Operator and privacy contact

StayFast is operated by Patryk Basic.

Legal correspondence address: Luxemburgo 2, 03710, Calp; Spain .

NIF: Z3536829D.

Contact, support and personal-data rights: stayfast@brag.es.

Service details

Depending on the function used, data include account name, email, account and role identifiers, age-eligibility confirmation, listing content and photos, accommodation location, dates and booking records, messages, reviews, favourites, session/device identifiers and support or safety reports. Data are supplied by you, the relevant booking party or the operation of the service; public listing content is distinct from private account and communication records.

Providing the data required for a function is necessary to perform it: without an email and account credentials we cannot establish the corresponding account; without dates and accommodation information we cannot handle a booking request. Optional functions and marketing are not conditions of the basic account.

Access, rectification, erasure, restriction, portability, objection and withdrawal of any applicable consent are handled according to the legal basis and circumstances. Withdrawing consent does not retrospectively invalidate earlier lawful processing. Protection uses scoped access and secure sessions; no system guarantees absolute security.

Hosts also supply the legal-profile and offer-declaration data needed for admission: legal name, private/professional status, correspondence address, account contact, any required business identifier, and required accommodation registration or the stated reason it is not required. The operator and authorised staff may review the private fields; guests receive the admitted host identification and applicable public registration information, not the entire private profile. This is not a collection of KYC identity documents or bank details.

Accounts and personal data

We process the data needed for account access, listings, booking requests and related messages to perform the platform service or take steps you request before a contract, as applicable under GDPR Article 6(1)(b). Necessary legal duties and rights requests rely on Article 6(1)(c) only where an actual applicable obligation is identified. Necessary, proportionate security, claims handling and evidence of accepted terms may rely on Article 6(1)(f) after the relevant legitimate-interest assessment. Reading the privacy information is not general consent to all processing.

Marketing is not a condition of an account and is not activated by this launch. Ordinary adult registration does not require a date of birth or identity document. Technical sorting, validation and status checks do not establish a verified identity or legal licence; B3 offer admission involves a human operator. We do not claim advertising profiling or solely automated decisions with legal or similarly significant effects as an implemented service.

Recipients

Necessary data are available to authorised staff and the relevant booking party. The hosting provider identified in the owner-reported account information is IONOS Cloud S.L.U.; account records, PostgreSQL data and own uploaded media are handled on the operator's server. Encrypted recovery copies remain on the operator-controlled external SSD, not a third-party cloud. IONOS SMTP for the existing Correo Basic mailbox is prepared for the release but has not yet been activated in StayFast.

The applicable IONOS general terms, section 7.2, refer to its data-processing agreement (DPA), version 1.2, December 2023. DPA section 12.3 provides for incorporation into the product terms, while section 12.1 requires customer acceptance. The owner-reported signed-in account information states incorporation from 14 December 2023; the recovered order evidence concerns the VPS purchased on 16 March 2026. These sources are the documented basis of this information. They are not presented as an independently retrieved acceptance receipt for a specific terms version or as evidence of a separately signed DPA.

IONOS DPA Annex 2, version 4.1 dated April 2026, lists Arsys Internet S.L.U. in Spain for VPS operation and support, and 1&1 Mail & Media GmbH in Germany for Correo Basic email delivery and receipt. Open-Xchange GmbH in Germany is listed for the webmailer; that entry is not represented as proof of an additional StayFast application integration. Entries for other products are not automatically attributed to this VPS.

The recovered order record dated 16 March 2026, supplied from the project history by the operator and linked to the same VPS subsequently used by StayFast, identifies the original data-centre country as Germany. The present physical location and the absence or occurrence of a later migration have not been independently reconfirmed. This statement is based on the order history, not IP geolocation. DPA section 4.3 provides for EU/EEA processing, with necessary transfers to third countries subject to Article 44 et seq. GDPR. This is a contractual safeguard, not proof of an actual transfer or a guarantee that all processing and support access remain within the EEA. The applicable IONOS DPA and current subprocessor annex are available at IONOS data-processing terms.

