Privacy Policy

The controller for your account data is Peter Buchlak, Czech Republic, hello@posadita.com. For the personal data of your guests you are the controller and we are your processor (see section 5).

Account data: email address, name, password (stored as a hash by our authentication provider), language and time zone, plan and billing status.

Property and business data you enter or import: properties, rates, bookings, guests, expenses, tasks, and guest messages you forward to us.

Technical data: server logs with IP address and user agent, kept for security and debugging; the cookies listed in section 7.

Waitlist: if you ask to be told when a feature launches, we keep your email and language for that one email.

We do not run analytics or advertising trackers on posadita.com.

To provide the service you signed up for (contract): syncing calendars, storing bookings, sending transactional emails such as confirmation and password reset, notifications you enable.

To run the product safely (legitimate interest): logs, abuse prevention, backups.

To send the one launch email you asked for (consent — you can withdraw by replying or by contacting us).

Where the law requires it (legal obligation): invoices and tax records.

Guest emails you forward to Posadita and messages you write are processed by an AI model (Anthropic’s Claude API) to sort them, extract booking details and suggest replies. Anthropic processes that content on our behalf and, under its API terms, does not use it to train its models. No AI-suggested reply is sent without you choosing to send it. If you do not want this, do not forward messages to Posadita; the rest of the service works without it.

Names, contact details, stay dates and — if you use online check-in — identity document data of your guests are stored in Posadita because you put them there or synced them. You decide what to collect and why; we process it only to provide the service to you, on your instructions, and delete it when you delete it or your account. A data processing agreement is available on request.

Database, file storage and authentication: Supabase, hosted on AWS in Frankfurt, Germany (EU). Application hosting: Vercel, with serverless functions in Frankfurt; Vercel Inc. is a US company bound by its EU data processing addendum. Transactional email: Resend. AI processing: Anthropic (section 4). Payments, once paid plans launch: the payment provider named on the pricing page; we never see full card numbers. Optional integrations you connect yourself — booking platforms via iCal, PriceLabs — exchange data directly with those providers under their own policies.

We do not sell personal data and do not share it with anyone else except when the law requires it.

Only essential cookies: the authentication session (set by our auth provider), NEXT_LOCALE (your language) and tz (your time zone, so due dates and reminders use your local day). No tracking or advertising cookies, so there is no cookie banner.

Account and business data: for as long as your account exists, then deleted within 30 days of deletion. Logs: up to 30 days. Waitlist emails: until the launch email is sent, then deleted within 12 months unless you have created an account. Invoices: as long as tax law requires.

You can access, correct, export and delete your data — most of it directly in the app, the rest by writing to hello@posadita.com. You can object to processing based on legitimate interest, withdraw consent at any time, and complain to a supervisory authority; in the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ).

We may update this policy as the product changes. We will notify you of material changes by email or in the app. The date at the top tells you when it last changed.