Privacy Policy
Staysy Last updated: October 2026
1. Who We Are
Staysy ("Staysy", "we", "us", or "our") operates the marketing website at staysy.co and the host application at app.staysy.co, which also serves the guest guides. We provide a digital concierge platform for short-term rental hosts and their guests.
Staysy is the data controller for the personal data of hosts who use the host application and of visitors to staysy.co. For the personal data of guests that hosts put in their guides, Staysy is the host's data processor (see Section 2.4).
Our own servers, which hold the database, the application, backups, logs and the Ask your guide AI model, are in the European Union.
Contact: For all privacy-related enquiries, please write to: hello@staysy.co
2. What Data We Collect and Why
2.1 Information You Give Us Directly
| Data | When | Why |
|---|---|---|
| Email address | Registration, support requests | To create and manage your account and send you service emails (verification codes, password resets, check-in and checkout alerts) |
| Name | Registration | To address you correctly. If you sign in with Google, we use the part of your email address before the @ instead |
| Password | Registration | To sign you in. We store only a one-way hash, never the password itself |
| Payment information | Subscribing to a paid plan | Stripe processes your payment. We never see or store your card details; we keep your plan and your Stripe customer and subscription IDs |
| Property information | Building your guides | To show your guests their guide: addresses, photos, check-in steps and door codes, Wi-Fi details, house rules, recommended places |
| Contacts | Adding contacts to a guide | Names, phone numbers and notes of people such as a property manager, cleaner or vet, shown to your guests. Make sure those people agree to be listed |
| Calendar links | Importing stays from an iCal link | We store the link and fetch it every hour to create and update stays. We treat it as a secret and never write it to our logs |
| Communications with us | The Help & feedback form, place problem reports, email | To answer you and fix problems. We store the request and email it to our support inbox |
| Your browser's location (optional) | Searching for an address or place | If your browser shares it, we send it to the search provider (Mapbox or Google) so nearby results come first. It is kept in your browser for that session only, not on our servers |
| Push subscription (optional) | Turning on notifications | Your browser's push address, so we can notify you about check-ins, checkouts and guest feedback |
2.2 Information We Collect Automatically
When you visit staysy.co or use app.staysy.co, we automatically collect:
- Technical logs: Our servers record each request (the page asked for, the time, the result) and keep short-lived traces that include the IP address and browser type. They are used to run the service, fix errors and investigate abuse.
- IP address: Used to limit abusive requests; the limits are kept in memory, not in our database. Cloudflare tells us the visitor's country, which we use only to count guide opens per country per day: that count holds nothing about you.
- Analytics on staysy.co: Only if you accept analytics cookies, Google Analytics records the pages you visit, your device and browser type and your approximate location.
- Cookies and similar technologies: See Section 7 (Cookies) for full details.
2.3 Information From Third Parties
If you register or sign in with Google, we receive from Google your email address, whether Google has verified it, and your Google account ID. We do not receive your name, your profile picture or your Google password, and we do not keep any Google access token.
2.4 Guest Data Processed on Your Behalf
As a host using Staysy, you may add information about your guests to Staysy: a guest's name (typed by you, or imported from a calendar link when the link includes it) and the dates and times of their stay. Staysy also records when the guest confirms check-in and checkout. We never ask guests for an email address or phone number. In that scenario:
- You are the data controller for your guests' personal data.
- Staysy acts as a data processor on your behalf.
- You are responsible for ensuring you have a legal basis (such as your guests' consent or contractual necessity) to share their data with Staysy.
- Our processing of guest data on your behalf is governed by the Data Processing Terms in Annex A of our Terms of Service.
When a guest checks in or checks out, we tell the host with a message in their Staysy inbox, an email and, if they turned notifications on, a push notification, with the guest's name and the property.
Guest feedback. On paid plans, guests can leave feedback after their stay: a rating (one of three faces), an optional comment of up to 500 characters, an optional answer to whether the guide was helpful, and the language they viewed the guide in. We store it with the booking and send the host a copy in their Staysy inbox and, if they turned notifications on, as a push notification. Only the host sees it, and it is never published. The feedback is deleted together with the booking or property it belongs to; the inbox copy stays in the host's account until the account is closed.
Places after the stay. When a stay ends, the guest's link keeps showing the host's recommended places for 12 months after checkout. The rest of the guide (door codes, Wi-Fi, contacts and the property address) is no longer shown.
