1. Who controls your data
Stayly ("we", "us") is the data controller for personal data processed through www.stayly.co.uk. We handle data in line with UK GDPR and the Data Protection Act 2018.
[Company details to be completed: registered company name, company number, registered office address, and — if required based on processing volume — ICO registration number.]
2. What we collect
- Account data: name, email address, and password (stored securely, never in plain text) when you register.
- Profile data: anything you add to your profile, such as a phone number or avatar.
- Booking data: dates, guest count, messages with your Host or Guest, and booking history.
- Verification data: if you choose to verify your identity, the document you upload (e.g. photo ID) and its review status. Documents are stored in a private, access-controlled file store — never public.
- Payment data: online payments are processed by Stripe. Stayly does not receive or store your full card number — Stripe handles that directly and shares back only what we need to confirm and record a payment (amount, status, a payment reference).
- Listing data (Hosts): your caravan's details, photos, pricing, and availability.
- Usage data: pages visited, searches performed, and general device/browser information, collected via the analytics tools described in §5.
3. How we use your data
- To create and run your account, and to let Guests and Hosts communicate and book with each other.
- To process payments and payouts through Stripe.
- To send transactional emails — booking confirmations, host notifications, review requests, and similar — via our email provider, Resend. You can opt out of marketing emails at any time; transactional emails about your own bookings can't be turned off while you have an active booking.
- To review host and identity verification requests.
- To keep the platform secure, prevent fraud, and enforce our Terms of Service.
- To understand how Stayly is used, so we can improve it — via the analytics tools described below.
4. Who we share it with
We share personal data only with the service providers that help us run Stayly, and only what each genuinely needs:
- Supabase — our database, authentication, and file storage provider. All Stayly data is stored here.
- Stripe — payment processing and Host payouts.
- Resend — sending transactional and (if you've opted in) marketing emails.
- Pexels — provides royalty-free stock images for AI-generated blog content only; no personal data is sent to Pexels.
- Analytics providers — Google Analytics, Meta Pixel, and Microsoft Clarity (see §5) may receive usage data to help us understand and improve the platform, and, where you've interacted with a Stayly ad, to measure its effectiveness.
- The other party to a booking — a Host and Guest can see each other's name and the details needed to complete their booking, same as any marketplace.
We do not sell your personal data.
5. Cookies and analytics
Stayly uses cookies and similar technologies for essential site functionality (keeping you signed in) and, where configured, for analytics: Google Analytics 4, Meta Pixel, and Microsoft Clarity (session recordings and heatmaps, used to understand how the site is used, not to identify individuals). These only run in Stayly's production environment. You can block cookies in your browser settings, though essential cookies are required for the site to function (e.g. staying signed in).
6. How long we keep it
We keep account and booking data for as long as your account is active and for a reasonable period afterward to meet legal, accounting, and dispute-resolution obligations (for example, financial records connected to a Stripe payment). If you delete your account, we remove or anonymise personal data that we no longer have a legal or operational reason to keep.
7. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request erasure of your data, subject to our legal/operational retention needs above.
- Object to or restrict certain processing, including marketing.
- Request a portable copy of your data.
- Withdraw consent at any time where processing is based on consent (e.g. marketing emails).
To exercise any of these rights, contact us. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data.
8. Security
Access to your data is restricted by row-level security in our database — a user can only see the data their account is genuinely entitled to see (their own bookings, their own listings, or a booking they're actually part of). Payment card details never pass through or rest on Stayly's own servers. Verification documents are stored privately and are never publicly accessible.
9. Children
Stayly is not directed at children, and you must be at least 18 to create an account.
10. Changes to this policy
We may update this policy from time to time. If we make a material change, we'll update the "last updated" date above and, where appropriate, notify registered users by email.