Privacy Policy

This Privacy Policy explains what personal data we process, why and on what legal basis, who we share it with and what rights you have. It covers:

• the website staynaut.com (the “Website”),
• the application at app.staynaut.com, consisting of the host dashboard (the “Dashboard”) and the guest guides opened from a QR code or link (the “Guide”).

Together they are the “Service”, and the service provided through them is “Staynaut”. This is a translation — in case of any discrepancy, the Polish version prevails.

The controller of your personal data is Jan Strózik, a sole trader operating as Jan Strózik, ul. Jerzego Samuela Bandtkiego 19A/9, 30-129 Kraków, Poland, tax ID (NIP) 6772525869, REGON 541836662 (the “Controller”, “we”).

For any data protection matter, write to hello@staynaut.com or to the postal address above. We have not appointed a Data Protection Officer.

Technical data. Each time you visit the Website, the server logs your IP address, the date and time of the request, the page requested and browser information. We use it to run and secure the Service and diagnose errors, based on our legitimate interest (Art. 6(1)(f) GDPR).

Sign-up and contact. If you leave your email address in the Website form or write to us, we process your email address and the content of the correspondence to reply and to tell you about Staynaut, based on Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (handling enquiries).

Analytics and marketing cookies. Only if you consent in the cookie banner, we use Google Analytics (traffic analysis) and Meta Pixel (measuring and targeting ads). This includes device and browser identifiers, IP address and information about your activity on the Website. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time — see section 8.

If you create a Dashboard account, we process:

• account data: name, email address, optionally a phone number, and your password — stored only as a secure hash (scrypt), never in plain text,
• billing data: invoice name, tax ID (if provided), invoice address and email, chosen plan, invoice and payment history,
• login session data: session identifier, a hash of your IP address (we do not store the address itself), browser type and last activity time,
• content you add to the guide: apartment descriptions, instructions (e.g. Wi-Fi details, door codes), recommended places, routes and photos.

Purposes and legal bases:

• creating and maintaining your account and providing Staynaut under the Terms — Art. 6(1)(b) GDPR (performance of a contract),
• issuing invoices and bookkeeping — Art. 6(1)(c) GDPR (tax and accounting obligations),
• account security, preventing abuse, service communication, and establishing, exercising or defending legal claims — Art. 6(1)(f) GDPR.

The host is responsible for the content published in their guide. Please do not include other people’s personal data unless necessary.

Guests open the Guide in their browser and do not create an account. We do not ask for a name or email unless the guest chooses to send a booking request.

Visit statistics. When the Guide is opened, we record the date and time, a hash of the IP address (one-way, with a secret salt — the IP address itself is not stored), browser type and the referring page. This lets the host see in the Dashboard how often the guide is opened and helps us protect the Service from abuse — based on Art. 6(1)(f) GDPR.

Settings on your device. The chosen language is remembered in a cookie, and places and day plans saved by the guest are kept in the browser’s local storage on their device. This data is not sent to our server.

Booking requests. If a guest sends a request from the Guide to book a partner’s service (e.g. an airport transfer), we process the name, phone or email, preferred time, number of people and notes they provide. We pass them to the partner providing the service and to the host of the apartment so the request can be handled — based on Art. 6(1)(b) GDPR (steps taken at the data subject’s request before entering into a contract). The guest contracts the service itself directly with the partner.

Data may be shared only as far as necessary for the purposes above:

• Hostinger International Ltd. — provider of the server the Service runs on (hosting),
• our email provider, used for correspondence,
• Google Ireland Ltd. / Google LLC — Google Analytics, only with your consent,
• Meta Platforms Ireland Ltd. / Meta Platforms, Inc. — Meta Pixel, only with your consent,
• Anthropic PBC — automatic translation of guide content, if the host uses it (only the text to be translated is sent),
• OpenStreetMap Foundation (Nominatim) — looking up coordinates of an address entered by the host,
• partners providing services requested by guests, and the host of the apartment — for booking requests (section 4),
• our accounting office, bank and public authorities where required by law.

Maps and some photos in the Service are loaded directly from external servers (OpenFreeMap and OpenStreetMap for map tiles; Unsplash for some photos). Your browser then connects to those servers and shares its IP address with them, as with any resource loaded from the internet. Navigation links open Google Maps only when clicked.

Using Google, Meta, Anthropic and Unsplash services may involve transferring data outside the EEA, in particular to the United States. Such transfers rely on the European Commission’s decision on the EU-US Data Privacy Framework (where the recipient participates in it) or on standard contractual clauses approved by the European Commission. You can obtain a copy of these safeguards by writing to us.

• server logs — up to 14 days,
• host account data and guide content — for as long as the account exists, and after deletion for the limitation period for claims,
• invoices and billing data — 5 years from the end of the year in which the tax obligation arose,
• login sessions — 30 days from last use,
• Guide visit statistics — up to 13 months,
• booking requests — as long as needed to handle them, no longer than 12 months,
• correspondence — as long as needed to handle the matter, then for the limitation period for claims,
• data processed on the basis of consent — until consent is withdrawn or the cookie expires (section 8).

Cookies are small files stored in your browser. We also use the browser’s local storage. We use:

• essential — remembering your choice in the cookie banner (local storage, until you change it), the Dashboard login session (cookie `sn_session`, 30 days) and the Guide language (cookie `sn_lang`, 12 months). No consent required,
• analytics — Google Analytics (e.g. `_ga`, `_ga_*`, up to 2 years). Only with consent,
• marketing — Meta Pixel (e.g. `_fbp`, up to 3 months). Only with consent.

On your first visit to the Website you choose which categories you accept. You can change your mind at any time with the cookie icon in the corner of the page or the “Cookie settings” link in the footer. You can also delete or block cookies in your browser settings; blocking essential cookies may prevent you from logging in to the Dashboard. The Guide and the Dashboard do not use analytics or marketing cookies.

You have the right to:

• access your data and receive a copy,
• rectify your data,
• erase your data,
• restrict processing,
• data portability for data processed on the basis of a contract or consent,
• object to processing based on our legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
• lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland) or the supervisory authority in your country.

To exercise your rights, write to hello@staynaut.com.

We do not make decisions about you based solely on automated processing that produce legal effects. If you consent to marketing cookies, Meta may analyse your activity to tailor ads — you can prevent this by not giving or by withdrawing consent.

Providing data is voluntary, but necessary to create an account and use the Dashboard, receive an invoice or send a booking request. Consent to analytics and marketing cookies is not a condition for using the Service.

The Service runs only over encrypted HTTPS connections, passwords are stored as hashes, and IP addresses in statistics as one-way hashes.

We may update this Policy, e.g. following changes in law or in the Service. The current version with its date is always available on this page. We will notify hosts with an account of material changes by email. Questions: hello@staynaut.com.