Guest likes. Once a guest has confirmed check-in, they can like places in their host's guide, during the stay and for up to 12 months after checkout. For each like we store only the place, the booking it came from and when it was given: no name, email address, IP address or device details. Each booking can like a place once. Hosts and guests only see how many guests like a place, never who. If the booking is deleted, the like is kept as an anonymous count that is no longer linked to any booking.
Ask your guide. Where a guide offers it, guests can type questions about their stay. An AI model that runs on our own servers in the EU answers them only from the guide, and never shows guests a part of the guide they can't see yet (such as Wi-Fi details before check-in). Questions and guides are never sent to an outside AI provider, and questions never appear in our logs. On guides that show the notice "Your host and Staysy can read the questions you ask here", we store each question with the answer, the time and the property, but no name, booking, access code or IP address, so that the host and Staysy can read them and make the answers more accurate, including by adjusting the AI model that runs on our own servers. After 12 months the text of the question and the answer is deleted; only a count remains. (Questions asked before this policy was updated in October 2026 keep the 60 days announced then.)
Where Staysy decides. For a few things we act on our own account rather than the host's: keeping the service secure (abuse limits and technical logs), counting guide opens per country, counting likes across hosts, and reading Ask your guide questions to find wrong answers and improve the assistant, including adjusting its model. Our legal basis is our legitimate interest in running a secure and accurate service. You can object at hello@staysy.co.
2.5 Places Shared Between Hosts
When you add a place to your Highlights by picking it from search, the place itself becomes a shared place that other Staysy hosts can find and add to their own guides: its name, address, place type, location (city, region and country) and a default photo from Google Places. Other hosts also see how many hosts recommend the place and how many guests like it. They never see your own description or photos for the place, or which host added it. Places you type in by hand or add from a map link stay private to your account unless Staysy reviews one and publishes it as a shared place (its name, address and type only; never your description or photos). We keep a record of which account first added a place; it is not shown to other hosts.
3. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account and your guides | Contract (Art. 6(1)(b)): processing is necessary to perform our service |
| Processing payments | Contract (Art. 6(1)(b)) |
| Sending service emails and notifications | Contract (Art. 6(1)(b)) |
| Security, abuse prevention and technical logs | Legitimate Interest (Art. 6(1)(f)) |
| Shared places, like counts and guide opens per country | Legitimate Interest (Art. 6(1)(f)) |
| Reading Ask your guide questions to improve the answers | Legitimate Interest (Art. 6(1)(f)). We balance this against your privacy rights: no name, booking or IP is stored, the model stays on our own servers, and the text is deleted after 12 months |
| Analytics on staysy.co | Consent (Art. 6(1)(a)), given in our cookie banner. You can withdraw it at any time |
| Compliance with legal obligations, such as keeping billing records | Legal Obligation (Art. 6(1)(c)) |
We do not send marketing emails.
4. How We Share Your Data
We do not sell your personal data. We share it only in the following circumstances:
4.1 Service Providers (Processors)
We use these providers to operate our service. Each may use the data only to provide its service to us, under its data processing terms:
- Cloudflare: Delivers our websites, protects them against attacks, and stores uploaded photos (Cloudflare R2). Privacy Policy
- Stripe: Subscription payments and billing. Privacy Policy
- Resend: Sends our emails (verification codes, password resets, check-in and checkout alerts, support messages). Privacy Policy
- Google: Google sign-in; Google Places for place search and place photos; reading Google Maps links you paste; Google Analytics on staysy.co, only with your consent. Privacy Policy
- Mapbox: Turns addresses into locations (to set a property's time zone and city and to measure distances to places) and powers address search. Privacy Policy
- Browser push services (from Google, Apple, Mozilla or Microsoft, depending on the host's browser): Deliver the notifications hosts turn on. The content is encrypted so that only the host's browser can read it.
The host application and guest guides load their fonts from Google Fonts, so Google receives the visitor's IP address when a page loads, under Google's Privacy Policy.
4.2 Legal Requirements
We may disclose your data if required by law, court order, or to protect the rights, safety, or property of Staysy, our users, or the public.
4.3 Business Transfers
If Staysy is involved in a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.
5. International Data Transfers
Our own servers are in the European Union. Some of the providers in Section 4.1 are based in the United States and may process data there. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses.
6. Data Retention
We retain your personal data only for as long as necessary:
- Account data: Kept while your account is open. When you ask us to close it, we delete your account, properties, guides and photos within 30 days, except the billing records below.
- Billing records: Kept for as long as tax and accounting law requires (up to 6 years in Spain).
