Privacy Policy

1. Controller

The operator of StayWindow is the controller of the personal data described in this policy. Use the contact channels below for any privacy questions.

2. Data we process

• Account data: name, email address, profile image if provided by a sign-in provider, password authentication state, email-verification status, and account timestamps.
• Hotel-watch data: saved hotels, hotel URLs, date windows, stay length, occupancy inputs, target prices, notes, currency, notification preferences, and watch status.
• Check and alert data: requested checks, discovered prices, ranked stay periods, price history, booking-page sources, alert triggers, delivery channel, and technical status for checks.
• Security and operations data: hashed passwords, verification and password-reset tokens, rate-limit records, authentication/session data, service logs, and abuse-prevention signals.
• Contact data: name, email address, topic, and message content submitted through the contact form.
• Analytics data: server-side product events needed to understand core product use, plus optional first-party client page-view and CTA events only if you allow analytics.

3. Purposes

• Provide the service: create accounts, save shortlists, run hotel checks, show results, maintain history, and send requested alerts.
• Secure the product: authenticate users, verify emails, reset passwords, prevent abuse, rate-limit risky actions, and diagnose failures.
• Communicate with you: respond to contact messages and send transactional account, security, and notification emails.
• Improve the product: understand aggregate product usage, troubleshoot conversion paths, and prioritize reliability work.
• Prepare paid features: maintain account and subscription-readiness records if paid plans are introduced later.

4. Legal bases

Where GDPR or similar law applies, we rely on the following legal bases depending on the context:

• Contract performance or steps before a contract, where processing is needed to provide the account, watchlist, checks, alerts, and support you request.
• Legitimate interests, where processing is needed for security, service reliability, abuse prevention, diagnostics, and limited internal product analytics.
• Consent, where client-side analytics or similar non-essential browser storage depends on your cookie preference.
• Legal obligations, where records must be kept or disclosed to comply with applicable law.

5. Processors and recipients

We share personal data only as needed to operate, secure, and support the service. Depending on the live configuration, recipients may include:

• Database & hosting provider: Application database and stored product data
• Application hosting provider: Runs the web app, worker processes, and secure infrastructure
• Email delivery provider: Transactional email delivery for verification, password reset, and contact messages

6. International transfers

Some providers may process data outside your country or the European Economic Area. Where that happens, we rely on the appropriate safeguards offered by the relevant provider — typically standard contractual clauses or equivalent protections recognized under applicable data-protection law.

7. Retention

• Account and hotel-watch data is kept while your account is active or until you delete the relevant data.
• Check history and alerts are kept as part of your account history while the related hotel or account exists.
• Analytics events are retained for up to 180 days unless removed earlier by account deletion, retention cleanup, or operational need.
• Email-verification and password-reset tokens are removed after expiry or use, then cleaned up within up to 30 days.
• Contact messages and service logs are kept only as long as reasonably needed for support, security, diagnostics, or legal reasons.

8. Your choices and rights

• Access, correct, export, or delete certain account data from the account area where self-service controls are available.
• Request access, correction, deletion, restriction, objection, or portability by contacting us through the privacy contact path below.
• Withdraw consent for optional client-side analytics at any time from cookie settings.
• Complain to a competent data-protection supervisory authority if you believe your rights have been infringed.

9. Cookies and analytics choices

Necessary cookies and browser storage support sign-in, language, theme, and product stability. Optional client-side analytics is off unless you allow it. See the Cookie Policy for details and controls.

10. Security

StayWindow uses password hashing, scoped account access, rate limiting, short-lived tokens, and operational safeguards. No internet-facing service can guarantee absolute security, but the product is designed to limit unnecessary exposure of personal data.

11. Children

StayWindow is not directed to children. Do not create an account if you are under the minimum age required by applicable law unless a parent or guardian is permitted to consent and has done so.

12. Updates

We may update this policy as the product, providers, or legal requirements change. Material changes should be reflected on this page and, where appropriate, communicated through the product or by email.