Privacy policy

Making a booking means we need a few of your details. This page sets out exactly which ones, why we keep them, for how long, and who else sees them.

What we keep

• For a booking: your name, email, phone number, arrival and departure dates, number of guests, and the amount you paid.
• A private note the owner may keep about your stay, for example that you asked to arrive early.
• Your IP address, briefly, only to limit abusive repeated requests.

What we never see

Your card details. The payment happens entirely on Stripe’s own pages, which receive them directly. All we learn is that the payment succeeded and for how much.

Who processes them

• Stripe, for the payment.
• Supabase, which hosts the database, on servers inside the European Union (Ireland).
• Vercel, which hosts the website, and Cloudflare, which hosts the photographs.
• Resend, which sends the confirmation and cancellation emails. It receives your name, your email address and the booking details, only in order to deliver those messages.
• Google, through the map alone: as soon as the page opens, the map loads from Google’s servers, which receive your IP address and set their own cookies.
• Booking.com and Airbnb see DATES only, so the same night cannot be sold twice. We never send them your name or contact details.

On what legal basis

• The booking details: to perform the accommodation contract you enter into with us.
• The records of payment: because tax law requires us to keep them.
• Your IP address: for our legitimate interest in protecting the booking form from abuse.

For how long

Booking details are kept for as long as tax law requires records to be kept, and are deleted afterwards. A cancelled booking remains on record, because it relates to a payment that took place.

Cookies

The site uses no tracking, advertising or analytics cookies. There is one cookie, used only for the owner to sign in to the admin panel.

Your rights

You may ask for a copy of your data, a correction, or its deletion, and may also ask us to restrict or stop processing it, by phone or email using the contact details on this site. Deletion is possible where no tax obligation prevents it.

If you believe we have not handled your data properly, you have the right to complain to the Hellenic Data Protection Authority (www.dpa.gr).