Privacy

Privacy Policy

What we collect, why we collect it, and what we deliberately don’t. Guests who open a portal are covered by section 5 — it’s short, because there is very little to say.

Last updated

1.Who we are

Guestate is operated by Guestate, of Budapest, Hungary. We are the data controller for the personal data described in this policy, except where section 10 says otherwise.

For anything in this policy — including a request to see, correct or delete your data — write to guestate@gmail.com.

2.Who this policy covers

The service has two sides, and they are treated very differently.

  • Hosts sign in and create properties, QR codes and guest portals. We hold an account for you. Sections 3, 4 and 6 to 14 apply.
  • Guests open a portal by scanning a printed code or following a link. You are not asked to sign in, you do not get an account, and we do not try to identify you. Section 5 covers everything we record.

3.What we collect from hosts

Account data, from Google

Signing in is handled by Google. We never see or store your Google password. Google passes us your name, email address, whether that address is verified, and the URL of your profile picture, and we store those. We also store a display name if you set one.

Alongside that we store the access and refresh tokens Google issues for your session, so you stay signed in between visits. They are held in our database and are erased when you delete your account or disconnect the app from your Google account.

Content you create

Property names and addresses, the time zone you pick, portal welcome text and colours, and the contents of each QR code — Wi-Fi network names and passwords, house manuals, local recommendations and emergency contact numbers.

Guest portals are public to anyone who has the link. A portal URL is unlisted, but it is not secret and not password-protected — anyone holding the link, or a photograph of your printed code, can read everything on it. Please treat it as public. See section 10 for what that means for anything you put there about other people.

Billing data

If you subscribe to a paid plan, our payment processor Stripe collects and holds your card details. We never receive or store your full card number. We keep the subscription record, the last four digits and card brand, your billing country, and the invoices themselves.

If you ask about paid plans

There are times when a paid plan cannot be bought — before it opens in the first place, or while we have upgrades switched off for maintenance. When that is the case we offer to tell you once it changes. If you press that button, we record that you asked, which plan you were looking at, and which limit you had reached — that last one so we know which limits actually matter to people. Nothing is recorded unless you press it.

We do not ask for an email address, and we do not store a second copy of one. The address from your Google sign-in is the one we would write to, and we would use it once, for that one message. Ask us and we will forget you asked; deleting your account does the same thing on its own.

Correspondence

If you email us, we keep the message and our reply so we can follow up and so we have a record of what was agreed.

4.Technical data while you use the dashboard

Our hosting provider processes the ordinary technical data any web server sees — your IP address, your browser’s user agent and the time of the request — in order to serve pages, block abuse and keep the service up. We do not build a profile from it.

We also count page views on the dashboard, using Vercel Web Analytics. It sets no cookie and stores nothing on your device: it counts a visit by turning your IP address and user agent into a hash that changes every day, which is why the figures are visit counts and not a record of anyone. We see which screens are used and how often. It is never sent your email address, your account, your property names, or anything you typed, and we cannot use it to look up what any one host did. There is no advertising tool anywhere in the product.

We also measure how fast pages render, using Vercel Speed Insights. It runs across the whole product — the dashboard, the marketing site, and guest portals — and reports load timings with a rough device type, browser and country. It sets no cookie, creates no identifier, and cannot follow anyone from one page to the next.

We use IP addresses in memory to rate-limit requests, so that one client cannot flood the service. Those counters are not written to our database and do not survive a restart.

5.What we collect from guests

When you open a guest portal, we record one row per action. That row contains the property, which tool you opened, the type of action, a random identifier from a cookie, and the time. That is the whole record — there are no other columns.

One other thing is measured, and it is not in that row: how fast the page loaded. Vercel Speed Insights times the rendering on your device and reports it with your rough device type, browser and country, so we can tell a portal that opens instantly from one that takes eight seconds on a hotel wifi. It creates no identifier, sets no cookie, and is not told which portal you opened — the property’s identifier is removed in your browser first. Nothing in it can be traced back to a person or joined to the row above.

The identifier is a random string generated by us and stored in a cookie on your device. It is not derived from your IP address, your device or anything about you, it is not linked to your name or any account, and it means nothing outside our own counting. It lets a host see roughly how many separate browsers opened their portal rather than one number of taps.

What we deliberately do not collect

The following are never stored against a guest, and most are never read at all:

  • Your IP address. It is read to rate-limit requests, in memory, and never written down. The speed measurement turns it into a country and keeps only that.
  • Your browser’s user agent, as a record of you. We read it to tell bots and browser prefetches apart from real visits, and never write it down. The speed measurement keeps a coarse version of it — “Chrome on Android, mobile” — because a page can be fast on a laptop and slow on a phone, and we cannot fix what we cannot see. It is attached to no identifier, so it names nobody.
  • Your precise location, or your time zone. A property’s time zone is a setting its host chooses; it is not read from your device. The speed measurement keeps your country, and nothing finer.
  • The page you came from, your name, your email address, or any device fingerprint.
  • Anything at all in your browser’s local storage — we do not use it.

