Privacy Policy

Policy version: 2026-10-15

1. Who we are

Snapstay OÜ
Registry code: 17386920
Registered address: Harju maakond, Tallinn, Kesklinna linnaosa, Ahtri tn 12, 15551, Estonia
Privacy contact: [email protected]

We are the controller for our website, accounts, billing, support, security, and business operations.

Hotels normally control guest and reservation data. We process it under their instructions and privacy notices. The hotel determines its purpose and legal basis; we act as its processor.

2. Personal data we process

Depending on your use of our hotel management and booking services, we process:

• Account data: names, contact and business details, login details, and communications.
• Transaction data: subscriptions, invoices, payments, and references.
• Hotel data: property content, guest details, reservations, and requests.
• Usage data: IP addresses, device information, service activity, and security and error records.

Data comes from you, hotels, connected services, service use, and publicly available sources. Without required account, billing, or booking information, we cannot provide the relevant service.

3. Why we use personal data

For our controller processing, the GDPR legal bases are:

Purpose	Legal basis
Accounts, billing, and support	Contract with you or steps you request before it; for business contacts and staff, legitimate interests in providing services to their organisation
Security, errors, and legal claims	Legitimate interests in protecting the service and our rights
Usage measurement and service improvement	Legitimate interests in understanding use and improving services; consent where required
Advertising measurement	Consent
Mandatory records	Legal obligation

4. Sharing and international transfers

We share relevant data with:

• hosting, storage, communications, support, security, analytics, AI, billing, and payment providers;
• hotels and the booking channels, AI assistants, or other services they connect;
• advisers and authorities for legal duties or claims;
• parties involved in a business sale or transfer, with appropriate protections.

Providers may process data outside the European Economic Area, including the United States and China.

Connected AI assistants

A hotel can connect an AI assistant, such as ChatGPT or Claude, to one of its properties. Snapstay then returns the data the assistant requests, within the access the hotel approved. This can include property details, rooms and rates, reservations with guest names, dates, and amounts, payment and payment-link status, reviews, and performance figures. Results do not include guest email addresses, phone numbers, card details, passwords, or access tokens.

We send this data on the hotel’s instruction, as its processor. The assistant’s provider processes it under the hotel’s own account with that provider and the provider’s terms and privacy policy. Snapstay does not control that processing.

The hotel can disconnect an assistant at any time in Settings → Apps. This stops further access but does not delete data the assistant already received.

5. Cookies and analytics

Cookies and similar storage support sign-in, bookings, and preferences. Analytics use usage and transaction data to measure activity and improve services.

With consent, advertising partners receive usage and device data to measure advertising results.

Accept, decline, or change advertising consent through Privacy settings on this page. Declining does not prevent use of Snapstay. Withdrawal does not affect earlier lawful processing. Blocking storage in your browser can affect service functions.

Storage purpose	Duration
Account sign-in	Up to 30 days or sign-out
Booking flow	Browser session
Currency and onboarding preferences	Up to one year
Privacy choice	Valid for up to 180 days; stored until replaced or cleared
Optional advertising cookies	Up to 90 days

6. Retention and security

We keep data for its stated purpose, subject to legal retention duties:

• Business enquiries: generally 12 months after the last exchange.
• Account and support records: the customer relationship plus up to 30 days for closure, except legal records or claims.
• Hotel and guest data: under the hotel’s instructions and contract, with deletion from active systems targeted within 30 days of a valid instruction, unless law requires retention.
• Logs, errors, and metrics: a target of 30 days, except documented security incidents or legal claims.
• Accounting records: seven years after the end of the financial year in which the transaction was recorded, or longer where law requires it.

Backup copies remain until scheduled expiry. We use security measures appropriate to the risks.

7. Your rights

Under the GDPR’s conditions and exceptions, you can request access, correction, deletion, restriction, and portability; object to processing based on legitimate interests and to direct marketing; withdraw consent; and exercise rights concerning solely automated decisions.

To exercise your rights, contact us using section 1.

For data controlled by a hotel, contact the hotel. We help hotels respond to requests about guest data.

You have the right to complain to a data protection authority.

8. Changes

We update the date and notify affected people of material changes before they take effect where law requires it.