Privacy policy

This policy explains how [Company legal name] (“we”) handles personal data in Myplace. Contact us at [Contact email] or [Registered address].

1. Two roles

• Customers of Myplace (the accommodation businesses and their team members): we are the controller of your account and billing data.
• Guests who book or contact a business through a website built with Myplace: the business is the controller; we process guest data on its behalf as a processor.

2. What we collect

• Account data: name, email address, password (stored hashed by our authentication provider), role and the businesses you belong to.
• Business data: property details, prices, photos and website content you enter.
• Billing data: plan, invoices and payment status. Card details are handled by Stripe and never stored by us.
• Guest data (for businesses): name, contact details, stay details, guest messages and payment status.
• Website statistics: daily page view counts per page. We do not use cookies for analytics and do not store visitors' IP addresses with these counts.
• Security logs: actions in the dashboard and a keyed hash of IP addresses for rate limiting and fraud prevention.

3. Why we use it

To provide the service (contract), to bill you (contract and legal obligation), to keep the service secure (legitimate interest), and to send service emails such as booking confirmations and billing notices. We do not sell personal data and do not use it for advertising.

4. Service providers

We use: Supabase (database, authentication and file storage), Vercel (hosting and domains), Stripe (payments) and Resend (email delivery). Each processes data only to provide its service to us. Some may process data outside your country under appropriate safeguards such as standard contractual clauses.

5. How long we keep it

Account and business data are kept while your account is active. When a business is deleted, guest personal data is erased after 30 days; booking and payment records are kept in anonymized form for as long as accounting law requires. Rate limiting records are deleted after a day; the audit log of dashboard actions is kept for security and accountability.

6. Your rights

You can access, correct, export or delete your data. Account holders can do most of this in Settings. Guests should contact the business they booked with; businesses can export or anonymize a guest's data from the dashboard. You may also complain to your data protection authority.

7. Cookies

We use only cookies needed to keep you signed in and remember your active business. Guest-facing websites set no tracking cookies.

8. Changes

We will post changes here and notify account holders of significant changes by email.