Privacy Policy

This policy explains what personal data CuraStay processes, why, on what legal basis, who else is involved and what rights you have. It applies to this website, to the request form, to CuraStay memberships and to the guest guides we publish for our customers. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP).

1. Who is responsible

The controller responsible for your personal data is:

2. The short version

• We collect only what we need to prepare your preview, run your guide and bill your membership.
• The site sets no cookies until you allow them. If you accept, Google Analytics tells us which pages are read. You can change your mind at any time, at the bottom of this page.
• There are no advertising pixels and no behavioural advertising profiling, and we never sell data. The only assessment we make is whether a business could be a fit for CuraStay, from public business information (3.10).
• Payments are handled by Lemon Squeezy. We never see your card details.
• You can ask us at any time what we hold about you, and have it corrected or deleted.

3. What we process and why

3.1 Visiting the website

When you open any page, our hosting provider automatically records technical data: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. We need this to deliver the site and to keep it secure against abuse. Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). These logs are kept only for as long as the hosting provider retains them for security, typically a few days to 30 days.

3.2 Your language preference

If you choose a language, the choice is saved in your own browser (local storage, under the key “curastay_locale”) so the site opens in that language next time. It is not sent to us and contains nothing that identifies you. Storing it is strictly necessary for a feature you asked for, so no consent is required. You can remove it at any time by clearing your browser’s site data.

3.3 Analytics, and the cookies that come with it

If you accept analytics in the banner, we load Google Analytics 4, which sets cookies in your browser (named _ga and _ga_<id>) and sends Google your truncated IP address, the pages you open, the approximate region they were opened from, and details about your device and browser. We use it only to see which pages are read and how people arrive, never to identify anyone. IP anonymisation is on, and we have not enabled advertising features, remarketing or data sharing with other Google products.

Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TTDSG or the equivalent national ePrivacy rule). Until you give it, no request is made to Google at all: the script is not loaded. Your choice is stored in your own browser under “curastay_consent”, and you can withdraw or give it at any time with the button at the end of this page or the cookie settings link in the footer, with effect for the future. Google Analytics data is retained for 14 months.

Google Ireland Limited acts as our processor, with Google LLC in the United States as a sub-processor. See Google’s privacy policy for how they handle it.

3.4 The request form

When you request a preview we receive your name, email address, WhatsApp number and the link to your listing. We use them to prepare your free preview guide and to contact you about it. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). If you do not become a customer, we delete these details no later than 12 months after our last contact with you.

3.5 Customers

To build and maintain your guide we process the information you give us about your property: for example house rules, check-in details, wifi details, entry instructions, photos and recommendations, together with your contact details. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). We keep this for as long as your membership runs and delete it within 30 days after it ends, except where the law requires us to keep records for longer.

If you give us a contact number for your guests, we publish it in your guide as a WhatsApp button, so anyone who has the guide’s link can see it. Giving one is optional. We publish it only after you confirm that it may be shown publicly and, if the number belongs to someone else, such as a co-host or a housekeeper, that they agreed. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). You can change or remove it yourself through your setup link, or by writing to us; it is taken off the guide when your membership ends.

What you save in the setup form after checkout (your Wi-Fi, the guest PIN, entry instructions and, if you give one, the guest number) is encrypted by our server before it is stored with our database provider (Upstash, see section 4), so the provider holds only ciphertext. On your guide only the guest number is shown openly; the Wi-Fi details and the entry instructions are released only to someone who enters the guest PIN. The form can only be saved with the private setup link from your checkout or your welcome email. When you pay, we send you that welcome email from our own address; its link lets you change your details later, so please do not share it.

So that guests can read your entry instructions in their own language, we have them translated once, when you save them, by Anthropic’s Claude API (see section 4). Anthropic receives only the text of the instructions, nothing else about you or your guests, and under its commercial terms does not use it to train its models. The translations are stored with your setup, encrypted in the same way. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). If you would rather not have them translated, write to us; guests then see your instructions as you wrote them.

3.6 Payments

Memberships are sold through Lemon Squeezy, which acts as the merchant of record and reseller. Lemon Squeezy processes your payment details and billing address as an independent controller under its own privacy policy. We receive your name, email address, country, the plan you chose and the status of your subscription, which we need to provide and manage your membership (Art. 6(1)(b) GDPR) and to meet our accounting obligations (Art. 6(1)(c) GDPR). Accounting records are kept for the period required by law.

3.7 Guests using a guide

Guests do not create an account and do not give us any personal data to use a guide. The only data involved is the technical data described in 3.1, the language preference in 3.2, and analytics if they accepted it in 3.3. Links in a guide to Google Maps or WhatsApp open those services only when tapped, and from that point their own privacy policies apply.

