Privacy
Last updated: October 26, 2026
This page explains simply what information LoveStay collects, why, how long it is kept and how you can view, correct or delete it. Your data is never sold, rented or used for advertising.
Who is responsible for your data?
- Controller
- Mbadnan Adoum Bakasse
- Company number
- BE 1029.683.110
What we do with your data
Waitlist
- Why
- Letting you know when LoveStay opens and preparing the launch according to the cities and profiles interested.
- Data
- Email, first name, last name and city (with its approximate position, to know which cities to open first). Profile (traveller, host or both). Site language. Approximate country derived from the connection. Website you came from. Date and wording of your consent. Your referral code and, if you came through a friend’s link, their code. The version of the page you saw if an A/B experiment is on.
- People concerned
- People signed up to the waitlist
- Legal basis
- Your consent, which you can withdraw at any time
- Retention
- Until launch, then 12 months at most. Deleted 90 days after unsubscribing.
- Access
- The LoveStay team and the service providers below
LoveStay emails
- Why
- Sending you the welcome email, the launch announcement and, if you agreed, news about the project. If you are a member of the app, emails to help you get started and keep you informed, which you can unsubscribe from at any time.
- Data
- Email, first name, language, city. Sending, delivery, opening and clicks of each email (to check they arrive).
- People concerned
- People signed up to the waitlist
- Legal basis
- Your consent, which you can withdraw at any time
- Retention
- Email tracking: 24 months, then anonymised.
- Access
- The LoveStay team, Resend
App accounts
- Why
- Creating and securing your LoveStay account, verifying your email, signing you in, resetting your password and checking that you are at least 18.
- Data
- Email or phone number, password (encrypted, unreadable even to us), first name, last name (private, never shown to other members), date of birth, traveller or host mode, language, verification codes (30 minutes), sign-up and last visit dates, campaign link or website you came from, promo codes used, rewards and points. Versions of the terms of use you accepted and of the privacy policy you read, with the date (proof of your agreement).
- People concerned
- App members
- Legal basis
- Performance of a contract with you
- Retention
- As long as the account exists. Everything is deleted immediately when you delete your account. Only an anonymous record of the deletion is kept.
- Access
- The LoveStay team, Supabase, Netlify, Resend
Profile
- Why
- Building your traveller card and, if you become a host, your host card, so other members can discover you, and suggesting the right profiles to you.
- Data
- Photos and their captions (traveller card and host card), city, bio, job, studies, travel style, interests, languages. Host card: host bio and what you offer. Optional: gender, “you would like to meet” and what you are looking for. Gender and “you would like to meet” may reveal your sexual orientation: you choose whether to give them, you can delete them at any time, and they stay hidden on your profile unless you choose to show them. Your display choices. The experiences you are interested in or offer (deep connection, shared moments, local discovery): they may relate to your intimate life, they are only saved with your explicit consent, you can remove them at any time, and they stay hidden on your profile unless you choose to show them.
- People concerned
- App members
- Legal basis
- Your consent, which you can withdraw at any time
- Retention
- As long as the account exists. A deleted photo or detail is removed immediately. The whole profile and all photos are deleted with the account.
- Access
- Other members (only what you choose to show, never your last name or date of birth), the LoveStay team, Supabase, Netlify
Host listings
- Why
- Letting hosts offer their home and experience, checking listings before they go online and showing them to travellers.
- Data
- Experience offered, entire or shared home, title, description, type of home, sleeping arrangement, number of guests, amenities, house rules, local discovery, photos and captions, city and neighbourhood, exact address (private), price, minimum nights, closed days, status and review decisions.
- People concerned
- App hosts
- Legal basis
- Performance of a contract with you
- Retention
- As long as the listing or the account exists. A removed listing is erased at once with its photos, and everything is erased with the account. The exact address is never shown to other members: it will be given to the traveller only when the host accepts their booking.
- Access
- Travellers (without the exact address), the LoveStay team, Supabase, Netlify
Reports and safety
- Why
- Protecting members: receiving and handling reports, letting you block a member, checking profile photos and texts, and hiding or suspending a profile that breaks the rules.
