Privacy policy

The operator named in the operator details at the end of this document is the controller of the personal data processed through Stayin. Questions and requests about personal data can be sent to the contact address given there.

A Property that receives your reservation or your message becomes responsible for the data it receives from you for its own purposes (for example to host you), as described in the Partner terms.

• Account data: name, e-mail address, optional telephone number, preferred language and account type. Passwords are handled by our authentication provider and stored only in protected, hashed form; we cannot read them.
• Business data from hotels and agencies: business and property details, contact details, descriptions, photographs, location, room types, prices, policies.
• Verification evidence: videos, photographs and documents that applicants upload so that reviewers can verify them. They are stored privately.
• Reservation data: guest name, e-mail, telephone, notes you enter, dates, number of guests, the chosen option and its terms, the price, and the status of the reservation.
• Messages you exchange with a Property.
• Reviews: rating and text. Publicly, only your first name and the initial of your last name are shown, with the month of the stay.
• Favourites you save.
• Technical data: IP address, browser and device information and the time of requests, used for security and to limit abuse; and cookies as described in the Cookie policy.
• Administration records: decisions and actions of our staff, such as approving a listing or hiding a review, with their reason.

We do not process payment card data, because online payment is not offered at the moment. Please do not put health data or other sensitive information in notes or messages unless it is needed, for example to describe an accessibility need.

• To provide the service you ask for: your account, searching, reservations, messages, reviews, favourites. Basis: performance of a contract.
• To verify Properties and protect the service and its users against fraud, abuse and security incidents, including with a bot check at sign-up and sign-in. Basis: our legitimate interest in a safe and trustworthy marketplace.
• To send service e-mails such as confirmation of your e-mail address, password reset, reservation and cancellation notices, and decisions on verification applications and on reviews. Basis: performance of a contract. In addition, unless you switch this off in your account settings, we e-mail you when you receive a new message, a review or a reply to your review; these e-mails do not contain the text of messages. We do not send marketing e-mails.
• To comply with legal obligations, such as accounting, tax, and answering lawful requests from authorities. Basis: legal obligation.
• To handle complaints and defend legal claims. Basis: legitimate interest.
• To improve the service using aggregated information. Basis: legitimate interest.

If we ever rely on your consent, for example for optional cookies, we will ask first and you can withdraw it at any time.

• The Property you reserve with or write to sees the reservation details and messages needed to host you.
• Signed-in users can see the contact details that a Property chooses to publish.
• Everyone can see published listings and reviews, with the limited author name described above.
• Our authorised staff see account, application, listing and reservation data when this is necessary to run and protect the service. Private messages are not shown in the administration area.
• Authorities, where the law requires it.

We use providers that process data on our behalf and under our instructions:

• database, authentication and file storage (Supabase);
• e-mail delivery (Resend), when e-mail sending is enabled;
• bot protection (Cloudflare Turnstile), when it is enabled;
• hosting of the website.

A daily exchange-rate service is contacted by our server to show approximate prices; it does not receive your personal data.

We do not sell personal data and we do not use it for advertising.

Our providers may process data in countries other than yours, including outside the European Economic Area and Georgia. Where the law requires it, we rely on safeguards such as standard contractual clauses or an adequacy decision.

• Account data: while your account exists, and afterwards only as long as needed for the purposes below.
• Reservation records: as long as needed for the contract, for possible disputes and for legal accounting and tax duties.
• Reviews: while the listing is on the site, unless removed under the Review policy.
• Verification evidence: while the listing is active and afterwards for a limited period so that we can show how a decision was made.
• Messages: while the accounts concerned exist.
• Security and administration logs: for a limited period.

When a retention need ends, we delete or anonymise the data. You can ask us for the specific periods that apply.

We protect data with measures including encrypted connections, access rules enforced in the database so that each user sees only their own data, private storage with short-lived links for verification files, bot protection, request limits and an audit log of staff actions. No system is completely secure. If you find a vulnerability, please report it privately through the Contact page.

Depending on the law that applies to you, including the GDPR and the Georgian Law on Personal Data Protection, you have the right to:

• access your data and receive a copy;
• have inaccurate data corrected;
• have data erased, in the cases the law provides;
• restrict or object to certain processing;
• receive your data in a portable form;
• withdraw consent you have given;
• complain to the data protection authority of your country.

You can correct much of your information yourself in your account. For other requests, write to the contact address of the operator. We may need to confirm your identity, and we will answer within the time the law sets (one month under the GDPR).

We do not make decisions with legal or similarly significant effect on you based solely on automated processing. Verification decisions are made by people. Automated tools only limit repeated requests and block suspected bots.

Stayin is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, please contact us and we will delete it.

We use only cookies that are needed to run the site and to remember your language and currency. Details are in the Cookie policy.

We will publish updates here with a new date and, for significant changes, tell registered users.

For privacy questions and requests, use the contact details of the operator shown at the end of this document and on the Contact page.