Privacy Policy

The controller of your personal data is Playline Ltd, 5, 131 st street, Sofia, 1797, Bulgaria. For any privacy question or request, write to support@gostiko.com.

• Account data: your name, email address and sign-in identifier from our login provider, and optionally a phone number and profile picture.
• Bookings: the property, dates, number of guests, prices, booking reference, cancellations and refund requests.
• Messages you exchange with hosts or guests through Gostiko.
• Payments: payment status and amounts. Card details are entered on Stripe's pages and never reach us.
• Host data: listings, photos, prices, availability and calendar links, and the payout details you give Stripe during onboarding.
• Listing imports: text you paste so our AI assistant can draft a listing.
• Technical data: your IP address, browser and request details in our server logs, used to run and protect the service, and anonymous visit statistics.
• Your choices: language, and whether you agreed to the Terms and to marketing emails.

• To provide the service you signed up for: your account, bookings, payments, payouts, messages and booking emails (performance of a contract, Art. 6(1)(b) GDPR).
• To meet legal duties, such as keeping accounting and tax records (Art. 6(1)(c)).
• To keep Gostiko secure and working: preventing fraud and abuse, monitoring errors and counting visits without cookies (legitimate interests, Art. 6(1)(f)).
• With your consent (Art. 6(1)(a)): marketing emails, and loading Google Maps when you choose to show a map. You can withdraw consent at any time; this does not affect what happened before.

When you book, the host receives your name, contact details and booking details so they can host you; guests see a host's public listing and the messages they send. We do not sell personal data.

We use these service providers, who process data on our behalf under data processing agreements:

• Auth0 (Okta) for sign-in.
• Neon for our database and image storage.
• Amazon Web Services (SES) for sending emails.
• Stripe for payments and host payouts. Stripe also acts as an independent controller for its own fraud prevention and legal obligations.
• OpenRouter and the AI model providers it routes to, only for listing text a host chooses to import.
• Google Maps, only after you choose to show a map.

Some of these providers process data outside the European Economic Area, mainly in the United States. Such transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

• Account data: while your account exists. When you delete it, we erase or anonymise your personal data, except what we must keep.
• Booking and payment records: as long as tax and accounting law requires, typically up to 10 years.
• Messages: while the related account or booking exists.
• Server logs: a few weeks, unless needed to investigate an incident.

We only use cookies and browser storage that the site needs to work: to keep you signed in, remember your language, remember which dashboard you last used, finish a payment, and remember whether you allowed maps. These do not require consent.

We count visits with Umami, which we run on our own servers. It uses no cookies, does not track you across sites, skips browsers that send Do Not Track, and does not store your IP address: it uses it only briefly to tell visits apart and to find your country. Google Maps loads only when you click Show map; from then on Google may set its own cookies and receives your IP address.

You can ask us for access to your data, to correct it, delete it, restrict or object to its use, and to receive it in a portable format. You can download your data and delete your account from your profile, or write to support@gostiko.com. You also have the right to complain to a data protection authority, in particular in the EU country where you live or work.

Gostiko is for people aged 18 and over. We do not knowingly collect data from children.

When we change this policy we update the date above. If the change matters for how we use your data, we will ask you to review it when you next sign in.