Privacy Policy

Effective October 19, 2026 · Entrevest LLC

Entrevest LLC (“we,” “us,” or “our”) operates Eat Sleep Shop at eatsleepshop.com. This policy explains how we handle information about visitors, waitlist applicants, and members of the web service and connected Eat Sleep Shop features when available.

1. Our role and current service

We determine how personal information is used to operate the waitlist, review invitations, authenticate members, provide the service, and protect accounts. The current web release provides a waitlist, Google sign-in for approved members, and an optional Gmail import pilot for a limited set of approved test accounts. Joining the waitlist does not create a member account. Signing in does not grant access to your Gmail messages, contacts, or calendar.

2. Information we collect

• Waitlist: email address, optional city, request date, and approval or revocation status.
• Identity: Google and Firebase provide details such as your name, email, profile image if available, verified-email status, and account identifier. We use verified email and the Firebase identifier to check membership and maintain a consistent web and mobile identity.
• Operations and security: session information, approval decisions, administrator identifiers, timestamps, and technical request information. Hosting providers may process IP addresses, browser details, and request logs. Our application rate-limit table stores keyed hashes rather than raw IP addresses.
• Information you submit: support requests and, when supported, places, links, notes, plans, and booking details you choose to save.

3. How we use information

We use information to manage invitations, verify identity, provide account access, organize content you request, answer support inquiries, prevent abuse, investigate errors, and meet applicable legal obligations. Joining the waitlist is not permission to scan your inbox or publish your travel history.

Where a legal basis is required, processing may be necessary to provide the service you request, protect our users and service, comply with law, or carry out a use you separately consent to. You may withdraw optional permission without changing the lawfulness of processing that occurred before withdrawal.

When you write a feed post, its text may be processed through OpenRouter and the selected model provider to suggest places explicitly mentioned in it. Suggestions do not rewrite your post, establish a visit or rating, or save a place or itinerary entry until you choose an action. We request processing without provider data collection or retention. Group and private text keeps its existing audience.

4. Optional Gmail access

Gmail import is available only to approved pilot accounts.Connecting Gmail requires a separate permission screen and affirmative consent. The read-only permission can technically access mailbox messages and attachments. The feature is intended to organize supported reservation confirmations, changes, and cancellations within the email date range you choose, including historical mail if requested. It does not send, modify, or delete Gmail messages. Workspace administrators may restrict access.

Connected-mail features store encrypted authorization credentials, message references, processing status, extracted booking information, and a bounded plain-text copy of supported confirmation messages so you can check the source. Supported calendar attachments may be read to extract booking details. Imports are private by default. A reservation is not proof of a visit, review, or personal relationship.

Disconnecting stops future imports and initiates removal or revocation of connection credentials. Previously saved bookings are separate records and are not automatically deleted by disconnecting. You can also revoke access in your Google Account and request deletion of saved data using the contact below.

Use and transfer of Google user data is subject to the Google API Services User Data Policy, including Limited Use requirements. Gmail data will not be sold, used for advertising or credit decisions, or used to train general-purpose AI models. Human access is limited to permitted cases such as your specific consent, security investigations, or legal requirements. Restricted Google data cannot be transferred in a business sale without the consent and safeguards required by that policy.

Optional contact discovery

Contact discovery is separate from sign-in and Gmail. If you choose Google Contacts, we request read-only access to saved contact names, email addresses and phone numbers. The browser reads Google Contacts directly using a short-lived token held in memory. Phone contact selection, where supported, and CSV or vCard import also create a temporary browser preview. Closing the discovery panel clears that preview.

Only email addresses and international phone numbers of contacts you select for an ESS lookup are sent to our service. We compare exact identifiers against member records without saving the submitted address book. These lookups do not send invitations, create friendships or share plans. Connection requests require your action and the recipient’s acceptance. Contact previews are not sent to AI providers or used for advertising. Google authorization may remain after closing the panel. You can manage it in your Google account. Revoking the app’s Google access may also affect other Google features connected to that app.

