Privacy Policy

1. Data Controller

The data controller for the processing of personal data collected through this platform is the accommodation facility owner/manager who has activated the EasyRentFlow service (hereinafter "Data Controller").

The Data Controller is responsible for determining the purposes and means of processing personal data collected through the guest registration system. For specific information regarding the identity and contact details of the Data Controller, please refer to the information provided at the time of booking or contact the accommodation facility directly.

2. Purpose and Legal Basis for Processing

Your personal data is processed for the following purposes:

• Guest registration (legal obligation): Collection and storage of guest identity data as required by local accommodation laws and regulations (EU Regulation 2016/679).
• Eco-tax calculation (legal obligation): Calculation and reporting of tourist eco-tax as required by applicable local legislation.
• Identity verification (legitimate interest): Verification of guest identity through document photos and liveness video for security purposes and fraud prevention.
• Communication (contract performance): Sending booking confirmations, check-in instructions, and registration-related notifications.
• Error monitoring (legitimate interest): Technical error tracking and performance monitoring through Sentry to ensure platform stability and security.
• SaaS account management (contract performance): Processing of account holder data (company name, email, country) for providing the EasyRentFlow platform service, billing, and support.
• Payment processing (contract performance): Processing of payment data through Stripe for subscription billing.

3. Personal Data Collected

The following categories of personal data are collected:

3.1 Identity Data

• First name and last name
• Date of birth, place of birth
• Nationality and gender
• Residential address (street, city, postal code, country)

3.2 Contact Data

• Email address
• Phone number

3.3 Identity Document Data

• Document type (passport, ID card, driving licence)
• Document number
• Issuing country and expiry date
• Photos of the document (front and back)

3.4 Biometric Data

• Liveness verification video (short video recording used solely for identity verification purposes)

3.5 Technical Data

• IP address
• Browser user agent
• Consent timestamp

4. Data Retention Period

Your personal data will be retained for a maximum period of 5 (five) years from the date of check-out, in compliance with legal obligations for accommodation facilities.

After the retention period expires, your data will be automatically anonymized or deleted. Anonymized data (which cannot be traced back to you) may be retained for statistical purposes.

Document photos, liveness videos, and other uploaded files are deleted together with the associated registration data at the end of the retention period.

5. Your Rights (GDPR Articles 15-22)

Under the General Data Protection Regulation (EU) 2016/679, you have the following rights:

• Right of access (Art. 15): You have the right to obtain confirmation as to whether or not your personal data is being processed and, if so, to access such data.
• Right to rectification (Art. 16): You have the right to request the correction of inaccurate personal data.
• Right to erasure (Art. 17): You have the right to request the deletion of your personal data, subject to applicable legal retention obligations.
• Right to restriction (Art. 18): You have the right to request the restriction of processing of your personal data.
• Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21): You have the right to object to the processing of your personal data.
• Right to withdraw consent (Art. 7): Where processing is based on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise any of these rights, please contact the accommodation facility (Data Controller) directly using the contact details provided at the time of booking.

6. Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• HTTPS/TLS encryption for all data in transit
• Secure token-based access to registration portals (128-bit entropy)
• Time-limited registration links (valid for at least 30 days and until 7 days after check-out)
• Identity document files encrypted at rest (AES-256-GCM)
• Multi-tenant data isolation (separate databases per property)
• File integrity verification via SHA-256 checksums
• Path traversal protection for uploaded files
• Rate limiting on sign-in, sign-up and other exposed endpoints
• Audit log of changes to guest registrations and bookings
• Password hashing with bcrypt for authentication

7. Third-Party Services

The following third-party services may process your data:

• Sentry (Functional Software Inc.): Error monitoring on our server. Processes: technical error reports (error message, page address, time). Nothing is sent to Sentry from your browser, and there are no session recordings. Data may be transferred to servers in the EU/US under appropriate safeguards.
• Gmail SMTP (Google LLC): Email delivery for booking confirmations and registration notifications. Processes: email addresses and message content.
• Stripe Inc.: Payment processing for subscription billing. Processes: payment method details and billing information. Data is handled under Stripe's own PCI DSS compliant infrastructure.
• Google Drive (Google LLC): Off-site backup. A daily copy of the databases, including registration data, is stored there and kept for 30 days.
• Telegram: Only if the host turns on Telegram notifications. Booking notifications sent to the host include the guest's name and stay dates.
• Anthropic (Claude): Only if the host connects Claude to their account. Claude can then read the host's bookings and guest names to answer the host's questions.

All third-party processors are bound by data processing agreements in compliance with GDPR Article 28.

8. International Data Transfers

Your personal data is primarily stored on servers located within the European Union. Where data is transferred to third-party services outside the EU (such as Sentry or Google), such transfers are protected by appropriate safeguards including Standard Contractual Clauses (SCCs) as approved by the European Commission.

9. Automated Decision-Making

This platform does not engage in automated decision-making or profiling as defined in GDPR Article 22. Identity verification decisions are made by the accommodation host.

10. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

You can find your local supervisory authority through the European Data Protection Board (EDPB) website at edpb.europa.eu.

11. Changes to This Privacy Policy

We reserve the right to update this privacy policy at any time. Any changes will be published on this page with an updated revision date. We encourage you to review this policy periodically.

B1. Who processes your data

For your own account data, the data controller is the operator of EasyRentFlow. Contact: stpaulapartment.malta@gmail.com.

For the data of your guests that you enter or collect through the platform, you are the data controller and EasyRentFlow processes it on your behalf (see section 6 of the Terms of Service). Part A above is the notice your guests see.

B2. What we collect about you

• At sign-up: company name, email address, password (stored only as a bcrypt hash), country, and the date you accepted the Terms and this policy.
• If you fill them in: business details (legal name, VAT number, tax code, address, billing email and phone) and your notification settings (email, Telegram chat).
• While you use the service: your properties, bookings, costs and other records you enter, the date of your last sign-in, and support requests you send us.
• Technical data: IP address, browser type and the pages requested, in the server logs; error reports (see Sentry in section 7).

B3. Why, and on what legal basis

• To provide the service (contract): your account, the features you use, support, and emails about your account and trial.
• Subscription payments (contract): through Stripe, if you subscribe.
• Security and reliability (legitimate interest): server logs, protection against automated sign-ups and password guessing, error monitoring and backups.
• Aggregate statistics (legitimate interest): counts of sign-ups, verifications and sign-ins, without your email, name or IP address.

We do not sell your data, use it for advertising, or share it with marketing platforms. The third-party services in section 7 process it only to do their part.

B4. How long we keep it

• Account data: while your account exists.
• If you delete your account: removed 30 days after the request (the grace period lets you change your mind). Backup copies are overwritten within a further 30 days.
• Sign-ups never verified by email: deleted after 48 hours.
• Support requests: when your account is deleted, your name, email and device details are removed from them. The text of the request is kept, so a reported problem stays on record without anything that identifies you.
• Server logs: 14 days. Application error logs: 30 days.

B5. Your rights

You have the rights listed in section 5 (access, rectification, erasure, restriction, portability, objection). You can download your data and delete your account yourself from Settings; for anything else, write to stpaulapartment.malta@gmail.com. We reply within 30 days. You can also lodge a complaint with a supervisory authority (section 10).