In the release candidate, the optional Google Maps embed is not created or contacted until you choose “Display map” for the current listing. Before that choice, the map control explains that Google will receive the IP address, browser request information and displayed listing location or map query, and may use its own cookies or browser storage. StayFast remains usable without the map. This choice is held only in memory for the current listing, location and title: changing the listing or location, leaving and returning, or reloading requires a new choice. “Hide map” removes the iframe, but cannot withdraw information already sent to Google or erase the provider's existing storage. The embed uses a no-referrer policy. This describes the new local candidate, not a claim that the older public release has already changed.

External links to Google Maps, Apple Maps or OpenStreetMap contact the selected service when you open the link. They are separate optional navigations, not permission to load the embedded map. Where an existing external Unsplash image is displayed, the browser may request it from that provider; it is not an operator-owned local image. Earlier Stripe onboarding may already have created provider account records even though real financial transactions remain disabled. Further payment and host-verification processing needs separately approved information; StayFast's own host legal profile does not collect identity-document scans or bank details.

The code can select an AI or native-push provider depending on actual configuration. Defaults alone do not prove that these services are off. Their effective inventory, recipients, data scope, roles and applicable contractual/location/transfer conditions have not been verified in this review; no active service or completed inference is asserted. That inventory must be settled before this information can be treated as ready for publication.

Retention

Account, profile and host legal-profile data are kept while the account and its requested service are in use. An account-closure or erasure request triggers a case review of each category: identity/profile, content, media, booking records, disputes and security. Data with no remaining justified purpose are deleted or irreversibly anonymised without undue delay once that review clears them; pseudonymisation is not erasure.

Booking and communication records needed for an outstanding stay, complaint, legal duty or a concrete claim are restricted to that purpose. We record the reason for retaining them and review it when the stay or case closes, the duty ends or a preservation requirement changes. The same test applies to the host's private legal address and business details; an unapproved or closed listing is not a reason to retain its entire profile indefinitely.

Closed support cases and routine security logs are reviewed manually at case or incident closure and in a monthly retention review. We remove material no longer needed for a documented follow-up, security investigation, legal duty or concrete claim. An exception identifies the data concerned, its reason and its next review trigger; it does not permit unrelated records to be kept indefinitely.

Encrypted recovery copies are not used as the active customer database. We review each generation after a successful replacement copy and after closing the deployment or incident for which it was kept. Obsolete generations are removed once no longer needed for recovery or a documented preservation reason. Before a restored system reopens, applicable erasure and restriction decisions are reapplied. There is no promise of automatic deletion of all backups after 30 days.

Erasure requests are handled with human review and the necessary recorded clearances; an acknowledgement or a queued task is not proof of completed deletion. No automatic purge service or blanket 30-day erasure, 12-month support or 30-day backup schedule is represented as operating. Financial records have no invented universal period; any applicable statutory period is determined for the actual record and obligation.

Your data rights

For personal-data matters, contact only stayfast@brag.es. We act without undue delay and inform you of the action on a rights request within one month of receipt. Where the law permits an extension because of complexity or the number of requests, we explain it and its reasons within that first month. This is the statutory response framework, not a promise that every record is erased within 30 days. Identity checks are proportionate, without routinely requiring an identity document.

The app's scheduled account-closure flow has a grace period of at least 30 days from the request. While closure is still reversible and anonymisation has not been committed, you may cancel it using the available account action. Passing that period makes the request eligible for reviewed processing; it does not prove automatic or completed deletion. This product grace period is neither the statutory one-month response period nor a general postponement of erasure rights: you may contact stayfast@brag.es separately to exercise those rights without waiting for the app schedule.

You may complain to Spain's Agencia Española de Protección de Datos (AEPD) or another competent EEA supervisory authority as applicable; this information does not restrict you to an exclusive Spanish forum. Contact for data rights remains stayfast@brag.es; no unconfirmed data protection officer is presented.

Versions and changes

The approved document identifies its version and effective date. For new accounts we retain the accepted version, language, time and user linkage. We do not attribute acceptance events to earlier users where none occurred. Changes requiring renewed acceptance will be presented separately, preserving users' rights.