Privacy Policy

Stay Now provides software that helps short-term rental hosts register guests and run their stays. For your host account, Stay Now is the data controller. For the guest registration data your guests submit, the host is the controller and Stay Now acts as processor on the host's behalf (see our Data Processing Agreement).

Host account data: name, email, authentication details, organization and billing information.

Guest registration data: the identity and stay details guests provide to satisfy the legal registration duty, including identity-document data, a signature, and the stay dates.

Technical data: request metadata such as IP address and device information, used for security and operating the service.

To provide the service and your account (performance of a contract); to help hosts meet their statutory guest-registration obligation (legal obligation / public interest); to secure the platform and prevent abuse (legitimate interests); and to process payments.

Hosts in many jurisdictions must register guests with the authorities — for example Romania's HG 237/2001 register and the national SIT system. Stay Now collects the data needed for that duty and produces an authority-ready record. The legal responsibility for the registration remains with the host.

Personal data is kept only as long as needed for its purpose or as required by law. Registration records are retained for the applicable statutory period and then purged automatically. Account data follows the deletion schedule described in our retention policy; you can review your schedule and request deletion via the data-rights portal.

We use a small number of vetted sub-processors to operate the service. The current list, the data each handles, and the safeguards for any international transfer are published on our Sub-processors page.

Subject to applicable law, you may request access, rectification, erasure, restriction, portability, and object to certain processing. Guests can view their stay history and automatic deletion schedule through the public data-rights portal. Formal requests are handled by our data protection contact.

Guest personal data is encrypted in a dedicated vault, isolated per organization, and access is least-privilege and audited. We enforce retention and deletion in the system rather than relying on manual processes.

The marketing site and apartment landing pages use only strictly necessary cookies. The dashboard uses a session cookie and a CSRF token. We do not load analytics without consent.

For privacy questions or to exercise your rights, contact dpo@stay-now.eu.