Using it is your choice, and nothing about your booking depends on it. It is an AI assistant, not a person. It is set up to answer from what we give it about your stay and your home, and it can make mistakes.

The chat platform deletes a conversation 30 days after its last activity, and can delete your conversation sooner if you ask us. That period is set and enforced on the platform, not by this website. Deleted conversations can remain for a short time in the platform's backups.

If you ask for a person, or the assistant cannot help with something, it records the request, and an email goes to MSM's staff mailbox with the assistant's summary and your booking details (your name, the home, the dates and your party). We keep a record of the request (when it arrived, what kind it was, which stay it concerns and the chat's conversation identifier) and the email in our message history, like other reservation records, without a defined deletion schedule.

How long we keep it

Two retention facts are true today, because they are how the software actually works: your cookie choices stay on your own device until you change them or clear your browser storage, and the Guest Companion keeps you signed in to your stay with a cookie on your device for up to 30 days, and never beyond the end of the day after your check-out.

Reservation and enquiry records, and portal accounts, are currently retained without a defined deletion schedule; an account is removed only when it is deleted.

How long the chat platform keeps an assistant chat conversation is stated in the section on the assistant chat.

Your rights

Under the EU General Data Protection Regulation you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, object to our use of it, and ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time: for cookies, from “Cookie settings” at the bottom of any page.

Write to us through the contact form (www.msmrentals.com/contact) and a person will answer. You also have the right to complain to a data protection supervisory authority.

Cookies and similar technologies

Everything this website puts on your device, or loads from a third party, is listed in the Cookie Policy, generated from the same list the site itself enforces, so the two cannot disagree. Nothing optional loads before you allow it.

Changes to this policy

When this policy changes we update the date at the top. If a change means we start using your data for something genuinely new, we will ask again rather than assume.