Privacy policy

Who is responsible

Meik Schütz, tax number (NIF) 231101538, Rua Parque Norte, 23, 2.1, 4600-105 Braga, Portugal.

For any question about your data, write to hello@stayin.pt.

Waiting list

When you ask to be told when sign-up opens, we store your email address, the language of the page and the date of your request.

We use this data only to tell you when sign-up opens. The legal basis is your consent, which you can withdraw at any time by writing to us; we then delete your email address.

Admin area accounts

For people who use the admin area we store their name, email address, role in the account (Administrator or Collaborator), password — only in hashed form, never readable — and the date of their last sign-in.

If you sign in with Google, Google confirms your email address and name to us. We never receive your Google password.

We use this data to give you access and to send invitations and password-reset emails. The legal basis is the performance of the contract. We keep the data for as long as the account exists.

Data hosts enter

Bookings, guest details, documents and messages are entered by hosts. For this data the host is the controller, and stay’in processes it on the host's behalf as a processor (Article 28 GDPR). If you are a guest, please exercise your rights with the property you stayed at.

Guests' identification data is reported to SIBA, the Portuguese guest registration system, when the host does so through the platform, to meet the host's legal obligation.

Guests' personal data is deleted automatically after the period each host sets.

Technical data

The IP address of whoever submits the waiting-list form is used briefly to limit abuse and is not stored.

The server logs technical errors so we can diagnose them. The legal basis is our legitimate interest in keeping the service secure and working.

Cookies

The stayin.pt website and the guest pages use no cookies and no analytics tools.

The admin area uses only necessary cookies: to keep you signed in and to remember the language you chose.

Who else processes data

We use these providers, each only for the purpose stated:

• Hetzner Online GmbH (Germany): server hosting, in Finland (European Union).
• Resend, Inc. (USA): sending invitations and password-reset emails.
• Google (USA): signing in with Google and, when a host connects their Gmail mailbox, access to that mailbox to read and send guest messages.
• Anthropic, PBC (USA): artificial intelligence features the host uses — suggested message replies, reading invoices and receipts, and translations.

When a provider processes data outside the European Union, the transfer relies on the standard contractual clauses approved by the European Commission or on the EU-US Data Privacy Framework.

We do not sell personal data or use it for advertising.

Your rights

You can ask for access to your data, its correction or deletion, restriction of or objection to its processing, and data portability. Where processing is based on consent, you can withdraw it at any time.

Write to hello@stayin.pt. We reply within one month.

You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

Changes

If this policy changes, we publish the new version on this page and update the date at the top.