Privacy policy
Last updated: 10 October 2026
This translation is provided for convenience; the Spanish version prevails.
1. Controller
[to be configured: company name] (NIF [to be configured: tax ID (NIF)]), address [to be configured: registered address]. Contact for data protection: ayuda@staydia.com.
2. What we process, why and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Account and sign-in | Name, email, password (hashed), sessions | Contract |
| Bookings, payments and refunds | Booking details, guests, amounts; card data are handled by Stripe, not by us | Contract |
| Messages between guest and host and support incidents | Message content | Contract |
| Guest registration | Identity document, nationality, date of birth, address of each guest | Legal obligation (Royal Decree 933/2021) |
| Security, fraud prevention and audit | IP, access logs, actions | Legitimate interest |
| Tax reporting of hosts (DAC7) | Host identification and income | Legal obligation |
| Measurement (only if enabled) | Pseudonymous browsing data | Consent |
3. Recipients
- The host of your booking receives what is needed for the stay and guest registration.
- Stripe (payments), the email provider and the hosting provider, as processors.
- Authorities, when the law requires it.
Some providers may process data outside the EEA; they do so under adequacy decisions (such as the EU-US Data Privacy Framework) or standard contractual clauses.
4. Retention
- Account: while it is active.
- Bookings and payments: for the periods required by commercial and tax law.
- Guest registration data: 3 years, then they are deleted automatically.
- Sessions expire after 14 days of inactivity.
5. Security
Passwords are hashed; secrets and guest registration data are stored encrypted (AES-256-GCM); every administrative action is logged.
6. Your rights
You can request access, rectification, erasure, objection, restriction and portability by writing to ayuda@staydia.com, and withdraw consent at any time. You may also complain to the Spanish Data Protection Agency (www.aepd.es). Cookies are explained in the cookie policy. Staydia is not intended for children under 14.