Privacy Policy

1. Controller and contact

The controller for GuestBun account administration, website operation, security, and analytics is the GuestBun operator identified in the Imprint.

Privacy, access, correction, or deletion requests may be sent using the contact information listed there.

2. Host and GuestBun roles

For host accounts and operation of the GuestBun service, the GuestBun operator determines the purposes and means of processing.

For guest pre-check-in information, the accommodation host generally determines why the information is collected and how it is used. In this service model, GuestBun processes that information on behalf of the host under the Data Processing Agreement. The host is responsible for identifying an appropriate legal basis and fulfilling applicable guest-registration obligations.

3. Data collected from hosts

GuestBun may process:

• Name and email address
• Password hash and authentication information
• Email-verification and password-reset information
• Acceptance records for the Terms, Privacy Policy, DPA, and reporting responsibility
• Property names, addresses, cities, countries, and accommodation details
• Booking dates, guest counts, check-in settings, and booking status
• Feedback and support messages
• Technical, security, and access-log information

4. Data collected from guests

Depending on the booking and country, the guest check-in form may collect:

• First and last name
• Date of birth
• Nationality or citizenship
• Identity-document type
• Identity-document number
• Document-issuing country

5. Purposes and legal bases

Personal data may be processed to:

• Create and administer host accounts
• Provide property, booking, check-in, and export functions
• Send verification, security, and service emails
• Protect the platform against misuse and unauthorized access
• Respond to support and privacy requests
• Meet applicable legal obligations
• Improve the website after analytics consent is given

Depending on the processing activity, the legal basis may be performance of a contract, steps requested before entering a contract, compliance with a legal obligation, legitimate interests in operating and protecting the service, or consent.

Google Analytics and Microsoft Clarity are activated only after consent. The intended legal basis is consent under Article 6(1)(a) GDPR together with the applicable rules governing access to information on a user's device.

6. Google Analytics

GuestBun uses Google Analytics 4 to understand website traffic and whether important product steps are completed. Depending on use, this may include:

• Page views and page paths
• Approximate location information
• Browser, operating-system, and device information
• Referrer and campaign information
• Session, engagement, and scroll information
• Product events such as account, property, and booking creation or completed guest check-in

Analytics is configured not to request advertising storage, advertising-user data, or advertising personalisation. Tokenised and record-specific URLs are replaced with generic paths before page-view events are sent.

Google Analytics may use cookies including _ga and related property-specific cookies after consent.

Provider: Google. Further information is available in the Google Privacy Policy.

7. Microsoft Clarity

GuestBun uses Microsoft Clarity on public website pages to understand usability problems. Clarity may provide aggregated statistics, heatmaps, and session recordings showing how visitors interact with public pages.

Processed information may include:

• Clicks, taps, scrolling, and navigation behaviour
• Page layout and rendering information
• Browser, device, operating-system, and screen information
• Approximate location and technical network information
• Visited public pages and referring pages

Clarity is activated only after analytics consent. It may then use cookies including _clck and _clsk. Withdrawing consent instructs Clarity to remove its cookies and end the consented session.

Provider: Microsoft. Further information is available in the Microsoft Privacy Statement.

8. Analytics consent and cookie settings

Google Analytics and Microsoft Clarity do not load unless the visitor selects Accept analytics.

The choice is stored in the visitor's browser using local storage under guestbun-analytics-consent. This preference is necessary to remember whether analytics was accepted or rejected.

Consent may be changed or withdrawn at any time using the Cookie settings button displayed on the website. Withdrawal does not affect processing carried out before consent was withdrawn.

9. Hosting and service providers

GuestBun uses specialised providers to operate the platform:

• Vercel — website hosting and delivery. Privacy notice
• Supabase — database and supporting infrastructure. Privacy policy
• Resend — transactional email delivery. Privacy policy
• Google — consent-based website analytics.
• Microsoft — consent-based behavioural analytics on public pages.

These providers may process data using infrastructure located in the European Economic Area or other countries. Where required, GuestBun relies on contractual and other legally recognised safeguards for international data transfers.

10. Data retention and deletion

Host-account information is retained while the account is active and for any additional period reasonably necessary for security, legal compliance, dispute handling, or establishment of legal claims.

Hosts can delete bookings and properties from the dashboard. Deleting a booking deletes submitted guest records attached to that booking. Deleting a property deletes its related bookings and attached guest records.

Analytics information is retained according to the configured retention settings and applicable provider rules. Data that is no longer required for its stated purpose will be deleted or anonymised where reasonably possible.

11. Security

GuestBun uses measures such as HTTPS transport encryption, password hashing, authenticated dashboard access, session controls, host-based data isolation, restricted check-in tokens, and access controls intended to reduce the risk of unauthorised access.

No internet-based system can guarantee absolute security. Hosts must protect their account credentials and provide check-in links only to the relevant guests.

12. Individual rights

Subject to applicable law, individuals may have rights including:

• Access to their personal data
• Correction of inaccurate data
• Deletion of personal data
• Restriction of processing
• Data portability
• Objection to certain processing
• Withdrawal of consent
• Complaint to a competent data-protection authority

Requests concerning guest check-in information may need to be handled together with the host responsible for the relevant property or booking.

13. Changes to this policy

This Privacy Policy may be updated when the product, providers, or legal requirements change. The current version and update date will be published on this page.