5. AI features

Optional AI parsing helps identify Eat, Sleep, Shop confirmations and supporting travel. It is off until you explicitly enable it in your Inbox or Profile. When enabled, bounded text from candidate confirmation messages, including booking, purchase, merchant and contact details present in that text, is sent to OpenRouter and the selected model providers for classification and extraction. A candidate may turn out to be unrelated. Mailbox credentials and your entire inbox are not sent.

Our requests require zero-data-retention endpoints and disallow providers that collect content for training. OpenRouter says it does not retain prompts unless prompt logging is enabled. These are provider policies, not a claim that we have independently certified them. You can see the configured models and turn AI parsing off in the app. Turning it off stops future AI requests. Work already sent may finish, but disabling the feature prevents those in-flight results from updating your records.

Extracted records, supporting source references, processing status and your corrections remain in your private ESS account. Model output can be wrong. Check important details against the original confirmation. We do not use Gmail content or private feedback to train general-purpose AI models, create public city guides or infer attendance.

6. Sharing and providers

We do not sell personal information or share it for targeted advertising. Vercel hosts the web service. Google Firebase and Google Cloud authenticate users, operate backend services, and store data. These providers process information needed for their services. OpenRouter and model providers process task-specific content only when the relevant AI features are enabled and disclosed.

Resend delivers waitlist confirmations and invitation emails when email delivery is enabled. It processes recipient addresses, email content, and delivery information for that purpose. These messages concern your request and access to the service.

Authorized administrators review waitlist requests and membership decisions. We may disclose information when required by law or necessary to protect users and the service. Information may transfer in a merger, acquisition, or asset sale, subject to applicable law and the additional Google-data restrictions above. Private bookings do not become public simply because you sign in or connect Gmail.

Feed audiences

All real feeds and conversations require approved member sign-in. Network posts are visible to their author and accepted ESS connections. Group posts are visible only to accepted group members, including members who join later. Only me posts are visible only to their author. Replies follow the audience of the post. There is no anonymous or internet-public feed.

Sharing your own private or group post with your network creates a separate, reviewed post. It does not share the original group, member list or replies. You can make a post private or remove it to stop future access through our service.

7. Cookies and browser storage

We use a necessary session cookie lasting up to five days unless you sign out or access is revoked. Firebase uses browser storage for authentication. This web release does not install advertising pixels or marketing analytics cookies. Google and our hosting providers may use security-related technologies. Blocking necessary cookies or storage may prevent sign-in.

8. Security and retention

We use encrypted connections, restricted service identities and database permissions, server-side access checks, and recorded approval decisions. No system guarantees complete security. Our Security & Trust page describes implemented controls.

We retain waitlist information while managing your request and account information while providing membership. Support and security records are retained as needed for their operational purposes or applicable legal requirements. You can request removal from the waitlist or account closure. Deletion requests are handled manually in this release. We may verify your identity and retain limited information for legal obligations, security, or disputes. Backup copies may remain until their retention cycle expires.

9. Your rights and choices

Depending on your location and applicable law, you may have rights to access, correct, delete, or receive a copy of personal information, or object to or restrict processing. Contact alan@entrevest.com. We may verify your identity and will explain applicable limits. You may also have the right to complain to a data protection authority.

The service is intended for adults aged 18 or older, not children. Contact us if you believe a child has provided personal information so we can investigate.

10. International processing and changes

Entrevest LLC operates in the United States. We and our providers may process information in the United States or other countries where they operate. Applicable transfer requirements and safeguards govern that processing. Contact us for details about your information.

We may update this policy, identify its effective date, and provide notice of material changes where required. New uses of Google data will be disclosed before they begin, with renewed permission where required.

Contact us

Eat Sleep Shop is operated by Entrevest LLC. For questions, privacy requests, account closure, or security reports, email alan@entrevest.com.