Privacy policy

1. Controller and contact

The controller is Wiktor Wanat, trading as Wiktor Wanat IT Solutions, ul. Przewóz 32B/81, 30-716 Kraków, Poland; email: wanatwiktor08@gmail.com, phone: +48 530 538 544. Polish tax ID (NIP): 6793258327; business registration number (REGON): 524261255. Send privacy questions and requests to the email or postal address above.

2. Information we receive

We process your email, account identifier, authentication information managed by Supabase, property details and uploaded photos. If you choose Google sign-in, we receive information supplied for authentication, such as your identifier, email and available profile details. We do not receive your Google password.

For subscriptions we receive Stripe customer and subscription identifiers, payment status, billing interval and renewal dates. Card details are entered directly with Stripe; the StaayGuide application does not store your full card number or CVC.

When you contact us, we receive your message and contact information. Servers delivering the website may process IP addresses, request times, page addresses and browser information in technical logs. Please do not upload guest records, identity documents or information unnecessary for describing a property.

3. Purposes and legal bases

Account administration, saving properties, providing subscriptions and contractual communication: GDPR Article 6(1)(b). Providing required information is voluntary, but an email is needed to create an account and the payment provider’s required information is needed to purchase a subscription.

Tax, accounting and statutory obligations: Article 6(1)(c). Security, abuse prevention, troubleshooting, other enquiries and establishing or defending claims: Article 6(1)(f). Our legitimate interests are operating a secure service and protecting our rights.

We do not use your information for behavioural advertising or marketing profiling. We do not make decisions with legal or similarly significant effects solely through automated processing within Article 22 GDPR.

4. Providers and recipients

Vercel provides website hosting and delivery. Supabase provides the database, authentication and file storage; the production project’s selected region is Ireland. Stripe provides payments and billing and may act as a separate controller for its own fraud-prevention and regulatory obligations.

Google provides optional sign-in and the Gmail contact mailbox. Fonts are served from StaayGuide. Demonstration photos originate from Unsplash; direct requests to external resources disclose connection information, including IP addresses, to the provider. Links to maps and other services lead to services with their own privacy policies.

Supabase authentication infrastructure handles account messages. The production email delivery provider has not yet been selected; recipient information will be updated before it is enabled. Authorised service personnel, accounting and legal advisers, and public authorities may also receive information where necessary or required by law.

5. Processing outside the EEA

Selecting Ireland for the database does not mean every provider operation is confined to the EEA. Global hosting, payments, support, Google and Unsplash services may involve processing elsewhere.

Transfers requiring safeguards rely on an applicable GDPR Chapter V mechanism, such as an appropriate European Commission adequacy decision or standard contractual clauses. Contact us for information about applicable safeguards and how to obtain a copy. Provider documentation is linked below.

6. Retention

We retain account information and saved properties while the account is maintained. Canceling a subscription does not delete the account or properties. Properties can be deleted in the dashboard; account closure and erasure can be requested by email. Information required by law or for a specific dispute may be retained after closure.

Tax records are kept for the statutory period, generally five years from the end of the year in which the tax payment fell due, subject to statutory extensions. Correspondence is kept until the matter is resolved and, where it documents a contract or claim, until the applicable limitation period expires.

Technical records are kept as necessary for troubleshooting and security under the hosting and authentication services’ retention settings; incident records may be retained until investigation is complete. Backups follow provider overwrite cycles and are not used for ongoing use of deleted information. You may request retention information for a particular record.

7. Your rights

Subject to GDPR conditions, you may request access and a copy, correction, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons related to your situation. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

We respond within GDPR time limits, normally one month. We may request proportionate identity verification to protect your information. You may complain to Poland’s President of the Personal Data Protection Office (uodo.gov.pl) or another competent supervisory authority.

8. Information supplied by hosts

Hosts are responsible for lawfully providing content, including photos and other people’s contact details. This policy describes the operator’s processing as controller; it does not replace a host’s notices to guests or a data processing agreement where required. The current service is not intended for maintaining guest records.

Provider documentation

• Vercel
• Supabase
• Stripe
• Google
• Unsplash

Polish Personal Data Protection Office