We also do not track scans. A printed QR code cannot report that it was scanned, so what a host actually sees is the number of times the page behind the code was opened. We say so on the dashboard too.

Hosts only ever see counts and charts. There is no way for a host to see an individual guest, an individual visit, or the identifier described above — the CSV export is aggregated by day for the same reason.

6.Cookies

We set a small number of first-party cookies. None of them are used for advertising, and none are shared with anyone. We set no third-party cookies ourselves — the one exception is the “things to do nearby” card on a guest portal, which loads content from GetYourGuide only if you tap it, and which sets cookies of its own once you do. Nothing reaches them before that tap.

CookiePurposeLifetime
gs_vCounts unique browsers on guest portals. Holds a random identifier and nothing else. Set only on guest portal pages, never in the dashboard.180 days
gs_optoutRecords that you asked not to be counted, so we remember next time. Set only if you use the switch below. Holds no identifier — just the fact that you said no.400 days
authjs.session-tokenKeeps a host signed in. Strictly necessary.Session
authjs.csrf-tokenProtects the sign-in form against cross-site request forgery. Strictly necessary.Session
authjs.callback-urlReturns you to the right page after sign-in. Strictly necessary.Session
Stripe cookiesSet by Stripe on the checkout and billing pages to process payments and prevent fraud. Only on paid-plan flows.Set by Stripe
GetYourGuide cookiesSet by GetYourGuide, for their own affiliate attribution, if you tap the “things to do nearby” card on a guest portal. Never set before that tap, and we can neither read them nor see what you do inside the card.Set by GetYourGuide

All of our own cookies are HttpOnly — JavaScript on the page cannot read them — and are sent only to us.

Why we don’t ask you to accept gs_v

Most analytics cookies need your consent before they are set. This one does not, under the audience measurement exemption that regulators — France’s CNIL among them — read into Article 5(3) of the ePrivacy Directive. The exemption is narrow and we hold ourselves to it: the cookie is used for counting and nothing else, the counting is done by us for us, hosts see only totals, and the data is never combined with anything else or handed to anyone.

A banner would ask you to approve something we have already made almost nothing. What the exemption does require is a way to say no that isn’t “change your browser settings”. So here it is.

Checking…

The switch remembers your answer in a second cookie, gs_optout, which is why it isn’t itself something you can switch off here. It applies to this browser only — another phone, or a private window, starts over. Events we already recorded stay in the host’s totals; there is nothing in them that points back at you, and the identifier they carried is gone from your browser for good.

You can also just block or clear cookies for this site in your browser. The portal works normally without any of them; the only effect is that the host’s count of unique browsers is slightly less accurate. Blocking the sign-in cookies will stop hosts being able to sign in.

8.Who we share data with

We do not sell personal data and we do not share it for advertising. We use a small number of providers to run the service, each of which processes data on our instructions:

ProviderWhat they doWhere
Google Ireland / Google LLCSign-in. Handles your password and tells us who you are.EU / United States
SupabaseHosts our database — everything in sections 3 and 5 lives here.EU
VercelHosts and serves the application. Counts page views on the marketing site and the dashboard, never on guest portals. Measures page load speed everywhere, including guest portals, without being told which portal.EU / United States
StripeProcesses payments and stores card details for paid plans.EU / United States
GetYourGuideShows tours and activities near a property, in the “things to do nearby” card on a guest portal. Loads only if a guest taps it.EU

GetYourGuide is the one entry above that is not acting on our instructions. Everything inside that card is theirs: we hand over the property’s town and nothing else, and whatever you do once it has loaded is between you and them, under their own privacy policy. That is also why it does not load until you ask it to.

We may also disclose data where we are legally required to, or to establish or defend a legal claim. If the service is ever sold or transferred, account data would transfer with it, and we would tell you first.

No-one counts you on a guest portal. No analytics, no advertising pixels, no session recording, no fingerprinting, and nothing that follows you from one page to the next. Two things do load. The “things to do nearby” card described above, which stays inert until a guest taps it. And Vercel Speed Insights, which measures how quickly the page rendered on your device — how long the text took to appear, whether the layout jumped — so we can find the portals that are slow to open.

