Privacy policy

1. Who is responsible for data

[DENUMIREA LEGALĂ A OPERATORULUI], tax ID [CUI/CIF], registration no. [NR. REGISTRUL COMERȚULUI], with its registered office at [SEDIUL SOCIAL], România, is the controller for data processed to operate the platform. Contact: [email protected], [TELEFON].

For data used by a host to negotiate, confirm and provide accommodation, the host acts as a separate controller. Bookfilo does not control how the host uses data outside the platform.

2. Data we collect

Account and identity: name, email, phone, password stored only as a hash, email verification, avatar, language, timezone, currency, roles, notification preferences, Google/Apple identifier and public passkey credentials. We do not store a passkey’s private key.

Host business and billing data: person type, business name, tax ID, registration number, representative, registered office, billing email, and Stripe identifiers, subscriptions, payments, invoices, refunds and the latest non-sensitive payment-method details. Full card details and CVC are collected directly by Stripe.

Content and operations: property and room information, addresses and coordinates, photos, facilities, prices, availability, policies, booking enquiries, guest name/email/phone, party size, messages, notes, reviews and support conversations.

Technical and security data: IP address, user-agent, session identifier, approximate device information, last activity, logs, sign-in attempts, anti-abuse signals and pseudonymised identifiers. For basic visit counting we generate an HMAC hash from the account or, for visitors, from the IP prefix, user-agent and browser language; the hash is not designed to recover the original values.

Only with analytics consent: IP hash, approximate IP prefix, browser/operating system and major version, device type, language, timezone, resolution, referring domain and UTM parameters. Google Analytics receives page/interaction events only after consent.

For core map and location functions, Mapbox, Inc. receives your IP address, browser information, billing/session identifiers and requested map styles and areas through api.mapbox.com and events.mapbox.com. Optional performance metrics are disabled; map-load and style-load usage/billing events remain active. We do not send your name, email or booking details to Mapbox to display maps.

3. Data sources

We receive data directly from you, automatically from your browser and infrastructure, from Google or Apple if you choose social sign-in, from Stripe for subscriptions and from a host when they enter or manage an enquiry. Some property data may come from sources specified by the administrator during import; the host must verify it.

4. Purposes and legal bases

Contract performance and pre-contract steps: accounts, authentication, listings, enquiries, support, subscriptions, invoices and user-requested functions.

Legal obligations: accounting and tax, responses to authorities, consumer protection and handling data requests.

Legitimate interests: protecting accounts and sessions from unauthorised access; identifying fraudulent payments and fabricated enquiries; detecting bots and repeated automated requests; diagnosing errors and maintaining availability; proportionate evidence for disputes; and ordering listings using engagement and commercial ranking signals. Each purpose requires a necessity and balancing assessment. Pseudonymisation does not make data anonymous, and legitimate interests do not replace consent required for device access or storage.

Consent: Google Analytics and associated optional technical data; newsletters or marketing where separately selected; device permissions where applicable. Consent may be withdrawn at any time for the future.

Mapbox provides the core map and location functions needed for the requested Bookfilo service under contract performance or pre-contract steps; security and usage/billing administration rely on legitimate interests. Mapbox remains active when these functions are used, independently of optional analytics choices. Address/place searches send the search text or selected coordinates, IP address and browser information to the Mapbox API. Device location is accessed only on request and with browser permission.

5. Who receives data

The host of the chosen property receives your name, email, supplied phone number, stay details and message when you submit an enquiry and is a separate controller for their accommodation activity. Bookfilo staff and collaborators have access within their responsibilities; disclosures to authorities, courts and advisers need a legal basis. We do not sell personal data.

Contabo GmbH (a company based in Germany) supplies platform hosting and the infrastructure running the MySQL database and Redis cache/queues. MySQL and Redis are technologies, not separate recipients. Bookfilo generates database backups in the selected storage infrastructure. The data-centre country and any separate backup provider depend on the service actually used; you can request these details at [email protected].

Cloudflare, Inc. (USA, global network) supplies domain/DNS administration and incoming email routing. Messages to Bookfilo are currently forwarded to Gmail, so Google receives their contents, addresses and metadata. Where Cloudflare R2 is used for photos, Cloudflare also receives those files and their metadata. Do not email full card numbers, passwords or unsolicited identity documents.

