Privacy policy
How HemmaBo handles personal data, and the GDPR roles of host and HemmaBo.
1. Introduction
Privacy Policy — English (canonical). Last updated: 2026-10-19. HemmaBo ("we", "us") protects your privacy. This policy explains how we collect, use, and protect personal data when you use HemmaBo's system. HemmaBo's role: We provide the technical platform hosts run their own direct booking on. We are not a travel agency, broker, or intermediary for accommodation.
2. Data controller and processor roles
Two distinct GDPR roles apply. HemmaBo processes guest data on behalf of the host under Art. 28 GDPR. The data processing terms in section 20 of our Terms of Service are the Data Processing Agreement (DPA) between HemmaBo and each host. Hosts remain responsible for complying with applicable data protection laws towards their guests.
- HemmaBo is data controller for: host account details (email, name, billing history)
- HemmaBo is data controller for: technical logs and analytics for hemmabo.com and the host dashboard
- HemmaBo is data controller for: communication between HemmaBo and the host
- The host is data controller for guest data (HemmaBo is processor): guest personal data (name, email, phone, booking details)
- The host is data controller for: host–guest communication
- The host is data controller for: reviews and feedback from guests
- The host is data controller for: technical logs from the host's booking website
- The host is data controller for: ID verification data (handled by Stripe, see section 4)
3. What data we collect
For hosts (our customers) and for guests (the host's customers). HemmaBo delivers booking websites to store and process guest data on behalf of the host. Do you have to provide it? Contact and billing details are required to enter into the agreement and to run your account and booking site — the service cannot be provided without them. Anything beyond that, such as a phone number in your profile or extra property information, is optional and only affects how complete your site is.
- Hosts: contact details (name, email, phone)
- Hosts: subscription billing information (handled securely via Stripe)
- Hosts: property information provided in the service
- Hosts: technical data (IP address, browser, device type)
- Guests: booking details (dates, guest count, requests)
- Guests: contact details (name, email, phone)
- Guests: payment status (we do not see card details — handled by Stripe)
4. Payments and Stripe
HemmaBo never receives money from guests. Payment goes directly from guest to the host's Stripe account via Stripe Connect. HemmaBo does not store card details, ID document images, or biometric data. Stripe processes this data on behalf of the host's Stripe account (Stripe Connect) and, for its own purposes such as fraud prevention and legal compliance, as an independent controller.
- Stripe processes card and payment data
- Stripe processes ID verification data and biometric data (if used by the host via Stripe Identity)
- Stripe processes fraud prevention analysis
5. How we use data
We use data for the purposes below. We do not use guest data for our own marketing.
- To provide and improve the system
- To manage host accounts and subscription billing
- To communicate service-related information
- To comply with legal requirements
- Legal bases (GDPR Art. 6): performance of a contract (Art. 6.1 b) for running the account, booking site and subscription; legal obligation (Art. 6.1 c) for accounting records under the Swedish Bookkeeping Act; legitimate interests (Art. 6.1 f) for security, abuse prevention and technical logs, balanced against your rights; and consent (Art. 6.1 a) for analytics cookies and optional features, which you can withdraw at any time. For guest data the host is the controller and determines the legal basis; HemmaBo processes it on the host's instructions under Art. 28.
6. Sharing of data
We never sell personal data. We may share data with the sub-processors below; hosts can request the current list. We do not proactively send guest contact details to AI providers. Property data (descriptions, images, location) is sent to AI providers to generate listings and answer questions. If a guest voluntarily types personal information (name, email, phone) into the on-site chat, that message is forwarded to the AI provider answering the chat in order to produce a response; it is not used for marketing or sold to third parties.
- Stripe (Stripe Payments Europe Ltd.) — billing, payments via Stripe Connect, and optional identity verification
- Brevo (Sendinblue SAS) — EU-based transactional email provider (booking confirmations and host notifications)
- AI providers — OpenAI: guest chat (gpt-4o-mini), automatic replies and smart messages, translation of property content, FAQ and location content, review summaries, checkout instructions, and semantic-search embeddings (text-embedding-3-small)
- AI providers — Google (Gemini): property text generation, image analysis, translation of messages between host and guest, and calendar reasoning
- AI providers — xAI (Grok): structured AI property search only, when configured; not used for guest chat
- Channel-management provider — two-way calendar and booking sync with the booking channels the host connects
- Supabase / Vercel — hosting and database infrastructure
- Transfers outside the EU/EEA: some providers above are established outside the EU/EEA — in particular the AI providers (OpenAI, xAI, Google) and parts of Stripe's and Vercel's operations. Where personal data is transferred to a third country, the transfer relies on the European Commission's Standard Contractual Clauses, and where applicable the EU–US Data Privacy Framework, together with the supplementary technical and organisational measures set out in the relevant provider's data processing agreement. Brevo (transactional email) is EU-based. You can request a copy of the safeguards for any specific transfer by contacting us.
7. Your rights
Depending on your jurisdiction, you may have rights such as access, correction, deletion, restriction of processing, objection and data portability. Where processing rests on consent, you can withdraw it at any time, and you can lodge a complaint with a supervisory authority. For guests: contact the host first to exercise rights relating to a booking. Automated risk scoring: a booking request is scored automatically against risk signals such as length of stay, how close to arrival it is booked, and guest count relative to capacity. The score is stored with the booking and shown to the host, and a high score can mark the booking as requiring host approval. The score does not decide anything on its own — the host makes the final call, and you can ask for the reason, contest it, and ask that it be reviewed by a person.
8. Retention
How long we keep data:
- Host accounts: as long as the account is active + 30 days after cancellation
- Guest data on a booking (name, e-mail, phone and messages): removed 180 days after check-out; a booking cancelled before payment is deleted after 30 days
- The bookkeeping record of a booking (amount and dates, without a name): 7 years after check-out, kept on the host's behalf
- Technical logs: 90 days
- Domain name: stored while the account is active, so we can serve the booking site on it. The domain is registered with the host's own provider — HemmaBo never registers domains and holds no registration record.
9. Cookies
We use necessary cookies for core functionality. Analytics cookies are used only with your consent, which you give or refuse in the cookie banner and can change at any time. Browser settings are not a substitute for that consent.
10. Contact and complaints
If you have questions about this policy or want to exercise your rights, contact us by email at info@hemmabo.se or by phone at +46 76-033 54 34. Postal address: HemmaBo, Asklundavägen 114, 244 91 Kävlinge, Sweden. If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Swedish supervisory authority, the Swedish Authority for Privacy Protection (IMY).
11. AI agents & the HemmaBo MCP connector
HemmaBo exposes a public Model Context Protocol (MCP) connector so AI agents can discover and verify host offers. When an AI agent accesses HemmaBo through this connector it receives property information, availability and pricing, and signed VRP verified stay-offer data (the host's cryptographically signed direct offer). The discovery and verification tools are read-only. No guest contact data is proactively sent to AI providers through the connector. HemmaBo never stores card data, ID documents, or biometric data.
What is a VRP vacation rental?
A VRP vacation rental is a holiday home whose host runs its own booking site on its own domain and publishes stay offers signed by that domain under the Vacation Rental Protocol (VRP). Any guest or AI agent can check, over plain HTTPS, that the price, the dates and the conditions come from the host — with no listing site, catalog or connector in between.
HemmaBo is software that makes a host's home a VRP vacation rental: the booking site on the host's own domain, the signed stay offers, and payment straight to the host.