Privacy Policy

Data Controller: AGERE - Krzysztof Blask
Contact: [email protected]

StayInFuerte ("we," "our," or "the Platform") is an online marketplace that connects property hosts and tourists interested in vacation rentals in Fuerteventura, Canary Islands, Spain. This Privacy Policy explains how we collect, use, and protect your personal data.

During Account Registration

• Full name (first and last name)
• Email address
• Password (hashed, never stored in plaintext)
• Account role (guest, host, or both)
• Timestamp of when you accepted our Terms of Service and Privacy Policy

When Using the Platform

• Property listings you create (title, description, photos, pricing, amenities, location)
• Inquiry messages you send to or receive from other users
• Profile information (avatar, bio, verification status)
• Account usage patterns (last login, activity logs)
• Technical data: IP address, browser type, device type (for rate limiting and security purposes only)

When Contacting Us

• Name, email, and message content if you contact our support team

Under GDPR Article 6, we process your personal data on the following bases:

• User accounts: Until account deletion + 30 days
• Property listings: Until account deletion
• Messages & inquiries: 2 years from last activity
• Consent records: 6 years (legal requirement — Spanish tax and commercial law)
• Contact form submissions: 1 year
• Rate-limiting logs and IP data: 90 days

Supabase (Database & Authentication): Storing user accounts, property data, and messages. Location: EU (Ireland). Website: supabase.com

Cloudflare (CDN & Hosting): Distributing the website and protecting against attacks. Location: Global (distributed), with EU data centres. Website: cloudflare.com

Resend (Email Delivery): Sending authentication and notification emails. Location: United States. We do not send marketing emails. Website: resend.com. Resend Inc. is bound by Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers to the United States. A Data Processing Agreement is in place.

All processors are GDPR-compliant and operate under Data Processing Agreements.

• Right to Access (Article 15): Request a copy of all personal data we hold about you
• Right to Rectification (Article 16): Ask us to correct inaccurate or incomplete data
• Right to Erasure (Article 17): Request deletion of your personal data, except where we have a legal obligation to retain it
• Right to Restrict Processing (Article 18): Request that we stop processing your data while you dispute its accuracy
• Right to Data Portability (Article 20): Request a copy of your personal data by emailing [email protected] — we will respond within 30 days
• Right to Object (Article 21): Object to processing based on legitimate interest
• Right to Lodge a Complaint: Contact the AEPD (Spain's data protection authority) at www.aepd.es

Email [email protected] with your full name, email address, description of your request, and proof of identity. We will respond within 30 days.

We use HTTPS/TLS encryption, hashed passwords, database encryption at rest, and access controls. If we discover a breach, we will notify you and relevant authorities as required by GDPR Article 33.

We use strictly necessary cookies (Supabase Auth session, CSRF protection) which are always active. We also use analytics cookies (Google Analytics 4 and Google Tag Manager) to understand how visitors use the Platform — these are only set after you give consent via our cookie banner. See our Cookie Policy for full details.

The Platform is not intended for children under 16. We do not knowingly collect data from children under 16.

Most data is processed within the EU (Supabase in Ireland). Resend processes data in the United States under Standard Contractual Clauses (SCCs).

We may update this Privacy Policy and will notify you of material changes by updating the "Last updated" date and, where significant, by email.

Email: [email protected]