Stripe (for EEA customers, ordinarily Stripe Payments Europe, Limited, Ireland; affiliates and services in the USA and other countries) processes payments, billing and fraud prevention. For online accommodation payments, necessary data goes to the provider connected by the host and identified before payment: Stripe, NETOPIA Payments, Viva, EveryPay, PayU or Cardlink, as applicable. Bookfilo stores transaction references and status, not full card numbers or CVC.

Google (Google Ireland Limited, Ireland, for European services; Google LLC, USA, and other affiliates) supplies Google Sign-In if chosen, Google Analytics only with consent, and Gmail for forwarded correspondence. Apple Distribution International Limited (Ireland; affiliates including Apple Inc., USA) supplies Sign in with Apple if chosen. These providers also have their own purposes described in their policies.

OpenAI Ireland Ltd. (Ireland; affiliates and providers in the USA and other countries) supplies the API for host-requested description drafts. The data and limits match the AI Policy; booking enquiries and support messages are intentionally excluded from the context. Any new AI supplier will be identified before it is used for personal data.

Mapbox, Inc. (USA) supplies maps and place/address searches, receiving IP addresses, browser information and requested function data through api.mapbox.com and events.mapbox.com. It may process in the USA and other countries; its policy normally provides for 30-day IP retention, with investigation exceptions. Details: https://www.mapbox.com/legal/privacy.

This list distinguishes providers processing on behalf of Bookfilo from recipients with their own purposes; not all are “sub-processors”. You can request the identity of the actual recipients of your data at [email protected].

6. International transfers

A company’s country does not guarantee where data is stored or accessed. Transfers outside the EEA can include affiliate or provider access. The EU–US Data Privacy Framework (DPF) applies only to certified recipients and covered processing; Standard Contractual Clauses (SCCs) require a transfer assessment and supplementary measures where needed.

OpenAI: its public agreement for EEA customers identifies OpenAI Ireland Ltd. and provides for SCCs or an adequacy decision for onward transfers. https://openai.com/policies/data-processing-addendum/. Cloudflare: its public agreement provides for DPF and SCCs for transfers without adequacy. https://www.cloudflare.com/cloudflare-customer-dpa/.

Stripe: public documents describe DPF and SCCs depending on recipient and transfer. https://stripe.com/legal/dta. Google: its public framework describes DPF and SCCs depending on service and recipient. https://policies.google.com/privacy/frameworks. Apple: its public policy identifies SCCs for EEA data transfers. https://www.apple.com/legal/privacy/en-ww/. Mapbox: its public documents describe DPF and SCCs where required. https://www.mapbox.com/legal/legal-faq.

These published provider mechanisms do not themselves confirm a signed agreement, verified certification or a particular region for Bookfilo’s account. You can request information about a specific transfer and a copy of applicable safeguards at [email protected], with confidential information protected. For Contabo and backups, safeguards depend on the actual region and service used.

7. Retention periods

Account data and content managed by the account holder are kept while the account is active. Following a closure request, the account is deactivated and deletion scheduled in 30 days; you may reactivate it during this period. Cleanup of the account and its resources runs through the scheduled process. Effects on enquiries, reviews and other recipients’ copies are explained in section 8; account deletion does not guarantee erasure of all these records.

Web sessions normally expire after 120 minutes of inactivity; device records remain until session revocation, logout, account deletion or technical cleanup. OAuth codes are single-use and expire in 90 seconds, and browser correlation in 10 minutes.

AI description drafts remain in Redis for up to 10 minutes. Individual AI metadata (user, property, model, tokens, duration and error) is deleted after 90 days, following aggregation into daily statistics without user or property identifiers.

Accounting and supporting payment documents are retained according to law, currently for 5 years calculated from 1 July following the relevant financial year. Data needed for litigation may remain until limitation periods expire and the case is finally resolved.

Booking enquiries and contact details remain in host history after resolution; approved reviews remain associated with the listing, and contact/support messages remain in communication records. These categories and individual visit statistics currently have no general automatic deletion deadline. Account or property deletion has the effects described in section 8. You can separately request erasure or anonymisation; any retention for legal obligations or disputes must be justified for the particular data. Guests can make a request without an account.

