1. Data controller
The data controller is Hostea (Petar Vlajić, Beograd, Srbija). Contact for all privacy matters: vlajic.p27@gmail.com. We process data in line with the Serbian Law on Personal Data Protection and, where applicable, the GDPR.
2. What we collect
Account: email and language. Booking: name, phone (optional), dates, number of guests, notes. Hosts: property details and contact details. Messages: the content of enquiries you send us. Technical data: IP address, browser type and error reports, for security and stability. We do not collect payment card data.
3. Why and on what basis
We use data to perform your booking and communicate with you (contract), to secure the platform and prevent abuse (legitimate interest), to meet legal obligations such as guest records and registration (legal obligation), and for optional features with your consent, which you can withdraw at any time.
4. Who we share data with
The host you book with receives the data needed for the stay (name, contact, dates). Service providers processing data on our behalf: hosting (Hetzner, EU), email delivery (Resend), image storage (Cloudinary) and error monitoring (Sentry). We disclose data to public authorities only when the law requires it. We do not sell personal data.
5. Transfers outside Serbia and the EU
Some of the providers above may process data outside Serbia and the EU. In that case we rely on appropriate safeguards such as standard contractual clauses.
6. How long we keep data
We keep account data while the account is active. Booking records are kept for as long as accounting and tax rules require. Sign-in links are valid for 15 minutes and sessions for at most 7 days. After you delete your account we anonymise personal data, except what we must retain by law.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. When signed in you can download your data and delete your account. For anything else write to vlajic.p27@gmail.com; we reply within 30 days. You may also lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).
8. Security
We use encrypted connections (HTTPS), passwordless sign-in with one-time links, rate limiting and access control. No system is perfectly secure; in the event of a breach affecting your data we will notify you and the authority within the legal deadline.
9. Cookies
We use only essential cookies and local storage (language and sign-in). Details are in the Cookie Policy.
10. Children
The platform is not intended for people under 16 and we do not knowingly collect their data.
11. Changes
We will notify you on the platform of material changes to this policy. The last-updated date is shown at the top of the page.