3.8 Photos from Google Maps

The recommended places in a guide show a current photo of the place from Google Maps, with the name of the person who took it, and so does the house itself when we have no photo from its own website. So that we never copy or store those photos, your browser loads each one directly from Google’s servers (googleusercontent.com). Google therefore receives your IP address, the time of the request and the usual browser details, as with any image loaded from its servers. It does not receive the page you are on, because the photos are requested without a referrer, and no cookie is set for this.

Our server first asks Google which photo to show. That request comes from us and contains only the place’s identifier, nothing about you. Your browser keeps the answer for up to one day, so reopening the page does not ask again. Legal basis: our legitimate interest in showing prospective customers an accurate picture of the places we would recommend to their guests (Art. 6(1)(f) GDPR). If the photos cannot be loaded, the page shows neutral illustrations instead. Google handles this data under its own privacy policy.

3.9 Emails and messages

If you write to us, we use your message and contact details to answer you. Legal basis: our contract with you or the steps before it (Art. 6(1)(b) GDPR), or otherwise our legitimate interest in replying to enquiries (Art. 6(1)(f) GDPR).

3.10 Publicly available business leads

To introduce CuraStay to potential customers, we process business contact information (such as business names, public email addresses, and phone numbers) collected from publicly accessible online sources: the business’s listing on Google Maps and its own website, such as its contact page or legal notice. We use the same public information to assess whether CuraStay could be a fit for the business and to prepare a preview guide for its property. Legal basis: our legitimate interest in direct B2B marketing (Art. 6(1)(f) GDPR). You can object to this at any time by writing to us. We delete these details immediately upon request or within 12 months of our last contact if no business relationship is established. If you ask us not to contact you again, we keep only what we need to respect that.

4. Who else processes data

We use a small number of service providers, bound by data processing agreements where they act for us:

• Vercel Inc., USA: website hosting and delivery.
• Upstash, Inc., USA: the database behind customer guides: the state of your membership and the setup you save for your guide, which we encrypt before it is stored, so Upstash holds only ciphertext.
• Anthropic PBC, USA: translation of the entry instructions in your guide’s setup into the guide’s six languages, once, when you save them (3.5), and drafting the text of preview guides from public information about a property: its name, town, category, Google rating and, where available, short excerpts of public reviews, never contact details (3.10).
• Resend, USA: delivery of the emails that notify us of requests and that we send to you, such as the welcome email with your guide’s setup link.
• Lemon Squeezy LLC, USA: payment processing, invoicing and tax, as merchant of record and independent controller.
• Google Ireland Limited, Ireland, with Google LLC, USA: website analytics, only with your consent.
• Google (Google Maps Platform): the photos of recommended places and houses in guides, loaded by your browser directly from Google as described in 3.8. Google acts as an independent controller for the data it receives this way.

The fonts on this site are served from our own domain, so opening a page does not contact Google or any other font provider for them. Apart from the place photos in 3.8 and analytics if you allow it, no page loads anything from Google. We do not share personal data with anyone else unless the law requires it.

5. Transfers outside Europe

Some of the providers above are based in the United States. Where data leaves the EU, the EEA, the UK or Switzerland, the transfer relies on the EU-US Data Privacy Framework and its UK and Swiss extensions where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses with the UK Addendum or their Swiss equivalent.

CuraStay itself is run from Türkiye, so we access your data there. For people in the EU, the EEA or the UK, that access is covered by Art. 49(1)(b) GDPR where it is necessary to perform our contract with you or to take steps you asked for before it, and otherwise by appropriate safeguards. If you would like details, write to us.

6. Your rights

Depending on the law that applies to you, you have the right to:

• ask what data we hold about you and receive a copy (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• have processing limited (restriction);
• receive your data in a portable format (portability);
• object to processing based on our legitimate interests (objection);
• withdraw any consent you gave, with effect for the future.

To use any of these rights, email us at hello@curastay.app. We answer within one month. You also have the right to complain to a data protection authority: in the EU and EEA the authority where you live or work, in the United Kingdom the Information Commissioner’s Office (ICO), in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), and in Türkiye the Personal Data Protection Authority (KVKK), whose law gives you equivalent rights.

Your analytics choice

Change it here at any time; it takes effect immediately.

7. Security

All traffic to this site is encrypted with TLS. Access to customer data is limited to the people who need it to deliver the service. Guest guides are unlisted but can be opened by anyone who has the link, which is why our Terms ask hosts to think carefully about what they publish in them.

8. Children

CuraStay is a service for property hosts and is not directed at children under 16.

9. Changes to this policy

We update this policy when our processing changes. The date at the top shows the current version. If a change affects customers materially, we tell them by email before it takes effect.