- Unfinished sign-ups and password reset links: Deleted within a day of expiring.
- Sign-in sessions: Expire after 24 hours.
- Guest data in a host's account: Kept while the host keeps it in Staysy: until the host deletes the property or closes their account.
- Guest feedback: Deleted together with the booking or property it belongs to. The copy in the host's inbox stays until the host's account is closed.
- Guest likes: Kept for as long as the place exists. When the booking is deleted, the like is kept only as an anonymous count.
- Ask your guide questions: The text of stored questions and answers is deleted after 12 months (60 days for questions asked before this policy was updated in October 2026).
- Shared places: A place picked from search stays available to other hosts after you remove it from your Highlights. Your own description and photos for it are deleted together with your highlight.
- Support requests: Kept while your account is open.
- Technical logs: Deleted after 30 days; traces after 7 days.
- Backups: Encrypted, kept on our own servers in the EU, and deleted after at most 3 months, so deleted data disappears from backups within that time.
- Analytics on staysy.co: Google Analytics keeps it for at most 14 months.
You may request deletion of your account and associated data at any time by contacting hello@staysy.co.
7. Cookies
We use cookies and similar technologies to operate the website and application. Here is a summary:
| Category | Where | Purpose | Can you opt out? |
|---|---|---|---|
| Strictly Necessary | app.staysy.co | Your sign-in session (24 hours), protection against forged requests (1 hour), your language (1 year), and short-lived cookies that remember a sign-up or a form you are filling in (up to 1 hour) | No, these are essential |
| Strictly Necessary | staysy.co | Your language (1 year) and your cookie choice, saved in your browser | No, these are essential |
| Analytics | staysy.co only | Google Analytics cookies (_ga, _ga_*, up to 2 years) that show how visitors use the site | Yes, they are set only if you choose Accept all in our cookie banner |
Guest guides set no cookies. A guide may save small settings in the guest's browser (for example, that the install hint was closed, or the Ask your guide conversation until the tab is closed) and an offline copy of the guide that is no longer shown once the stay has ended.
On your first visit to staysy.co, you will see a cookie consent banner. You can change your choice at any time via the Cookie Settings link in the website footer.
We use Cloudflare for security. Cloudflare may set its own cookies for bot detection and performance. For details, see Cloudflare's Cookie Policy.
8. Your Rights
Depending on your location, you have the following rights regarding your personal data:
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Ask us to correct inaccurate or incomplete data |
| Erasure ("Right to be Forgotten") | Ask us to delete your data in certain circumstances |
| Restriction | Ask us to limit how we process your data |
| Data Portability | Receive your data in a structured, machine-readable format |
| Object | Object to processing based on legitimate interests |
| Withdraw Consent | Where processing is based on consent, withdraw it at any time |
| Automated Decisions | Not be subject to solely automated decisions that significantly affect you |
To exercise any of these rights, email us at hello@staysy.co. We will respond within 30 days. We may ask you to verify your identity before fulfilling the request.
If you are a guest, your host decides about most of your data in their guide, so you can also ask them. If you write to us, we will help your host answer.
Supervisory Authorities
If you are in the European Union and believe we have processed your data unlawfully, you have the right to lodge a complaint with your local data protection authority. In Spain, this is the:
Agencia Española de Protección de Datos (AEPD) https://www.aepd.es Tel: +34 901 100 099
In other EU member states, contact your national data protection authority.
9. Children's Privacy
Staysy is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
10. Security
We take appropriate technical and organisational measures to protect your personal data, including:
- Encrypted data transmission (HTTPS/TLS)
- Passwords stored only as one-way hashes, and sign-in sessions that expire after 24 hours
- Access controls and authentication requirements
- Encrypted backups kept on our own servers
- Automated checks of our software dependencies for known vulnerabilities
- Cloudflare-based DDoS and abuse protection
No method of transmission or storage is 100% secure. We will notify you and the relevant authorities of any data breach where legally required.
11. Links to Other Websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will tell hosts about material changes by email or with a message in the host application before they take effect, and post a notice on our website. The "Last updated" date at the top of this policy reflects the most recent revision.
13. Data Processing Terms
Hosts who use Staysy to manage guest data are acting as data controllers. Staysy processes guest data strictly on the host's instructions, under the Data Processing Terms in Annex A of our Terms of Service, which apply automatically when you use Staysy.
14. Contact Us
For any questions, concerns, or requests related to this Privacy Policy:
Staysy Email: hello@staysy.co Website: https://staysy.co