- Data
- Who reports whom, the reason chosen, the details written, the reported photo if any, the date. The members you have blocked. Moderation decisions (warning, hidden profile, suspension) and their reason. The date your photos and texts were checked.
- People concerned
- App members
- Legal basis
- Our legitimate interest
- Retention
- Handled reports are deleted 2 years after the decision. Everything about a member is deleted with their account. If you delete your account, your reports remain, without your name, to keep protecting other members. The reported person never learns who reported them.
- Access
- The LoveStay team, Supabase, Netlify, Resend
Messages received
- Why
- Answering emails sent to a @lovestay.app address.
- Data
- Email address, name, message content and attachments.
- People concerned
- People who write to LoveStay
- Legal basis
- Our legitimate interest
- Retention
- 12 months after the last exchange.
- Access
- The LoveStay team, Resend, Google (Gmail)
Visit statistics
- Why
- Knowing how many people visit the site and how they find it, to improve LoveStay.
- Data
- Page viewed, language, approximate country, device type, referring site. No cookies: an anonymous code that changes every day counts visitors without recognising them. The version of the page viewed if an A/B experiment is on.
- People concerned
- Website visitors
- Legal basis
- Our legitimate interest
- Retention
- 13 months.
- Access
- The LoveStay team
Measuring our ads
- Why
- Measuring how well our ads on Meta (Facebook, Instagram), TikTok and Google work, and showing them to people who might be interested in LoveStay.
- Data
- Only if you accept advertising cookies: cookie identifiers, pages viewed, waitlist sign-up or account creation (without your name or email), IP address and browser type, collected by these companies.
- People concerned
- Site and app visitors who accept advertising cookies
- Legal basis
- Your consent, which you can withdraw at any time
- Retention
- Your choice is kept for 6 months. Advertising cookies last 13 months at most. You can withdraw your consent at any time with the “Manage cookies” link.
- Access
- Meta Platforms Ireland, TikTok Technology Limited (Ireland), Google Ireland. These companies may transfer data to the United States (EU-US Data Privacy Framework)
Requests about your data
- Why
- Handling your requests (access, correction, deletion of your data…) and being able to prove we answered them.
- Data
- Email, type of request, exchanges, dates.
- People concerned
- People exercising their rights
- Legal basis
- A legal obligation
- Retention
- 3 years after the answer.
- Access
- The LoveStay team
Ambassadors
- Why
- Running the ambassador programme: their link and promo code, and what each one brings in.
- Data
- Name, email, city, channel (social network, partner…), collaboration notes, results of their link and code (clicks, sign-ups, accounts created).
- People concerned
- LoveStay ambassadors, influencers and partners
- Legal basis
- Performance of a contract with you
- Retention
- During the collaboration, then 1 year.
- Access
- The LoveStay team
The service providers who help us
These services process data only on our behalf, following our instructions, under a contract that requires them to protect it.
Database
- Location
- European Union (Paris)
- Safeguards
- Data processing agreement and European Commission standard contractual clauses
Website hosting
- Location
- Global network (US company)
- Safeguards
- Data processing agreement and European Commission standard contractual clauses
Sending and receiving emails
- Location
- European Union (Ireland), US company
- Safeguards
- EU-US Data Privacy Framework and standard contractual clauses
Inbox for messages sent to LoveStay
- Location
- Worldwide (US company)
- Safeguards
- EU-US Data Privacy Framework and standard contractual clauses
Cookies
This site uses no advertising or tracking cookies. Visit statistics work without cookies, which is why no banner asks for your consent.
Security
Data is encrypted in transit (HTTPS) and stored with reliable providers. Only the people who run LoveStay have access, with a personal password.
Your rights
- See your data and receive a copy.
- Correct it if it is wrong.
- Delete it.
- Withdraw your consent at any time, for example by unsubscribing from emails.
- Object to a processing activity or ask to restrict it.
- Most of these actions happen instantly on the "My data" page. For anything else, write to us: we answer within one month.
Manage my data
If you think your rights are not respected, you can lodge a complaint with: Data Protection Authority (APD/GBA), Belgium.
← Home
