Security
How your data is handled.
What we hold, how it is protected, where it lives and how long we keep it. In plain words, with the limits said out loud. Last reviewed October 8, 2026.
What we hold
As little as the product needs.
- About you
- Your name, your work email and your role on the account. There is no password to store: you sign in with a one time link sent to your email, or with Google.
- About your hotel
- The details you enter, such as its name and address, room count, tier, your minimum rate, and the competitors you choose to track.
- About payments
- Stripe takes the payment and holds the card. We never receive or store the full card number. Stripe shows us the last four digits, the card brand and the billing country, and we keep our own record of each charge: the amount, the invoice number and whether it went through.
- About your use of it
- The request logs that our servers and our hosting providers write: what was asked for, when and by which account. They can include your IP address, and they are there to run the service and keep it secure.
- Nothing about your guests
- RevStar reads public prices. It does not connect to your reservations, and we ask you not to enter guest personal data.
- No ads and no trackers
- The application runs no advertising pixels, no third party analytics and no session recording. The only cookies it sets are the ones that sign you in and keep you signed in.
How it is protected
- Encrypted on the way and where it is stored.
- Your connection to RevStar is encrypted with TLS. What we store sits with our database provider, which encrypts it at rest.
- No passwords to steal.
- A sign in link works once and expires in 15 minutes. We store no passwords at all.
- Each account sees only its own hotels.
- Every request for a hotel's data is checked on our servers against the account of the person signed in, before anything is returned.
- You decide who gets in.
- An owner invites people by email and chooses which hotels each one can see. An invitation works once.
- Keys are kept out of the code.
- Credentials and keys live in a managed secret store and are never committed to source control.
- Our own access is limited, and changes are recorded.
- Production systems are open only to the people who need them. Every change our staff make to a customer account is recorded, with who made it and when, and so is each time one of them signs in as a customer to help. Looking at an account without changing it leaves no such record.
Where it lives
In the United States, with the providers listed here.
| Provider | What it does for us | Where |
|---|---|---|
| Cloud hosting provider | Application hosting and email delivery | United States |
| Database provider | Managed database | United States |
| Web hosting provider | Web application hosting and delivery | United States |
| Stripe | Payment processing, subscription billing, invoices | United States |
| Sign in with Google, address lookup and mapping | United States | |
| AI model provider | Written rate observations and nearby public events | United States |
| Rate data providers | Collection of publicly published hotel rates and listings. They receive hotel names and stay dates, not your personal data | United States |
The same list is section 5 of the Privacy Policy, and it changes there first.
How long we keep it
You can delete a hotel, or the whole account, yourself in Settings.
| What | How long |
|---|---|
| Your account and hotel details | For as long as your account is open. |
| Detailed rate history, events and written observations | 60 days. Older rows are deleted automatically. Summary information your charts need may be kept longer. |
| A hotel you delete in Settings | Its compset, rate history, events and insights are erased when you delete it. This cannot be undone. |
| An account you delete in Settings | The account, every hotel on it and the people invited to it are erased when you delete it. This cannot be undone. |
| An account you ask us to close | Account and hotel data are deleted within 90 days, except records the law requires us to keep. |
| Billing and tax records | As long as the law requires, normally seven years. Stripe holds the invoices, and they stay there after an account is deleted. |
| Request and security logs | Up to 90 days for the application, and longer for aggregated security records. |
| The record that a hotel has had its free trial | Kept after a hotel or an account is deleted, so the same hotel cannot take the free trial twice. It holds the email address that started the trial, the hotel's name and its location. |
| The record that a deletion was asked for | Kept after the deletion: who asked, when, and the names of the hotels removed. |
What the AI is sent
RevStar uses an AI model, run by one of the providers listed above, for two jobs, and this is what each one is sent.
- To find events near you
- Your hotel's city and state, its map coordinates, the radius you set and the dates to search.
- To write your suggestions
- Your hotel's name and tier, where your rate usually sits against your competitors', and for each night your public rate, the lowest, middle and highest rate among your competitors, how many of them were sold out and the events nearby. It is also given the names of any competitors left out of the comparison.
It is not sent your email address, your billing details or anything about a guest.
A rate that comes back is held inside the range your competitors actually charged on those nights before you see it, and nothing is ever applied to your rates automatically.
What we do not have yet
Better you hear it from us.
No independent audit report. We do not hold a SOC 2 report or an ISO 27001 certificate.
No outside penetration test. Nobody independent has been paid to try to break in yet.
No paid bug bounty. A report is welcome and we will act on it, but we do not pay for findings.
No uptime guarantee. We aim to keep the service available and the Terms commit to no specific level.
If your review needs an answer that is not on this page, ask at team@shiningstar.software and we will answer in writing.
Report a security problem
Email team@shiningstar.software with what you found and the steps to see it. Please do not look at another customer's data or disrupt the service while you test.
If you think someone has been in your account, write to the same address straight away. If a breach ever affects your personal data, we will tell you and any regulator the law requires, without undue delay.
RevStar is operated by Shining Star Software, from the United States. The full detail of what we collect and your rights over it is in the Privacy Policy.