Privacy notice — draft

Version preview-2026-10-10. Not finalized for live intake. Operator identity, hosting arrangements, relevant markets, lawful bases and rights procedures need review before launch. Contact: contact.stay@funtoolie.com; delivery and monitoring are not yet verified.

StayWidget uses common Funtoolio Google sign-in for owners. It keeps an issuer/subject identity and display name; it does not access Gmail. Secure service cookies are used for owner login and antiforgery. Guests do not need an account or cookies.

Reservation requests collect name, phone, email, dates, unit and guest count. Guests should not submit passport data, payment details or sensitive free text. Property owners determine their booking use; the service's controller/processor responsibilities and agreements must be assessed for the actual operator and market.

Private links are bearer capabilities. Anyone with a complete link can use its scoped permissions. They expire, can be revoked, and are removed from retry recovery after 24 hours. Encrypted recovery material remains briefly while an email-addressed request is pending so approval can queue its private link; this does not extend submission retry access. Authorized owner management/export still contains guest data and must be handled privately.

Provisional retention: closed unaccepted enquiry contacts 90 days; booking contacts 12 months after departure/cancellation; nonpersonal history 24 months; activity 12 months. Upcoming bookings are preserved. Feedback is private: closed or unreviewed New records expire after 12 months, selected ongoing work remains until closed. Product account deletion is a coordinated operator procedure; common-auth deletion is separate. Backup expiry and deletion reapplication must be established before production.

When production sending is configured, Brevo processes the guest email address, stay details, owner public contact and private management link for the confirmation message. The sender is noreply@funtoolie.com. No marketing email is sent. Local development uses a private sink instead of an external provider. Queue payloads are encrypted with service keys, cleared after a completed attempt, and queue records expire after 30 days. Sender authentication, processor agreements, provider retention, transfers and email tracking settings need verification before live sending.

On the configured production host, public home, pricing, demo, installation and limitations pages use Umami Cloud for estimated visits. Widgets, reservation forms, guest-status links, owner dashboards, feedback, sign-in and callbacks are excluded. Manual views include only the configured website/hostname, fixed public path/title, empty referrer, browser language and screen size; queries, fragments, form contents and account identities are not sent. No advertising profiles, identity linking, replay or heatmaps are enabled. Umami receives ordinary network transport information; this is not a claim of anonymity. Website visit settings offers a browser opt-out stored for 180 days, and DNT/GPC signals disable collection. Local preview tracking is off. Umami is a separate provider and uses the owner-selected shared portfolio stream; actual account/domain acceptance, provider processing/retention/transfers and applicable visitor-choice requirements must be verified before launch.

Optional first-party daily counters count fixed public page requests, widget responses, committed requests, installation acknowledgements and attribution clicks. They are approximate counts, not unique visitors. No tenant, guest, token, IP or referrer is stored in them. They are disabled by default; DNT: 1 and Sec-GPC: 1 opt out when enabled. Raw networks are transiently used in abuse controls as process-local keyed hashes. Metrics expire after 90 days and failures do not affect bookings.

Routine feedback is not the security/privacy rights channel. Use the contact address above for rights or security reports; never send a private guest link or password. Identity verification, applicable response obligations, incident handling and any international transfer requirements need review. This draft does not establish legal compliance.