Privacy Policy.

Who is responsible for your data

The controller — the company that decides how your personal data is used on this website — is:

Company

Cloudsource LTD

Trading as

MSM Rentals

Website

https://www.msmrentals.com

Email

hello@msmrentals.com

Registered office

Strovolou 77, STROVOLOS CENTER, Office 401, 2018 Strovolos, Nicosia, Cyprus

Company registration

HE 478194

VAT number

CY60185107T

Data protection officer

To be confirmed — whether a data protection officer has been appointed, and their contact details

Controller or processor — which one we are

For this website, for enquiries you send us, and for bookings you make directly with us, MSM Rentals is the controller: we decide what is collected and why.

MSM also manages homes on behalf of the people who own them. Whether we act as controller or as processor for guest data arising from a particular home depends on the management agreement for that home, and that determination has not been made yet.

To be confirmed — the controller/processor determination for guest data arising from managed homes, and the data-processing terms in the homeowner management agreement.

What we collect, and when

Browsing this website collects nothing about you personally. There is no account system, no contact form, no advertising pixel and no profiling. What the site does put on your device is listed, item by item, in the Cookie Policy.

You give us personal data only when you choose to:

• Write to us. We receive your email address, your name if you sign it, and whatever you tell us — and we use it to reply and to continue that conversation.
• Book a stay directly. We collect the name, email address and telephone number of the person booking, the dates and the home, and any details you add about your party. Payment is taken by Stripe: your card number is entered inside Stripe's own secure frame and never reaches MSM.
• Use the Guest Companion for a stay. Opening your personal Companion link creates a session so the site knows which stay is yours. What you see there is information about your stay and your home.

Bookings made through a channel such as Airbnb or Booking.com reach us from that channel, through our property management system. What they share with us is decided by them; some channels share only a first name.

Why we use it, and on what basis

• To arrange and deliver a stay you have booked — because it is necessary to perform that agreement with you.
• To answer you in the assistant chat, where a stay offers it and you use it — because we have a legitimate interest in helping you with your stay, and you choose whether to use it.
• To reply to an enquiry you have sent — because you asked us to, and we have a legitimate interest in answering.
• To take a payment and to prevent fraud — because it is necessary to perform the booking, and because Stripe must be able to detect fraudulent card use.
• To load optional parts of the website, such as the interactive map — only with your consent, which you can withdraw at any time.

Short-term rental accommodation is also subject to statutory obligations in some places, including reporting guest details to the authorities. Which of those apply to each of our homes, and what they require, has not yet been confirmed for this policy.

To be confirmed — the statutory guest-registration and reporting obligations that apply to each home, and the data they require.

Who else is involved

• Stripe — takes card payments for direct bookings. Stripe processes payments outside the European Economic Area.
• OwnerRez — our property management system. It holds reservations and the photographs of the homes, which are delivered to your browser from its image service.
• OpenStreetMap Foundation — supplies the map tiles, and only if you have allowed the map.
• The Cloudsource AI platform, and Anthropic as the provider of its AI model — only for a stay where the assistant chat is switched on, and only when you use it.
• Our email and hosting providers, which carry and store the messages and the website itself.

We do not sell personal data, we do not share it for advertising, and we have no advertising or analytics technology running on this website.

To be confirmed — the signed data-processing agreements with each processor, and the transfer mechanism relied on for payment processing outside the EEA.

The assistant chat in the Guest Companion

The Guest Companion can offer an AI assistant chat for a stay. It appears only where we have switched it on for that stay. If yours offers it and you use it, this is what happens.

• What you write in the chat is processed to answer you.
• Facts about your own stay are made available to the assistant, limited to a fixed set: your first name, the home and its area, the dates and number of nights, your party, the booking status, the check-in and check-out times and the time zone. Never door or access codes, access instructions, Wi-Fi passwords, payment details, contact details, your surname or internal reference numbers.
• Information about the home that we prepare for guests, and what our website publishes about our homes, is made available to the assistant too.

The chat is provided through the Cloudsource AI platform. Its replies are generated by an AI model from Anthropic, which processes your messages to do so and may do so outside the European Economic Area.

Chat platform operator

To be confirmed — whether the Cloudsource AI platform is operated by the same company as the controller above, and so the data-processing role of each party involved in the chat

We offer the chat because we have a legitimate interest in helping you with your stay. Using it is your choice, and nothing about your booking depends on it. It is an AI assistant, not a person. It is set up to answer from what we give it about your stay and your home, and it can make mistakes.

The chat platform deletes a conversation 30 days after its last activity, and can delete your conversation sooner if you ask us. That period is set and enforced on the platform, not by this website. Deleted conversations can remain for a short time in the platform's backups.

If you ask for a person, or the assistant cannot help with something, it records the request, and an email goes to MSM's staff mailbox with the assistant's summary and your booking details (your name, the home, the dates and your party). We keep a record of the request (when it arrived, what kind it was, which stay it concerns and the chat's conversation identifier) and the email in our message history, like other reservation records, without a defined deletion schedule.

To be confirmed — the data-processing terms with the AI model provider and whether it retains chat messages, and the transfer mechanism relied on for processing outside the EEA.

How long we keep it

Two retention facts are true today, because they are how the software actually works: your cookie choices stay on your own device until you change them or clear your browser storage, and the Guest Companion session for a stay is a short-lived browser session that ends when you close the tab.

Beyond that, we will not state a period we do not yet enforce. Reservation and enquiry records are currently retained without a defined deletion schedule. Setting one — and building the deletion it implies — is outstanding work, and we would rather say so than publish a number that is not true.

How long the chat platform keeps an assistant chat conversation is stated in the section on the assistant chat.

To be confirmed — the retention periods for reservation records, enquiry correspondence, guest identity data and Companion content, together with the legal or tax minimums that constrain them.

Your rights

Under the EU General Data Protection Regulation you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, object to our use of it, and ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time — for cookies, from “Cookie settings” at the bottom of any page.

Write to hello@msmrentals.com and a person will answer. You also have the right to complain to a data protection supervisory authority.

Supervisory authority

To be confirmed — which data-protection supervisory authority to name for complaints

To be confirmed — the response time the operator commits to for answering a rights request.

Cookies and similar technologies

Everything this website puts on your device, or loads from a third party, is listed in the Cookie Policy — generated from the same list the site itself enforces, so the two cannot disagree. Nothing optional loads before you allow it.

Changes to this policy

When this policy changes we update the date at the top. If a change means we start using your data for something genuinely new, we will ask again rather than assume.