Privacy Policy

Data Controller: AGERE - Krzysztof Blask
Contact: [email protected]

StayInFuerte ("we," "our," or "the Platform") is an online marketplace that connects property hosts and tourists interested in vacation rentals in Fuerteventura, Canary Islands, Spain. This Privacy Policy explains how we collect, use, and protect your personal data.

During Account Registration

• Full name (first and last name)
• Email address
• Password (hashed, never stored in plaintext)
• Account role (guest, host, or both)
• Timestamp of when you accepted our Terms of Service and Privacy Policy

When Using the Platform

• Property listings you create (title, description, photos, pricing, amenities, location)
• Inquiry messages you send to or receive from other users
• Profile information (avatar, bio, verification status)
• Account usage patterns (last login, activity logs)
• Technical data: IP address, browser type, device type (for rate limiting and security purposes only)

When Contacting Us

• Name, email, and message content if you contact our support team

Under GDPR Article 6, we process your personal data on the following bases:

• User accounts: Until account deletion + 30 days
• Property listings: Until account deletion
• Messages & inquiries: 2 years from last activity
• Consent records: 6 years (legal requirement — Spanish tax and commercial law)
• Contact form submissions: 1 year
• Rate-limiting logs and IP data: 90 days

Supabase (Database & Authentication): Storing user accounts, property data, and messages. Location: EU (Ireland). Website: supabase.com

Cloudflare (CDN & Hosting): Distributing the website and protecting against attacks, including the Cloudflare Turnstile anti-spam check on our contact and inquiry forms. Location: Global (distributed), with EU data centres. Website: cloudflare.com

Resend (Email Delivery): Sending authentication and notification emails. Location: United States. We do not send marketing emails. Website: resend.com. Resend Inc. is bound by Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers to the United States. A Data Processing Agreement is in place.

Google Analytics 4 (Google Ireland Ltd.): Statistics on how the Platform is used (pages viewed, device and browser type, approximate location). Loaded only after you accept analytics cookies; IP addresses are anonymised. Location: EU, with possible transfers to the United States. Website: policies.google.com/privacy

Sentry (Functional Software, Inc.): Error monitoring, so we can detect and fix technical errors (error details, page address, browser and device type). Data is stored in the EU (Germany). If you accept analytics cookies, a small share of visits may also be recorded as a session replay for troubleshooting, with text and form inputs masked. Website: sentry.io

CARTO and OpenStreetMap (map tiles): When you view a map, your browser loads the map images directly from these providers, which receive your IP address. Websites: carto.com, openstreetmap.org

Travelpayouts (affiliate links): Attribution of outbound booking links to partner websites. Its script is loaded only after you accept marketing cookies. Website: travelpayouts.com

All processors are GDPR-compliant and operate under Data Processing Agreements.

• Right to Access (Article 15): Request a copy of all personal data we hold about you
• Right to Rectification (Article 16): Ask us to correct inaccurate or incomplete data
• Right to Erasure (Article 17): Request deletion of your personal data, except where we have a legal obligation to retain it
• Right to Restrict Processing (Article 18): Request that we stop processing your data while you dispute its accuracy
• Right to Data Portability (Article 20): Request a copy of your personal data by emailing [email protected] — we will respond within 30 days
• Right to Object (Article 21): Object to processing based on legitimate interest
• Right to Lodge a Complaint: Contact the AEPD (Spain's data protection authority) at www.aepd.es

Email [email protected] with your full name, email address, description of your request, and proof of identity. We will respond within 30 days.

We use HTTPS/TLS encryption, hashed passwords, database encryption at rest, and access controls. If we discover a breach, we will notify you and relevant authorities as required by GDPR Article 33.

We use strictly necessary cookies (Supabase Auth session, CSRF protection) which are always active. We also use analytics cookies (Google Analytics 4) to understand how visitors use the Platform, and a marketing/affiliate cookie (Travelpayouts) to attribute booking referrals — these are only set after you give consent via our cookie banner. See our Cookie Policy for full details.

We also use Ahrefs Web Analytics, a privacy-friendly analytics tool that does not use cookies and does not collect personal data. Because it does not process personal data, it runs without requiring cookie consent.

The Platform is not intended for children under 16. We do not knowingly collect data from children under 16.

Most data is processed within the EU (Supabase in Ireland). Resend processes data in the United States under Standard Contractual Clauses (SCCs). Google and Sentry are US-based companies; where personal data is transferred to the United States, this is based on the EU–U.S. Data Privacy Framework or Standard Contractual Clauses.

We may update this Privacy Policy and will notify you of material changes by updating the "Last updated" date and, where significant, by email.

Email: [email protected]