Privacy Policy
What we collect, why we collect it, and what we deliberately don’t. Guests who open a portal are covered by section 5 — it’s short, because there is very little to say.
Last updated
1.Who we are
Guestate is operated by Guestate, of Budapest, Hungary. We are the data controller for the personal data described in this policy, except where section 10 says otherwise.
For anything in this policy — including a request to see, correct or delete your data — write to guestate@gmail.com.
2.Who this policy covers
The service has two sides, and they are treated very differently.
- Hosts sign in and create properties, QR codes and guest portals. We hold an account for you. Sections 3, 4 and 6 to 14 apply.
- Guests open a portal by scanning a printed code or following a link. You are not asked to sign in, you do not get an account, and we do not try to identify you. Section 5 covers everything we record.
3.What we collect from hosts
Account data, from Google
Signing in is handled by Google. We never see or store your Google password. Google passes us your name, email address, whether that address is verified, and the URL of your profile picture, and we store those. We also store a display name if you set one.
Alongside that we store the access and refresh tokens Google issues for your session, so you stay signed in between visits. They are held in our database and are erased when you delete your account or disconnect the app from your Google account.
Content you create
Property names and addresses, the time zone you pick, portal welcome text and colours, and the contents of each QR code — Wi-Fi network names and passwords, house manuals, local recommendations and emergency contact numbers.
Guest portals are public to anyone who has the link. A portal URL is unlisted, but it is not secret and not password-protected — anyone holding the link, or a photograph of your printed code, can read everything on it. Please treat it as public. See section 10 for what that means for anything you put there about other people.
Billing data
If you subscribe to a paid plan, our payment processor Stripe collects and holds your card details. We never receive or store your full card number. We keep the subscription record, the last four digits and card brand, your billing country, and the invoices themselves.
If you ask about paid plans
There are times when a paid plan cannot be bought — before it opens in the first place, or while we have upgrades switched off for maintenance. When that is the case we offer to tell you once it changes. If you press that button, we record that you asked, which plan you were looking at, and which limit you had reached — that last one so we know which limits actually matter to people. Nothing is recorded unless you press it.
We do not ask for an email address, and we do not store a second copy of one. The address from your Google sign-in is the one we would write to, and we would use it once, for that one message. Ask us and we will forget you asked; deleting your account does the same thing on its own.
Correspondence
If you email us, we keep the message and our reply so we can follow up and so we have a record of what was agreed.
4.Technical data while you use the dashboard
Our hosting provider processes the ordinary technical data any web server sees — your IP address, your browser’s user agent and the time of the request — in order to serve pages, block abuse and keep the service up. We do not build a profile from it.
We also count page views on the dashboard, using Vercel Web Analytics. It sets no cookie and stores nothing on your device: it counts a visit by turning your IP address and user agent into a hash that changes every day, which is why the figures are visit counts and not a record of anyone. We see which screens are used and how often. It is never sent your email address, your account, your property names, or anything you typed, and we cannot use it to look up what any one host did. There is no advertising tool anywhere in the product.
We also measure how fast pages render, using Vercel Speed Insights. It runs across the whole product — the dashboard, the marketing site, and guest portals — and reports load timings with a rough device type, browser and country. It sets no cookie, creates no identifier, and cannot follow anyone from one page to the next.
We use IP addresses in memory to rate-limit requests, so that one client cannot flood the service. Those counters are not written to our database and do not survive a restart.
5.What we collect from guests
When you open a guest portal, we record one row per action. That row contains the property, which tool you opened, the type of action, a random identifier from a cookie, and the time. That is the whole record — there are no other columns.
One other thing is measured, and it is not in that row: how fast the page loaded. Vercel Speed Insights times the rendering on your device and reports it with your rough device type, browser and country, so we can tell a portal that opens instantly from one that takes eight seconds on a hotel wifi. It creates no identifier, sets no cookie, and is not told which portal you opened — the property’s identifier is removed in your browser first. Nothing in it can be traced back to a person or joined to the row above.
