Privacy policy

1. Controller

The controller of your personal data is StayBaltica. For data protection questions write to hello@staybaltica.com.

2. What we collect

• Account data: name, email address, language, role (guest, host, service provider).
• Booking data: dates, number of guests, the stay or service booked, amount, cancellations and refunds.
• Messages you send to other users through StayBaltica.
• Provider data: listings, photos, address, booking page details, Stripe account ID.
• Reviews you write.
• Technical data: IP address and device data needed to run and secure the site. We use the IP address to work out your approximate region to show ads for your area; it is not stored.
• Location, if you use "Nearby" in search. Your browser asks for permission and the location is not stored.

3. Why we use it

• To make and fulfil bookings and arrange payments (contract).
• To send booking confirmations, reminders and thank-you emails (contract).
• So users can talk to each other (contract).
• To prevent fraud and abuse and keep the site secure (legitimate interest).
• To meet accounting and tax obligations (legal obligation).

4. Who we share it with

Data is shown only to those who need it: a booking is visible to the guest and the provider concerned.

We use trusted processors who handle data on our instructions:

• Supabase – database and login (data stored in the EU, Frankfurt).
• Vercel – website hosting.
• Stripe – payment processing and payouts to providers.
• Resend – sending emails.
• OpenStreetMap and unpkg – maps and map software; your IP address reaches them when a map is shown.

Where data leaves the European Economic Area, the European Commission's standard contractual clauses or other lawful safeguards are used.

5. How long we keep it

• Account data: as long as the account exists.
• Booking and payment data: 7 years, because of accounting rules.
• Messages: up to 3 years after the last message.
• Data of a deleted account is removed within 30 days, except what the law requires us to keep.

6. Your rights

You have the right to see your data, correct it, ask for it to be deleted, restrict or object to its use and get it in a machine-readable form. Write to hello@staybaltica.com; we reply within one month.

If you think we break data protection rules, you can complain to the Estonian Data Protection Inspectorate (aki.ee).

7. Security

Data travels over encrypted connections. Access is limited and every user sees only their own data. Card details stay with Stripe only.