# Guest Data and Privacy in Direct Booking

Vacation rental software. A signed stay offer on the host's own domain.

The host is the data controller for guest data; HemmaBo processes it.

## Who owns the guest data?

HemmaBo is a booking website provider. You as the host own and control all guest data.

- You as host are the data controller: You decide how guest personal data (name, email, phone, booking details) is collected, stored and used. HemmaBo does not make decisions about guest data on your behalf.
- HemmaBo is the data processor: HemmaBo stores and processes guest data on your behalf. We have no independent right to use guest information — we are the system provider, not the owner.
- Guest data is never shared with third parties without your consent: All guest data stays under your control. No third-party sharing without your explicit consent.
- Read our full policy: The details are in our privacy policy, which describes the exact roles of HemmaBo and the host.

## How is guest data stored in HemmaBo?

Guest data lives in a secure database, and payment data is handled entirely by Stripe.

- Booking data is stored in Supabase: Bookings, guest details and calendar data are stored in Supabase — a secure database system with encryption and access controls.
- Payment data is handled by Stripe: HemmaBo never sees card details. Stripe handles all payment data — card numbers, transactions and any ID verification. Funds flow directly from guest to your Stripe account.
- Export and deletion: You can request export or deletion of your data via the contact form. Guests who wish to exercise their rights contact you as the host first.
- Retention period: The name, e-mail, phone and messages of a guest are removed 180 days after check-out; the amount and the dates stay without a name for 7 years for the bookkeeping. Technical logs are kept for 90 days. Host accounts are deleted 30 days after cancellation.

## Your GDPR obligations as a host

You carry the legal responsibility for informing guests and complying with data protection rules.

- Inform your guests: You are responsible for informing your guests about how their data is handled — what data you collect, why, and how long it is stored.
- HemmaBo delivers the booking system, not legal advice: HemmaBo gives you the tools (booking system, payments, calendar) but the legal responsibility for GDPR compliance toward your guests lies with you as the host.
- Complaints and supervisory authority: If a guest has concerns about data handling, they can contact you as the host or the relevant data protection authority in their country.

[Read our full privacy policy](https://www.hemmabo.com/privacy)

https://www.hemmabo.com/data-and-privacy