The identifier is a random string generated by us and stored in a cookie on your device. It is not derived from your IP address, your device or anything about you, it is not linked to your name or any account, and it means nothing outside our own counting. It lets a host see roughly how many separate browsers opened their portal rather than one number of taps.
What we deliberately do not collect
The following are never stored against a guest, and most are never read at all:
- Your IP address. It is read to rate-limit requests, in memory, and never written down. The speed measurement turns it into a country and keeps only that.
- Your browser’s user agent, as a record of you. We read it to tell bots and browser prefetches apart from real visits, and never write it down. The speed measurement keeps a coarse version of it — “Chrome on Android, mobile” — because a page can be fast on a laptop and slow on a phone, and we cannot fix what we cannot see. It is attached to no identifier, so it names nobody.
- Your precise location, or your time zone. A property’s time zone is a setting its host chooses; it is not read from your device. The speed measurement keeps your country, and nothing finer.
- The page you came from, your name, your email address, or any device fingerprint.
- Anything at all in your browser’s local storage — we do not use it.
We also do not track scans. A printed QR code cannot report that it was scanned, so what a host actually sees is the number of times the page behind the code was opened. We say so on the dashboard too.
Hosts only ever see counts and charts. There is no way for a host to see an individual guest, an individual visit, or the identifier described above — the CSV export is aggregated by day for the same reason.
7.Our legal bases
Under the GDPR we must have a lawful basis for each purpose. Ours are:
| What we do | Legal basis |
|---|---|
| Run your account, store your properties and QR codes, and serve your guest portals | Performance of a contract — Art. 6(1)(b) |
| Take payment and keep subscription records | Performance of a contract — Art. 6(1)(b) |
| Keep invoices and tax records for the statutory period | Legal obligation — Art. 6(1)(c) |
| Count portal opens so hosts can see whether their portal is used | Legitimate interests — Art. 6(1)(f): measuring aggregate use of a service, with an identifier that is not linked to anyone and cannot be used to single a person out. Storing the cookie itself is a separate question, answered by the audience measurement exemption to Art. 5(3) of the ePrivacy Directive — see section 6. |
| Count page views on our marketing site and the dashboard so we can see which pages and features are used | Legitimate interests — Art. 6(1)(f): understanding how our own product is used, from visit counts that identify nobody. The measurement is cookieless and stores nothing on your device, so unlike the portal cookie above it does not engage Art. 5(3) of the ePrivacy Directive at all, and there is nothing to ask permission for. It never runs on a guest portal. |
| Measure how quickly pages render, everywhere including guest portals, so we can find and fix slow ones | Legitimate interests — Art. 6(1)(f): keeping a service usable for the people using it, which on a guest portal is someone who needs the Wi-Fi password on a bad connection. Timings carry no identifier, cannot be linked across pages, and are not told which portal was opened; the interest is hard to serve any other way, since a page can be fast for us and slow for them. Cookieless, so Art. 5(3) is not engaged. |
| Remember that you asked not to be counted | Legitimate interests — Art. 6(1)(f): honouring a request you made to us. The cookie that carries it is strictly necessary under Art. 5(3), so it is set without asking — asking permission to record a refusal would be absurd. |
| Rate-limit requests, filter bots, and protect the service from abuse | Legitimate interests — Art. 6(1)(f): keeping the service secure and available |
| Email you once, when paid plans become available again, if you press the button asking us to | Consent — Art. 6(1)(a). A different purpose from running your account, so it does not ride on the contract above: telling you about something new to buy is marketing, and Art. 13 of the ePrivacy Directive wants you to have asked first. Pressing the button is the asking. One message, no list, and you can withdraw it by telling us or by deleting your account — the record goes with it. |
| Reply to your emails | Legitimate interests — Art. 6(1)(f): responding to the person who contacted us |
You can object to any processing based on legitimate interests — see section 11.
