Guest Data and Privacy in Direct Booking
The host is the data controller for guest data; HemmaBo processes it.
Who owns the guest data?
HemmaBo is a booking website provider. You as the host own and control all guest data.
- You as host are the data controller: You decide how guest personal data (name, email, phone, booking details) is collected, stored and used. HemmaBo does not make decisions about guest data on your behalf.
- HemmaBo is the data processor: HemmaBo stores and processes guest data on your behalf. We have no independent right to use guest information — we are the system provider, not the owner.
- Guest data is never shared with third parties without your consent: All guest data stays under your control. No third-party sharing without your explicit consent.
- Read our full policy: The details are in our privacy policy, which describes the exact roles of HemmaBo and the host.
How is guest data stored in HemmaBo?
Guest data lives in a secure database, and payment data is handled entirely by Stripe.
- Booking data is stored in Supabase: Bookings, guest details and calendar data are stored in Supabase — a secure database system with encryption and access controls.
- Payment data is handled by Stripe: HemmaBo never sees card details. Stripe handles all payment data — card numbers, transactions and any ID verification. Funds flow directly from guest to your Stripe account.
- Export and deletion: You can request export or deletion of your data via the contact form. Guests who wish to exercise their rights contact you as the host first.
- Retention period: The name, e-mail, phone and messages of a guest are removed 180 days after check-out; the amount and the dates stay without a name for 7 years for the bookkeeping. Technical logs are kept for 90 days. Host accounts are deleted 30 days after cancellation.
Your GDPR obligations as a host
You carry the legal responsibility for informing guests and complying with data protection rules.
- Inform your guests: You are responsible for informing your guests about how their data is handled — what data you collect, why, and how long it is stored.
- HemmaBo delivers the booking system, not legal advice: HemmaBo gives you the tools (booking system, payments, calendar) but the legal responsibility for GDPR compliance toward your guests lies with you as the host.
- Complaints and supervisory authority: If a guest has concerns about data handling, they can contact you as the host or the relevant data protection authority in their country.
What is a VRP vacation rental?
A VRP vacation rental is a holiday home whose host runs its own booking site on its own domain and publishes stay offers signed by that domain under the Vacation Rental Protocol (VRP). Any guest or AI agent can check, over plain HTTPS, that the price, the dates and the conditions come from the host — with no listing site, catalog or connector in between.
HemmaBo is software that makes a host's home a VRP vacation rental: the booking site on the host's own domain, the signed stay offers, and payment straight to the host.