Privacy Policy

• Host account: name, email, hashed password or Google account ID, language and preferences.
• Property content: unit name and address, photos, instructions, host contacts and the rest of the welcome book.
• Sign-up form on the site: the name, email and number of properties you enter.
• Payments: plan, billing and subscription status. Card details are handled by Stripe and never reach our servers.
• Communications: emails you send us and service emails we send you.
• Usage: welcome book visits (a count per book), technical logs and, only with your consent, the analytics and marketing data described in the Cookie Policy.

• Providing the service and managing your account and payments: contract (GDPR art. 6(1)(b)).
• Invoicing and tax obligations: legal obligation (art. 6(1)(c)).
• Service, security and product update emails: contract and legitimate interest (art. 6(1)(f)).
• News and offers: consent (art. 6(1)(a)), which you can withdraw from any email.
• Measuring site use and ad results: consent given in the cookie banner.
• Preventing fraud and abuse: legitimate interest.

When a host uses the guest form or the welcome book, their guests’ data is processed on the host’s behalf. The host is the controller and GuestBusters acts as processor (GDPR art. 28), as set out in the Terms of Use. Guests should send requests about their data to the host, and we help the host respond.

We use service providers that process data on our behalf under processing agreements:

• Supabase (database and authentication).
• Vercel (site hosting and cookieless visit statistics).
• Stripe (payments).
• Resend (email delivery).
• Google (Sign in with Google and, with consent, Google Analytics).
• Meta Platforms Ireland (with consent, measuring Facebook and Instagram ads).

We do not sell personal data. We may have to disclose it to authorities where the law requires.

Some of these providers are based in or use servers in the United States. Those transfers rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

• Account data and content: while the account is active and up to 90 days after deletion.
• Invoices and payment records: 10 years, for tax purposes.
• Site form entries without an account: up to 24 months.
• Analytics and marketing data: as stated in the Cookie Policy.

You can ask for access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time, by writing to hello@guestbusters.com. We reply within one month. You can also complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).

Data travels encrypted (HTTPS), passwords are stored hashed and internal access is limited to the people who need it to run the service.

If we change this policy in a material way, we will tell you by email or in the dashboard before it takes effect.