Privacy Policy

1. Who we are

GuestsGuide is an online service based in the UK. You can contact us by email at support@guestsguide.co.uk.

For host accounts, billing and this website, we are the controller of your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Section 5 explains the different position for information hosts put into their guest guides.

2. Information we collect

Host account holders

• Account details: your email address and password. Your password is stored by our sign-in system in a scrambled (hashed) form that we can't read. If you sign in with Google, we receive your Google email address and the basic profile details Google shares, such as your name.
• Property and guide content: everything you enter in the guide editor — for example the property name, address, check-in instructions, Wi-Fi details, house rules, local recommendations, emergency information, host contact details, checkout checklist and review links — and the photos you upload. When you upload a photo it is resized and camera details, including location data, are removed.
• Billing records: for each property, its subscription status, renewal date, whether the setup fee has been paid, invoice amounts and dates, refunds or disputes, and the reason for any failed payment. Card and bank details are entered directly into our payment provider's secure form; we never see or store your full card number.
• Agreement records: when you start a checkout we record which version of our terms you accepted, the property, the time, and whether you asked for the service to start straight away.
• Messages: anything you send us by email.

Guests who open a guide

Guests don't need an account and we don't ask them for any information. If a guest ticks items on a guide's checkout checklist, the ticks are stored only in their own browser for that visit and are never sent to us or the host.

Everyone who visits the website

Like any website, our hosting and security providers process technical information such as your IP address, browser type and the pages requested, to deliver pages, keep the service secure and count visits. See our Cookie Policy for the cookies and similar technologies involved.

3. How we use it and our lawful bases

• Running your account and hosting your guides — creating your account, signing you in, saving drafts, publishing guides and showing them to people with the link. Lawful basis: contract.
• Billing — taking payments, managing each property's subscription, showing your payment history and dealing with failed payments, refunds and disputes. Lawful basis: contract.
• Accounting and tax records — keeping records of payments. Lawful basis: legal obligation.
• Recording your agreement to our terms — so we can show what was agreed if there's a dispute. Lawful basis: legitimate interests (and legal obligation where consumer law requires us to keep evidence).
• Security and preventing misuse — protecting accounts, detecting fraud and abuse, and fixing errors. Lawful basis: legitimate interests.
• Service emails — such as confirming your email address, resetting your password, and payment receipts or failed-payment notices from our payment provider. Lawful basis: contract.
• Answering your messages. Lawful basis: legitimate interests, or contract if you're a customer.
• Counting website visits — overall traffic figures to understand how the site is used. Lawful basis: legitimate interests.

We don't send marketing emails, we don't sell personal information, and we don't use it for automated decisions about you.

4. Who we share it with

We use these service providers to run GuestsGuide. They process information on our behalf unless stated otherwise:

• Lovable — builds and hosts the website, and provides its database, file storage, sign-in system, account emails (such as email confirmation and password resets) and visitor statistics.
• Supabase — the database, file storage and sign-in infrastructure used by Lovable. Our database is hosted in the European Union (Ireland).
• Cloudflare — delivers the website and protects it against malicious traffic.
• Stripe — processes payments and subscriptions, sends payment receipts and stores card details. Stripe also acts as an independent controller for some purposes, such as fraud prevention and meeting its own legal duties; see Stripe's privacy policy. If you choose to save your details with Stripe's Link service, that is between you and Stripe.
• Google — if you choose Google sign-in, Google confirms your identity to us. Our website fonts are also loaded from Google's servers, which receive your IP address when a page loads.

We may also share information if the law requires it, to protect our rights or users' safety, or with a buyer if the business is ever sold (in which case you'd be told).

5. Information in guest guides

Hosts decide what goes into their guides. A published guide can be opened by anyone who has its link or scans its QR code, without signing in — including its Wi-Fi details, house information, photos and the contact details the host adds. Drafts are private to the host's account.

If you're a host and you include personal information about other people — for example a co-host's or cleaner's phone number, or people in your photos — you're responsible for having the right to share it, and for keeping it accurate. For that content we act on your instructions to store and publish it. We recommend sharing sensitive details such as key-safe codes directly with each guest rather than in the guide.

6. International transfers

Our main database is in the European Union, which the UK recognises as giving adequate protection. Some of our providers (such as Stripe, Google, Cloudflare and Lovable's infrastructure providers) may process information in the United States or other countries. Where they do, they rely on safeguards recognised under UK law, such as UK adequacy regulations (including the UK–US data bridge) or the International Data Transfer Agreement or Addendum. You can ask us for more detail.

7. How long we keep it

• Account, property and guide information is kept while your account exists. Deleting a property removes its details, photos and published guide straight away. Deleting your account removes all your properties, photos and your sign-in account.
• Payment records are kept by Stripe under its own legal obligations, and by us for as long as tax and accounting law requires.
• Records of your agreement to our terms are kept after an account is deleted, as evidence of what was agreed, until they're no longer needed to deal with disputes or legal duties.
• Emails you send us are kept for as long as needed to deal with your enquiry.
• Technical logs are kept by our hosting and security providers for limited periods set by them.

8. Security

The site is served over encrypted connections (HTTPS). Database access rules make sure each host can only see and change their own properties, photos and billing records. Draft guides and photos are kept private; guests receive time-limited links only to photos in a published guide. Card details are handled by Stripe. No system is perfectly secure, so please use a strong, unique password and tell us straight away if you think your account has been misused.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that's wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use it, or object to uses based on legitimate interests;
• ask for information you gave us in a portable, machine-readable format.

You can change your email address or password, or delete your account and everything in it, yourself from Account in your dashboard. For anything else, email support@guestsguide.co.uk. We'll reply within one month, and we may need to confirm your identity first. Some rights have exceptions — for example we may have to keep payment records for tax purposes.

If you're unhappy with how we've handled your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

10. Children

GuestsGuide accounts are for adults (18 or over) who manage holiday lets. We don't knowingly collect children's information.

11. Changes to this policy

We'll update this policy when how we handle personal information changes, and change the effective date at the top. If a change is significant, we'll let account holders know in the dashboard or by email before it takes effect.