Privacy Policy

This Privacy Policy describes how Quiet Cove LLC ("Quiet Cove", "Quiet Corner", "we", "us", or "our") collects, uses, shares, and protects information.

Sections 1 through 6 apply to everyone who books a pod or visits our websites. Section 7 applies only to staff at the hotels and event venues that host our pods, who have access to a separate venue portal. If you are a booking customer, section 7 does not apply to you.

If you have questions about this policy, or want to exercise any of the rights described below, contact us at [email protected].

1. Information We Collect When You Book

To create and manage a booking we collect your name and email address, the pod and location you booked, your booking start and end times, the amount charged, and any coupon code applied.

We also generate a temporary numeric door code for your booking and send it to you by email. The code is tied to your booking window and stops working when it expires.

We do not ask for or store a phone number as part of booking a pod.

2. Payment Information

Payments are processed by Stripe. Your card details are transmitted directly to Stripe and are never stored on, or accessible to, our systems. We retain only a Stripe transaction reference and the amount, currency, tax, and discount associated with your booking. For walk-up bookings paid at a pod, the card reader communicates with Stripe directly in the same way.

3. If You Contact Support

If you text our support number, we receive and retain your phone number and the messages in that conversation so we can respond and keep a record of the issue. This is the only circumstance in which we collect a phone number from a customer. If you email support instead, we retain that correspondence for the same reason.

4. Bookings Made Through Partner Marketplaces

Some pods can be booked through third-party workspace marketplaces such as LiquidSpace and Deskpass. When you book that way, the marketplace sends us the booking details needed to fulfil the reservation, which typically include your name, email address, and reservation time. Your relationship with that marketplace is governed by its own privacy policy.

5. How We Use Information

We use the information described above to:

• Create, confirm, modify, and cancel your booking
• Issue and deliver the door code that lets you into the pod you booked
• Take payment, apply discounts and tax, and issue refunds
• Send booking confirmations, reminders, and receipts
• Respond to support requests
• Operate and secure the pods, including diagnosing problems with locks, tablets, and door access
• Report aggregate performance to the venues that host our pods
• Meet our accounting, tax, and legal obligations

We do not sell your personal information. We do not use your booking data or your messages to train machine-learning models, and we do not share them with third parties for their own marketing.

Reporting we provide to host venues is aggregate — booking volumes, utilisation, and revenue share. It does not identify individual customers.

6. When You Visit Our Websites

If you submit a contact or enquiry form, we receive the details you provide so we can reply. When we send a venue or event organiser a proposal, we record whether and when that proposal was opened, so our team knows whether to follow up.

7. Venue Partners: The Portal and the Optional Outlook Connection

This section applies only to staff at venues that host our pods. It does not apply to pod booking customers, and none of it involves customer data.

We provide a portal to venue teams. For portal users we hold a name, work email address, and the venue they are associated with. Signing in sends a one-time code to that email address; we do not store a password. Portal activity is logged so venue teams have a shared record of what happened.

Venue teams send outreach email as part of their work with us. A portal user may optionally connect their Microsoft Outlook account. Rather than send mail on their behalf, we prepare a message and place it in the user's own Outlook as a draft, so a person reads it, edits it if they want, and presses send themselves.

To do that, Microsoft asks the user to grant our application permission to read and write mail in their mailbox. That permission is broad by design — Microsoft does not offer a narrower "drafts only" permission. We therefore describe our actual practice, and we hold ourselves to it:

• We create drafts. We write messages into the connected mailbox as unsent drafts.
• We never send mail on a user's behalf. Sending is always an action the account holder takes in their own Outlook.
• We check whether a draft we created was sent, so the portal can show accurate status and avoid duplicate follow-ups. This means reading properties of the specific messages we created and their replies.
• We do not read unrelated mail, browse the mailbox, or extract contacts, calendar entries, or attachments beyond what is described here.
• We do not use mailbox content to train models, and we do not disclose it to any third party.

The access tokens that make this possible are encrypted at rest using AES-256-GCM and are used only to carry out the actions above. A user can disconnect at any time from the portal, and can independently revoke our access from their Microsoft account permissions page. Disconnecting stops all further access immediately; drafts already created remain in the user's own mailbox, under their control.

8. How We Share Information

We do not sell or rent personal information. We share it only with service providers who perform work necessary to run the service, and only to the extent they need it:

• Stripe — payment processing, including in-person card readers
• Resend — transactional email such as confirmations, door codes, reminders, and receipts
• Twilio — support text conversations
• Google — calendar entries used to keep pod availability accurate across booking channels
• LiquidSpace and Deskpass — where a booking originated on those marketplaces
• Microsoft — the optional venue portal mailbox connection described in section 7
• Neon, Railway, and Cloudflare — database, application hosting, and website delivery

We may also disclose information where required by law, to enforce our terms, or to protect the rights and safety of our customers, our staff, or the public. If our business is ever sold or reorganised, information may transfer as part of that transaction, and this policy will continue to apply until it is replaced by one you are told about.

Separately, we run an internal integration with QuickBooks Online used solely to manage Quiet Cove's own accounting records. It is a private, internal tool; it is not offered to customers or venues and does not read customer booking data. Its specific terms are set out in our End User License Agreement.

9. Security

Traffic to our services is encrypted in transit. Sensitive credentials, including the Outlook access tokens described in section 7, are encrypted at rest. Access to production systems is limited to the people who need it to operate the service. Door codes are temporary and expire with the booking they belong to.

No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

10. Data Retention

We keep booking records, including the associated name, email address, and transaction reference, for as long as needed to operate the service and to satisfy accounting, tax, and legal obligations. Door codes expire at the end of the booking window. Support conversations are retained so we can handle recurring issues. Outlook access tokens are deleted when a venue portal user disconnects the integration.

11. Your Rights

Depending on where you live, you may have the right to access the personal information we hold about you, ask us to correct or delete it, object to or restrict certain processing, opt out of marketing messages, and request a copy in a portable format. To make a request, email [email protected]. We will not treat you differently for exercising these rights.

Some information cannot be deleted immediately where we are required to keep it — financial records being the usual example. If that applies, we will tell you.

12. Children

Our services are intended for adults. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date below. Where a change materially affects how we handle your information, we will take reasonable steps to tell you.