How we handle your data.
What we collect when you visit this site or write to us, why, who else handles it, and what you can ask of us. In plain words.
Last updated:
Who we are
StayParity runs this site and decides what happens to the personal data it collects. Under the GDPR, that makes us the controller. For anything about your data, write to hello@stayparity.com.
When you visit
Cloudflare serves this site. To deliver a page and protect it from attacks, it handles your IP address, what your browser tells it and the address of the page you asked for. We keep short-lived request logs to find faults, and use them only for that.
The fonts come from our own servers, not a third party's, and the site sets no cookies. The one thing it keeps in your browser is the light or dark theme, and only if you choose one in the footer.
When you ask for a check or write to us
The form sends us:
- What you type: your name, work email and hotel and, if you give them, your website, how many hotels you run and your message.
- About the request: the page's language, the page you sent it from, the site address it was sent from, and your browser's user agent.
- Where you came from: if you arrived through a link with campaign tags (utm_ or ref) or from another website, those tags and that website's address, never the page you were reading there. The site holds this in the page's memory while you browse, and keeps nothing on your device.
- Your IP address, hashed: we store a keyed hash of it, never the address itself, and use it only to limit how often one sender can use the form.
Before the form sends, Cloudflare Turnstile checks that you are a person. Its script loads only once you start on the form, reads technical signals from your browser, and receives your IP address from us with the check.
Your request reaches us by email, and you get one back to say we have it.
If you tick the box for occasional product news, we record that you did and when. The box starts unticked, and we answer your request the same way whether you tick it or not.
Why, and on what basis
- Answering your request and following up: steps you asked us to take before a possible contract (GDPR Art. 6(1)(b)), and our legitimate interest in replying to business enquiries (Art. 6(1)(f)).
- Keeping the site and the form safe: the request logs, the bot check and the sending limits rest on our legitimate interest in running a secure service (Art. 6(1)(f)).
- Product news: your consent (Art. 6(1)(a)). Withdraw it any time by writing to hello@stayparity.com. That doesn't affect what we sent before.
We don't sell your data, use it for advertising or make automated decisions about you.
Who else handles it
These services process data for us, only on our instructions:
- Cloudflare: serves the site and runs the bot check.
- Convex: our database and backend, where your request is stored.
- Resend: sends the emails about your request.
Some of these providers are based in the United States or use servers outside the European Economic Area. Where data leaves the EEA, it is protected by safeguards the GDPR recognises, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
How long we keep it
We delete a request 24 months after it arrives, or sooner if you ask. Request logs are deleted automatically within days.
If your hotel uses StayParity
When your hotel uses StayParity at app.stayparity.com, we also process account data (names, email addresses, sign-in details), hotel data (properties, rooms and settings) and the rates we collect for you, to provide the service. Your customer agreement sets out the details.
Your rights
Under the GDPR you can ask us for:
- Access: a copy of the data we hold about you.
- Correction: to fix anything wrong or incomplete.
- Erasure: to delete it.
- Restriction or objection: to pause using it, or to stop a use that rests on our legitimate interest.
- Portability: what you gave us, in a format a computer can read.
- Withdrawing consent: to stop product news, at any time.
Write to hello@stayparity.com. We reply within a month, and may ask you to confirm it's you.
You can also complain to a data protection authority. In Greece that is the Hellenic Data Protection Authority, www.dpa.gr. We'd like the chance to put it right first.
Changes
If we change this notice, the date at the top changes with it.