Privacy Policy

1. Who we are

OstaPal ("we", "our", or "us") is a software platform that helps short-term rental hosts manage direct bookings, pricing, and guest communications. Our website is ostapal.com.

If you have questions about this policy, contact us at hello@ostapal.com.

2. Information we collect

Information you provide

• Account data — email address and password when you sign up as a host.
• Property data — property name, address, photos, description, amenities, and pricing that you enter into the platform.
• Booking data — guest names, emails, check-in/check-out dates, and payment amounts for direct bookings made through your property page.
• Payment data — billing details collected and processed by Stripe. We never store your full card number or bank account details on our servers.

Information collected automatically

• Usage data — pages visited, features used, and time spent in the app, used to improve the product.
• Device and browser data — IP address, browser type, and operating system for security and analytics.
• Cookies — session cookies to keep you logged in and remember your selected property. We do not use advertising cookies.

3. How we use your information

• Provide, maintain, and improve the OstaPal platform.
• Send transactional emails — booking confirmations, guest communications, and password resets.
• Process subscription payments via Stripe.
• Respond to support requests.
• Detect and prevent fraud or abuse.
• Comply with legal obligations.

We do not sell your personal information to third parties. We do not use your data for advertising.

4. How we share your information

We share data only with the third-party services necessary to operate the platform:

• Supabase — database and authentication hosting (servers in the US).
• Stripe — payment processing. Stripe's privacy policy applies to payment data.
• Resend — transactional email delivery.
• Vercel — web hosting and CDN.

We may also disclose information if required by law, court order, or to protect the rights and safety of OstaPal or its users.

5. Guest data and host responsibility

When a guest books through your property's direct booking page, their personal information (name, email, dates) is stored in your OstaPal account. As the host, you are the data controller for your guests' information. You are responsible for using guest data only for the purposes of managing their booking, and for complying with applicable privacy laws in your jurisdiction.

6. Data retention

We retain your account and property data for as long as your account is active. Booking records are retained for 7 years for tax and legal compliance purposes. You may request deletion of your account and associated data at any time by emailing hello@ostapal.com.

7. Security

We use industry-standard security measures including encryption in transit (TLS), row-level security on our database, and secure authentication via Supabase Auth. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Data portability (receive your data in a machine-readable format).

To exercise any of these rights, email hello@ostapal.com. We will respond within 30 days.

9. Children's privacy

OstaPal is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the app. Continued use of OstaPal after changes become effective constitutes acceptance of the updated policy.