Privacy policy
Last updated: 6 October 2026
What we collect
- Your name, email, and phone number (for booking correspondence).
- Booking history and payment receipts (we keep these for 7 years as required by Swedish accounting law).
- Basic technical information — IP address, user-agent — used only for rate-limiting and abuse detection.
What we do NOT collect
- Card numbers, CVV, or expiry — these are entered directly into Stripe Elements and never touch our server.
- Location tracking or analytics fingerprinting.
Security
Passwords are hashed with Argon2id. All traffic is HTTPS-only and protected with HSTS. Door-lock PINs and smart-home tokens are AES-256-GCM encrypted with keys held outside the database. We maintain an append-only audit log of administrative actions.
Sub-processors
We use the following third parties to deliver the service. Each is bound by a Data Processing Agreement (GDPR Art. 28). Optional processors are only engaged when you opt in to the corresponding feature.
| Processor | Purpose | Data shared | Region |
|---|---|---|---|
| Stripe | Payment processing (card, Apple/Google Pay). | Name, email, billing postcode/country, booking total, payment method metadata. | EU/US (Stripe Payments Europe, Ltd., Ireland). |
| Resend | Transactional email (booking confirmations, receipts). | Email address, name, booking reference. | EU/US. |
| Vercel | Web hosting and edge network. | IP address, request headers, access logs. | Global edge network; server functions run in Dublin, Ireland (eu-west-1). |
| Supabase | Primary Postgres database (managed hosting). | All application data (encrypted at rest). | EU (eu-west-1 — Ireland). |
| Googleoptional | OAuth sign-in (optional; only if you pick "Continue with Google"). | Your Google account email, name, profile photo. | Global. |
| Upstashoptional | Redis-backed rate limiting. Only used if enabled; otherwise rate-limit counters live in our own database. | Hashed IP, email, request identifiers (ephemeral). | EU (eu-west-1 — Ireland). |
| Home Assistant (self-hosted or HA Cloud)optional | Smart-home bridge — door lock provisioning, climate and lights. Only invoked for bookings that opt in. | Booking window (start / end), generated PIN code, device identifiers. | EU (self-hosted on-site at the property by default; HA Cloud region: US East if enabled). |
| Criiptooptional | Nordic identity verification (BankID/MitID). Only used where required by local law or on admin request. | Government-issued name, personal identification number (hashed at rest), verification timestamp. | EU (Denmark). |
| Stripe Identityoptional | Fallback identity verification for guests outside the Nordics. | ID document scan, selfie, verification status (documents held by Stripe, not us). | EU/US. |
Your rights under GDPR
- Art. 15 — access. Email the address on the Contact page and we will send you a copy of the personal data we hold about you within 30 days.
- Art. 16 — rectification. Correct your name, phone and email at any time from your profile page.
- Art. 17 — erasure. Delete your account on /account/settings. Past bookings are retained in anonymised form for 7 years to comply with Swedish accounting law; everything else is erased immediately.
- Art. 18 — restriction. You can ask us to pause processing of your data while a dispute is resolved.
- Art. 20 — portability. Machine-readable exports (JSON) available on written request.
- Art. 21 — objection. You can object to any processing based on our legitimate interests. Contact us and we will stop unless we can show an overriding legitimate ground.
Retention periods
- Bookings and receipts — 7 years. Required by Swedish accounting law (bokföringslagen 7 kap). After this point the booking record is fully anonymised.
- Audit logs — 7 years. Required to defend against fraud and abuse claims over the same horizon as the bookings they reference.
- Identity verification proofs — 30 days post-checkout. Scanned documents and selfies are deleted. The verification status (pass/fail, timestamp) is kept 7 years with the booking.
- Session data — 30 days. Expired sessions and rate-limit tickets are pruned daily.
Cookies
We set only strictly-necessary cookies by default — session, payment flow, language, currency. A consent banner asks before any non-essential cookie is set; you can revisit the choice at any time by clearing the traryd_consent_v1 cookie in your browser settings.