That measurement builds no identifier of any kind, sets no cookie, and cannot link one page view to the next, so there is nothing that could be assembled into a picture of you. It is not even sent the address of the portal you opened: the property’s identifier is stripped in your browser before anything is sent, so what leaves is the shape of the page — “a portal”, “a tool page” — and never which one. What it does send is listed in section 5. We keep this line tight because a guest did not choose us, and is often standing in someone else’s home.

On our marketing site and the host dashboard — never on a guest portal — we also count page views, with Vercel Web Analytics. Both it and the speed measurement above are cookieless and store nothing on your device, so neither needs a banner and there is nothing to opt out of; see section 4 for what they do and do not receive. We run no advertising trackers anywhere — no Google Analytics, no advertising pixels, no session recording. The fonts are served from our own domain rather than from Google Fonts, so opening a page does not tell anyone else you did.

9.International transfers

Some of the providers above are based in, or have infrastructure in, the United States. Where personal data is transferred outside the European Economic Area, that transfer is covered by the European Commission’s Standard Contractual Clauses, or by the provider’s certification under the EU–US Data Privacy Framework. You can ask us for details of the safeguards in place for any particular transfer.

10.How long we keep things

  • Your account — until you delete it. See section 11.
  • Properties, QR codes and portal content — until you delete them, or until you delete your account.
  • Guest portal events — for as long as the property they belong to exists. Deleting a property or your account erases its history immediately and permanently.
  • Invoices and tax records — for the period required by the tax law of Hungary, which is longer than your account may live and applies even after you delete it.
  • Emails — up to three years after the conversation ends.
  • A request to hear about paid plans — until we have sent that message, or until you or your account goes, whichever comes first.

11.Your rights

Under the GDPR you can ask us to give you a copy of your data, to correct it, to erase it, to restrict what we do with it, or to send it to another provider in a machine-readable form. You can object to processing we base on legitimate interests. Where we rely on your consent, you can withdraw it at any time without affecting what came before.

You can erase your own account at any time. Dashboard → Settings → Delete account. This permanently removes your account, every property, every QR code, all of their content, your stored Google tokens and every portal event those properties produced. It cannot be undone, and your printed codes will stop working.

If you are on a paid plan, deleting your account also cancels your subscription immediately, so nothing is charged again. The rest of the month is not refunded. Your invoices stay with Stripe for as long as tax law requires — see section 10 — because we are obliged to keep them; they are the one thing deletion does not reach.

For anything else, email guestate@gmail.com. We will respond within one month.

If you think we have handled your data badly, please tell us first — but you have every right to complain directly to a supervisory authority. Ours is the Hungarian National Authority for Data Protection and Freedom of Information, or Nemzeti Adatvédelmi és Információszabadság Hatóság (https://naih.hu). You may also complain to the authority where you live or work.

A note for guests. We hold nothing that identifies you, so we usually cannot find “your” records in order to act on a request — the identifier in the cookie is the only handle that exists, and it means nothing to us on its own. Clearing this site’s cookies removes it from your device. If you send us the identifier itself, we can delete the rows carrying it.

12.If you are a host: your own obligations

You decide what goes into your portal, so for that content you are the controller and we are your processor. In practice that means:

  • Do not put other people’s personal data in a portal unless you are entitled to publish it. A cleaner’s mobile number is personal data; so is a neighbour’s.
  • Remember that the portal is readable by anyone with the link. The emergency contacts tool publishes whatever numbers you enter, including your own.
  • If you add affiliate links, disclose them to guests where your local consumer law requires it.

We do not use your guests’ portal activity for our own purposes. We process it to produce your dashboard, and to keep the service running and secure. The one thing we do keep for ourselves is how fast your portal rendered on a guest’s device — timings only, with no identifier and without being told which portal it was, so it tells us our pages are slow without telling us anything about your guests or your property. Section 5 describes it in full.

13.Security

Everything is served over HTTPS. Session cookies are HttpOnly and, in production, Secure. Our database is not reachable from the public internet. Requests are rate-limited, and the one place where the service fetches a URL you supply is restricted so that it cannot be pointed at internal addresses.

Wi-Fi passwords and other portal content are stored so we can display them to your guests, which means they are stored in a readable form. Combined with the fact that a portal link is public, this is a deliberate design trade-off you should factor in: put in a guest network password, not your bank details.

No service can promise perfect security. If a breach ever affects your personal data and is likely to be a risk to you, we will tell you and the supervisory authority as the GDPR requires.

14.Children

The service is for property hosts and is not directed at children. We do not knowingly create accounts for anyone under 18. Guest portals record nothing that identifies whoever opens them, of any age.

15.Changes to this policy

We will update this page when what we do changes, and the date at the top will change with it. If a change materially affects how we handle your personal data, we will tell hosts by email or in the dashboard before it takes effect. Continuing to use the service after that means you accept the updated policy.