Privacy Policy

FYStay ("we", "us") operates fystay.vercel.app, a booking platform for independent accommodation on the Fylde Coast. This policy explains what personal data we collect, why, and the rights you have over it under UK GDPR and the Data Protection Act 2018. For questions or to exercise any of the rights below, contact privacy@fystay.co.uk.

We only collect what we need to run bookings and accounts:

• Account details: name, email address, and a securely hashed password (we never store your password in plain text).
• Booking details: check-in/check-out dates, guest numbers, and the listings you book, save, or review.
• Host listing details (for hosts): property description, address, photos, pricing, and availability.
• Payment information: handled entirely by Stripe. We receive confirmation that a payment succeeded and its amount, never your full card number.

We do not collect any special category data, and we don't run behavioural advertising or ad-tracking cookies - see our Cookie Policy for what we do use.

• To provide the service (create your account, process a booking, show your trips, send booking emails) - necessary to perform our contract with you.
• To keep the Platform secure (preventing fraud, abuse, or unauthorised access) - our legitimate interest.
• To meet legal obligations (e.g. keeping payment records) - legal obligation.

We share personal data only where it's needed to run the Platform:

• Stripe - to process payments and refunds.
• Supabase - our database and listing-photo storage provider.
• Resend - to send account and booking emails (e.g. password reset).
• The other party to a booking - a host and guest can see each other's name and the booking details needed to complete the stay.

Some of these providers may process data outside the UK. Where that happens, it's covered by adequacy regulations or standard contractual clauses recognised under UK GDPR, and each provider's own data processing terms.

We never sell your personal data.

We keep account and booking data for as long as your account is active, and afterwards only as long as needed for legal, accounting, or dispute-resolution purposes (typically up to 6 years for financial records). You can ask us to delete your account at any time, subject to those retention requirements.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data ("right to be forgotten"), subject to any legal retention obligations.
• Ask us to restrict or object to certain processing.
• Receive your data in a portable format.
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you think we've mishandled your data.

To exercise any of these, email privacy@fystay.co.uk. We'll respond within one month.

If we change how we handle your data, we'll update this page and the "Last updated" date above.