Privacy policy

Data controller

Jamie Gary (Tax ID Y8320940Z), registered at Calle Pepa Guerra Valdenebro, bloque 2, 29631 Arroyo de la Miel, Benalmádena (Málaga). Data protection contact: privacy@checkinsecure.com (operational mailbox of the same operator).

What data we process

Request form: name, email, phone (optional), the name and city of your rental, a link to your listing (optional), number of rentals, plan of interest, desired domain (optional), whether you want to activate CheckInSecure, and any message you add. To detect abuse of the form, we keep for a short period an irreversible code (hash) derived from your IP address and your email; we do not store your IP address in clear.

Owner account: email and name. Access is passwordless (one-time link by email); if you come from CheckInSecure, the account is linked through the same shared-identity mechanism (see the specific notice when connecting).

Your Direct Website's setup: rental address, city, description, amenities, policies, prices, photos and logo you upload (stored in a private bucket, never public by direct URL without access control).

Bookings: the guest's name, email and phone (optional), dates, number of guests and amount. Entered by the guest when booking, or by the owner when logging a manual booking. We do not collect guest ID documents -- that, when it applies, is handled independently by CheckInSecure under its own legal notice.

Payments: we do not store card data. Payment is processed directly by Stripe; we only keep technical references (transaction id, amount, status) to be able to manage refunds and disputes.

Owner billing: name or company name, tax ID and tax address, and the invoices OwnGuests issues to the owner (setup and commissions), with their chained integrity record. Legal basis: compliance with legal obligations (invoicing and tax rules) and performance of the contract.

Owner's payment account: the status of the Stripe connection (connected, pending, restricted) and the owner's Stripe account identifier. On fixed-fee plans, to take bookings in the owner's own Stripe account, OwnGuests processes the technical configuration needed to provide the service (a key restricted to charging, capturing, refunding and checking those bookings, and the configuration of their webhook), stored encrypted. We never access the owner's passwords, access codes or bank account (IBAN); the owner can revoke that key at any time.

Communications: the operational emails we send (confirmations, notices, access links) and their delivery status (sent, delivered, bounced), handled by Resend.

Support: whatever you write to us when asking for help or making an inquiry.

Security and technical logging: technical logs without personally identifiable data (no names, emails or raw tokens), used only to detect errors and abuse.

What we use it for

To handle your request and contact you to agree on launching the service (pre-contractual steps at your request); to provide the contracted service (contract performance): build and maintain your website, process bookings and payments, send you the necessary operational emails and provide support; and for security and abuse prevention (legitimate interest).

Our role regarding guest data

For direct bookings, OwnGuests processes guest data as data controller: OwnGuests operates the booking engine and needs that data to manage the booking itself (confirmation, payment, communication with the owner). We share with the property owner what is necessary for them to host the guest (name, contact, dates, number of guests). This differs from CheckInSecure's role regarding the legal identity data that Spanish tourism regulations require for SES Hospedajes: there, CheckInSecure acts as the owner's/manager's data processor, under its own Data Processing Agreement (DPA) -- see checkinsecure.com. OwnGuests does not collect that legal identity data.

Recipients and sub-processors

We do not sell personal data to third parties. We use the following technology providers as sub-processors:

Cloudflare, Inc. -- application infrastructure, database and photo storage (Workers, D1, R2) and cookieless aggregate visit statistics (Web Analytics). US / EU depending on Cloudflare's configuration.

Resend -- transactional and operational email delivery. US.

Stripe -- payment processing: on the per-booking plan, commission collection and transfers to the owner; on the monthly and annual plans, bookings are charged to the owner's own Stripe account and the plan fee to OwnGuests' account. Ireland / US. OwnGuests never receives or stores card data: you enter it directly on Stripe's hosted page.

Retention

Requests that do not turn into a contract: 12 months from the last interaction, then deleted unless an active contractual relationship exists.

Issued invoices and their records: for the retention period required by tax and invoicing rules, including after the account is closed; they are not modified or deleted before then.

Account, booking and billing data: for as long as the account remains active and, after termination, for the period necessary to meet legal obligations (including tax obligations, see Terms) or to defend against claims.

Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data by writing to privacy@checkinsecure.com. We will respond within the period established by the GDPR (generally, one month from receipt of the request). You may also lodge a complaint with the Spanish data protection authority (AEPD, aepd.es).

Cookies

This site only uses cookies strictly necessary for signing in. See the cookies page for details.