Privacy Policy
Last updated: 11 July 2026
Controller: operator of staypagy.com (independent project, not a registered company).
Contact: [email protected]
Staypagy hosts vacation-rental listing pages. Guests contact Hosts directly; we do not take bookings or messages.
Data
| Who | Data | Purpose | Art. 6 |
|---|---|---|---|
| Waitlist | Launch updates | Consent (a) | |
| Host | Email, password hash, language, listing content | Account & listings | Contract (b) |
| Host session | Token; IP; user agent | Sign-in & security | (b), (f) |
| Visitors | Logs, essential cookies, locale | Operate & secure the site | (f) |
| Listing traffic | Aggregated views, device, country, referrer; short-lived IP+UA hash | Host analytics | (f) |
Legitimate interests (f): run and secure the site; show Hosts listing traffic. Host email and password are required for an account.
Cookies: Cookie Policy. No ads or social trackers. No automated decisions with legal effects.
Sharing & transfers
Hetzner (EU hosting), Cloudflare (CDN, R2 photos, cookieless analytics), email provider for transactional mail. Host-published contacts are public. Primary processing is in the EEA; outside-EEA processing uses SCCs or an adequacy decision.
Retention
Waitlist — until you opt out. Account — while active, then deleted in a reasonable time. Sessions — until sign-out/revocation. Logs — ~90 days. View aggregates — while the listing exists. Dedupe hash — ~30 minutes.
Rights
Access, rectification, erasure, restriction, portability, objection (legitimate interest), withdraw consent. Reply within 30 days: [email protected]. Complaint: CNPD. Portuguese law + GDPR. Not for under-16s.