Privacy Policy

This policy explains what personal information Airstay collects, why we collect it, who we share it with and your rights. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

The data controller is [COMPANY NAME] Ltd (trading as Airstay), company number [COMPANY NUMBER], registered office: [REGISTERED OFFICE ADDRESS]. For any privacy question, email hello@airstay.uk.

2. What we collect

• Guests: your name, email address and phone number (if given), your booking details (listing, dates, number of guests, prices) and payment status.
• Hosts: your name, email address, phone or WhatsApp number, your listings and the information needed to pay you.
• Messages: anything you send us by email or WhatsApp.
• Technical data: basic information our hosting provider records automatically when you visit the site, such as your IP address and browser type, used for security and to keep the site working.

We do not receive or store your card details. Card payments are handled by Stripe and PayPal payments by PayPal, on their own secure pages.

3. Why we use it (and our legal basis)

• To take and manage your booking, take payment, send your confirmation and put you in touch with your host: to perform our contract with you.
• To keep accounting and tax records: legal obligation.
• To prevent fraud, keep the site secure and deal with complaints or disputes: our legitimate interests.

We do not sell your data and we do not send marketing emails unless you have asked us to.

4. Who we share it with

• Your host, who receives your name, email, phone number and booking details so they can prepare for and manage your stay. A host receives a guest's details only once a booking is confirmed.
• Service providers who process data on our behalf: Supabase (database, servers in Ireland), Vercel (website hosting), Stripe and PayPal (payments), and Resend (sending booking emails, servers in Ireland).
• Authorities, where we are legally required to, for example HMRC or the police.

Some of these providers may process data outside the UK (for example in the USA). Where this happens, it is protected by safeguards approved under UK law, such as the UK International Data Transfer Addendum or the UK–US data bridge.

5. How long we keep it

We keep booking and payment records for 6 years after the end of the tax year they relate to, because UK tax law requires it. Other information, such as messages, is kept for as long as it is needed to deal with your booking or any question or complaint, and then deleted.

6. Cookies

We only use cookies that are strictly necessary for the website to work. We do not use advertising or tracking cookies. Stripe and PayPal may set their own cookies on their payment pages to process payments securely and prevent fraud.

7. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct anything that is wrong;
• ask us to delete your data, where we do not need to keep it by law;
• object to or ask us to restrict how we use your data; and
• ask us to transfer your data to you or another organisation.

To use any of these rights, email hello@airstay.uk. We will reply within one month. If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

8. Keeping your data safe

Your data is stored with reputable providers using encryption in transit, and access is limited to the people who need it to run Airstay.

9. Changes

We may update this policy from time to time. The latest version will always be on this page.