Legal · Privacy
Privacy Policy
We collect what we need to verify people and run bookings, keep it in the EU, and delete identity scans as soon as the review is done.
Last updated 5 September 2026
Draft for the Prague pilot — under review by counsel. Processor list and retention periods reflect the current system; the controller details are completed in the imprint.
1. Who is responsible
The data controller is the company named in the Imprint. For anything about your data write to privacy@semesterstay.eu.
2. What we collect and why
- Account
- Name, e-mail, password hash (via our auth provider), avatar. To run your account. Legal basis: contract.
- Student profile
- Citizenship, date of birth, home and host university, acceptance letter. To match listings (some are restricted to EU passport holders) and to verify you as a student. Basis: contract, legitimate interest in trust and safety.
- Host verification
- Identity document scans, driver's license, utility bill, cadastre extract or lease, landlord consent, habitability declaration, tax identification number. To verify hosts before they can publish and to meet tax-reporting duties. Basis: contract, legal obligation (DAC7), legitimate interest.
- Bookings & payments
- Requests, bookings, payment schedule, payment and payout records. Card details never touch our servers — they go straight to Stripe. Basis: contract, legal obligation (accounting).
- Deposit records
- Who marked the deposit as sent/received/returned and when, deduction cases with evidence. The host's bank account (IBAN) is shown only to the student of a confirmed booking. Basis: contract.
- Messages & evidence
- Chat messages and attached photos, dispute messages and evidence, inspection reports. Basis: contract, legitimate interest in resolving disputes.
- Technical
- Server logs, IP address and user agent for security and debugging. Basis: legitimate interest.
3. How long we keep it
- Identity scans (ID card, passport, driver's license) are deleted from storage 7 days after a verification is decided. We keep only the fact that a document of that kind was reviewed and the outcome.
- Property documents (ownership, lease, consent, utility bills) stay on file for the host to access while the property is listed, and for as long as we must keep records of bookings on it.
- Booking, payment and payout records are kept for the period required by Czech accounting and tax law (typically 10 years). If you delete your account we pseudonymise your profile instead of deleting these records.
- Messages, disputes and evidence are kept for 3 years after the stay ends, unless needed longer for an open dispute or legal claim.
4. Who we share it with
We use a small number of processors, all under data-processing agreements:
- Supabase
- Database, authentication and private file storage — hosted in the EU (Frankfurt).
- Stripe
- Card payments, host payout accounts and identity checks for payouts. Stripe is an independent controller for the payment data it processes.
- Vercel
- Hosting and delivery of the application.
- Resend
- Transactional e-mail (booking, deposit and verification notifications).
- Authorities
- Under DAC7 we report hosts' identification and yearly payout totals to the Czech tax administration, which shares them with other EU member states.
We do not sell personal data and do not use it for advertising. Hosts see the profile information of students who request their place; students see the host's name and verification status, and their bank details once a booking is confirmed.
5. Your rights
Under the GDPR you can ask for access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Write to privacy@semesterstay.eu; we answer within one month. You can also complain to the Czech Office for Personal Data Protection (ÚOOÚ) or your local supervisory authority.