9.International transfers
Some of the providers above are based in, or have infrastructure in, the United States. Where personal data is transferred outside the European Economic Area, that transfer is covered by the European Commission’s Standard Contractual Clauses, or by the provider’s certification under the EU–US Data Privacy Framework. You can ask us for details of the safeguards in place for any particular transfer.
10.How long we keep things
- Your account — until you delete it. See section 11.
- Properties, QR codes and portal content — until you delete them, or until you delete your account.
- Guest portal events — for as long as the property they belong to exists. Deleting a property or your account erases its history immediately and permanently.
- Invoices and tax records — for the period required by the tax law of Hungary, which is longer than your account may live and applies even after you delete it.
- Emails — up to three years after the conversation ends.
- A request to hear about paid plans — until we have sent that message, or until you or your account goes, whichever comes first.
11.Your rights
Under the GDPR you can ask us to give you a copy of your data, to correct it, to erase it, to restrict what we do with it, or to send it to another provider in a machine-readable form. You can object to processing we base on legitimate interests. Where we rely on your consent, you can withdraw it at any time without affecting what came before.
You can erase your own account at any time. Dashboard → Settings → Delete account. This permanently removes your account, every property, every QR code, all of their content, your stored Google tokens and every portal event those properties produced. It cannot be undone, and your printed codes will stop working.
If you are on a paid plan, deleting your account also cancels your subscription immediately, so nothing is charged again. The rest of the month is not refunded. Your invoices stay with Stripe for as long as tax law requires — see section 10 — because we are obliged to keep them; they are the one thing deletion does not reach.
For anything else, email guestate@gmail.com. We will respond within one month.
If you think we have handled your data badly, please tell us first — but you have every right to complain directly to a supervisory authority. Ours is the Hungarian National Authority for Data Protection and Freedom of Information, or Nemzeti Adatvédelmi és Információszabadság Hatóság (https://naih.hu). You may also complain to the authority where you live or work.
A note for guests. We hold nothing that identifies you, so we usually cannot find “your” records in order to act on a request — the identifier in the cookie is the only handle that exists, and it means nothing to us on its own. Clearing this site’s cookies removes it from your device. If you send us the identifier itself, we can delete the rows carrying it.
12.If you are a host: your own obligations
You decide what goes into your portal, so for that content you are the controller and we are your processor. In practice that means:
- Do not put other people’s personal data in a portal unless you are entitled to publish it. A cleaner’s mobile number is personal data; so is a neighbour’s.
- Remember that the portal is readable by anyone with the link. The emergency contacts tool publishes whatever numbers you enter, including your own.
- If you add affiliate links, disclose them to guests where your local consumer law requires it.
We do not use your guests’ portal activity for our own purposes. We process it to produce your dashboard, and to keep the service running and secure. The one thing we do keep for ourselves is how fast your portal rendered on a guest’s device — timings only, with no identifier and without being told which portal it was, so it tells us our pages are slow without telling us anything about your guests or your property. Section 5 describes it in full.
13.Security
Everything is served over HTTPS. Session cookies are HttpOnly and, in production, Secure. Our database is not reachable from the public internet. Requests are rate-limited, and the one place where the service fetches a URL you supply is restricted so that it cannot be pointed at internal addresses.
Wi-Fi passwords and other portal content are stored so we can display them to your guests, which means they are stored in a readable form. Combined with the fact that a portal link is public, this is a deliberate design trade-off you should factor in: put in a guest network password, not your bank details.
No service can promise perfect security. If a breach ever affects your personal data and is likely to be a risk to you, we will tell you and the supervisory authority as the GDPR requires.
14.Children
The service is for property hosts and is not directed at children. We do not knowingly create accounts for anyone under 18. Guest portals record nothing that identifies whoever opens them, of any age.
15.Changes to this policy
We will update this page when what we do changes, and the date at the top will change with it. If a change materially affects how we handle your personal data, we will tell hosts by email or in the dashboard before it takes effect. Continuing to use the service after that means you accept the updated policy.