The database backup process is scheduled daily and by default keeps the latest five successful copies. A copy count is not a maximum age in days: process failures can extend retention. Copies may contain records erased from the live system; an erasure request must also consider backups and any later restoration.

8. How we delete and protect data

Account deletion is requested in settings, with a 30-day reactivation period. For a host, removing their properties also deletes their bookings and reviews; the account holder’s support conversations are deleted with the account. For a guest, enquiries in the host’s history are not automatically deleted: the account link is removed, but names and contacts in the enquiry may remain. Reviews are linked to a booking and the supplied email and do not automatically disappear when a guest account is deleted. Request erasure, anonymisation or restriction of these records separately at [email protected]; we assess retention grounds and other people’s rights. Independent host copies and provider records require separate assessment.

We use role controls, HttpOnly sessions with SameSite, CSRF protection, password and identifier hashing, passkeys, rate limits, validation, logging, backups and restricted access. No system is infallible; we handle incidents and notifications according to law.

9. Automated decisions and profiling

Bookfilo uses a commercial score for standard ordering and a separate calculation for the Popular badge. Parameters, payment influence and the difference between badge selection and display order are explained in Terms section 8a. We also detect likely bot user-agents. Ranking calculations do not decide guest acceptance or booking confirmation.

AI generation is initiated by the host and produces only an editorial draft. We do not make legal or similarly significant decisions solely on the basis of AI.

10. Your rights

Subject to the GDPR, you have rights to information, access, rectification, deletion, restriction, portability, objection to legitimate-interest processing and direct marketing, withdrawal of consent and not being subject to a solely automated decision with significant effects.

Send your request to [email protected] with the subject “Data protection”. You can request access and, where Article 20 GDPR applies, data you provided in a structured, commonly used, machine-readable format, and direct transmission to another controller where technically feasible. Exports are requested through this channel; the account currently has no download button. We may ask for proportionate information to verify identity. We respond within one month; if the legally permitted extension of up to two further months is necessary, we inform you within the first month and explain why. You may complain to ANSPDCP at https://www.dataprotection.ro/.

11. Minors and updates

The service is not intended for people under 18 and we do not knowingly collect personal data from children. If we learn that we have collected such data, we take steps to delete it.

We update this policy when operations or the law change. The date and version identify the revision, and the preceding snapshot is available in the archive. Material changes are communicated through an appropriate channel; where a new purpose requires consent, we obtain it before processing. A document update does not itself constitute consent.

PostHog — analytics and masked session replay

When configured and only after a renewed analytics choice, PostHog measures searches, property views, submitted enquiries and host onboarding steps. We send pseudonymous browser and session identifiers and, for eligible signed-in accounts, the internal account ID. Events contain only page categories, locale, device category, result counts, public property IDs and field or error codes. We do not send names, emails, messages, entered values, raw URLs, booking signatures or tokens. PostHog also receives connection data needed for delivery, including the IP address; IP-based analytics enrichment is disabled.

Session replay requires separate permission and analytics consent. When enabled in configuration, we select 20% of eligible sessions. Public discovery and property pages and the first 3 onboarding steps are eligible; authentication, account, private booking, payment, billing, support and administration screens are excluded. Text, inputs and data-bearing attributes are masked, and images and sensitive elements are blocked. We do not capture network request contents, headers, console logs or canvas.

We use an EU PostHog Cloud project in Frankfurt. PostHog, Inc. provides the service: https://posthog.com/privacy and https://posthog.com/dpa. On the initial free plan, events are retained for 1 year and recordings for 1 month. Access to dashboards and recordings is intended for the team improving the product; administrative and configured internal accounts are excluded from collection.

PostHog uses localStorage for pseudonymous identifiers and sessionStorage for session management, only after consent. Withdrawal stops collection and replay and clears PostHog browser persistence; logout or an account change resets identity. A Google Analytics choice from version 2 does not activate PostHog: we request a new version 3 decision in bookfilo_legal_consent_v2. Withdrawal does not automatically delete data already sent; contact us to exercise the rights described in the privacy policy.