Privacy Policy
Version of 2026-10-01
This policy explains which personal data VilaTab processes, why, for how long, and your rights.
1. Controller
{COMPANY_NAME}, {ADDRESS}, is responsible for the data of hosts and website visitors. For guests’ data the host is responsible and we process it on the host’s behalf (see the Data Processing Agreement). Contact: info@vilatab.com.
2. Data about hosts
- Account: name, e-mail address, password (stored only as a secure hash by our sign-in provider), language, sign-in times.
- Profile and billing: phone, company name, billing address, VAT or tax number.
- Properties: names, addresses, map location, photos, logos, the contact details you show to guests (name, phone, WhatsApp number), Wi-Fi details, prices, offers, places and texts, calendar links.
- Use of the service: plan and payment status, plan requests, e-mails sent to you, the terms you accepted and when, translation usage, tablet status (last seen).
- Payments: your Stripe customer and subscription reference, plan, payment dates and amounts. Card details are entered only on Stripe’s pages and never reach us. If you take card payments from guests: your Stripe account reference and whether it can take payments; your identity and bank details stay with Stripe.
We use this data to provide VilaTab under our contract (Art. 6(1)(b) GDPR), to meet legal duties such as accounting (Art. 6(1)(c)), and in our legitimate interest in security, preventing abuse and informing you about your service (Art. 6(1)(f)).
3. Data about guests
VilaTab is built to need very little guest data:
- Booking dates and the platform (for example Airbnb or Booking.com) from the calendar links you connect. These calendar exports contain no guest names, e-mail addresses or phone numbers, and we do not store any.
- Direct reservations and extensions you record: dates, price and payment method, and a name only if you type one in.
- Tablet use: which offer QR code was scanned and in which language, counted without identifying anyone; the tablet’s random id; IP addresses only in hashed form to stop misuse of tablet links, kept for one day.
- WhatsApp: the QR codes open WhatsApp on the guest’s own phone. The messages go directly between guest and host through WhatsApp (Meta); VilaTab never sees them.
- Card payments for extra nights: the guest pays on Stripe’s page. We store the payment reference, the amount, the dates and the e-mail address the guest gave Stripe, so that the host sees the payment and the guest gets a receipt. Stripe processes the payment for the host and is itself responsible for its own legal duties such as fraud prevention (stripe.com/privacy).
The host decides about this data and informs the guests; we process it only to provide VilaTab.
4. Website visitors
We use no analytics, advertising or tracking. Our hosting provider records technical data (IP address, browser, time) in server logs for security; they are kept for a short time. The cookies and similar storage we use are listed in the Cookie notice.
5. Processors and recipients
We use these service providers, bound by data processing agreements:
| Service | What for | Where the data is processed |
|---|---|---|
| Supabase | Database, sign-in, photo storage | EU (Frankfurt, Germany) |
| Vercel | Hosting of the website, admin and tablet pages | EU and USA (EU–US Data Privacy Framework, standard contractual clauses) |
| Google (Maps, Places, Fonts) | Map, place details and fonts on the guest tablet; place suggestions in the admin | EU and USA (EU–US Data Privacy Framework) |
| DeepL | Machine translation of checkout steps and place texts | EU (Germany) |
| Resend | Sending e-mails | USA (standard contractual clauses) |
| MET Norway | Weather forecast (receives only the house’s coordinates) | Norway (EEA) |
| OpenStreetMap | Map tiles in the admin (loaded by your browser) | United Kingdom (adequacy decision) |
| Stripe | Card payments: hosts paying VilaTab, and guests paying hosts on the host’s own Stripe account | EU (Ireland) and USA (EU–US Data Privacy Framework, standard contractual clauses) |
Where data leaves the European Economic Area, it is protected by an adequacy decision (such as the EU–US Data Privacy Framework) or by standard contractual clauses. When the guest tablet opens the map, Google receives the tablet’s IP address; when a guest scans a QR code, their phone connects to the respective service directly.
6. How long we keep data
- Account and property data: while your account exists. If your subscription is not renewed, 12 months after the end of the paid year; then the property is deleted.
- Deleting a unit or a property removes its calendar, bookings, places, photos and tablet links at once.
- Invoices and accounting records: as long as accounting law requires (8 years in Hungary).
- E-mail log: 2 years. Hashed IP addresses: 1 day. Translation usage: 13 months. Accepted terms: while the account exists.
- Card payment references of extensions: as long as the extension is kept (until its unit is deleted); payment records at Stripe according to Stripe’s rules.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. Write to info@vilatab.com. You may also complain to a data protection authority, in Hungary the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu), or the authority where you live.
Guests who want to exercise their rights should contact their host first; we support the host.
8. Security
Connections are encrypted (HTTPS); every host can reach only their own data (row-level security in the database); passwords are stored only as hashes; access to production data is restricted to the people who need it.
9. Changes
We update this policy when our processing changes. The current version and its date are shown on this page; for important changes we inform you by e-mail and ask you to accept the new version in the admin.