Privacy Policy

These roles matter, because they determine who you exercise your rights against.

In plain terms: we are responsible for your host account. For guest data the host is responsible, and we process it on their behalf under the Data Processing Agreement.

Contact: Finest Spaces Studio Ltd, 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF · Company no. 16561913 · [email protected]

If you are a host:

• Account: name, email address, hashed password, email-verification status, creation date.
• Property content you enter or import: descriptions, photos, amenities, prices, policies, house rules, address and approximate coordinates.
• Billing: subscription plan and interval, and identifiers from our payment provider. We never see or store your card number.
• Payout connection: the identifier of the payment account you connect, so bookings pay you directly.
• Operational records: calendar sync URLs and their status, promo codes, email delivery logs.

If you are a guest:

• Booking details: name, email, phone, country, stay dates, number of guests, price and payment status.
• Messages you exchange with your host through the platform.
• Any review you choose to leave after a stay.
• Questions you type into the on-site booking assistant, where the host has enabled it.

Everyone: a strictly necessary session cookie when signed in, aggregate page-view counts per property — a daily total, not tied to you — and, on our own pages and only if you accept it, Google Analytics.

We do not knowingly collect special-category data (health, religion, political opinions, biometrics), and we ask that you do not enter it into free-text fields such as notes or messages.

We do not sell personal data, and never have. We share it only with the categories of provider needed to run the service:

A current list of our sub-processors is kept at /subprocessors, where hosts can also ask to be notified before we add a new one.

We may also disclose data where legally required — a court order or regulator — or to establish or defend legal claims.

Some providers process data outside the UK and the European Economic Area. Where they do, we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where UK law applies, together with additional safeguards such as encryption in transit and data minimisation. The categories affected and the safeguard applied to each are listed on the sub-processors page. You may request a copy of the relevant clauses from [email protected].

If you are in the UK, EEA or Switzerland you have the rights below. They apply to hosts and guests alike — though for guest data it is often quicker to ask the host directly, since they control it.

• Access (Art. 15) — a copy of the personal data we hold about you, plus the information in this policy.
• Rectification (Art. 16) — correction of anything inaccurate or incomplete.
• Erasure (Art. 17) — deletion, where no overriding obligation requires us to keep it. Booking records subject to tax law are the usual exception.
• Restriction (Art. 18) — ask us to pause processing while a dispute or accuracy check is resolved.
• Portability (Art. 20) — your data in a structured, machine-readable format, or sent to another provider where technically feasible.
• Objection (Art. 21) — object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds.
• Withdraw consent (Art. 7(3)) — at any time where processing relies on consent. This does not affect processing already carried out.
• No automated decision-making (Art. 22) — we do not make decisions producing legal or similarly significant effects about you by automated means alone.
• Complain (Art. 77) — to your local supervisory authority, or to the Information Commissioner's Office (ICO). You need not come to us first, though we would like the chance to help.

To exercise any of these, email [email protected]. We respond within one month, extendable by two further months for complex requests — we will tell you if we need that extension. There is no charge unless a request is manifestly unfounded or excessive. We may ask for enough information to confirm your identity before acting.

We use a strictly necessary cookie to keep you signed in, which needs no consent because you asked to sign in. On our own marketing pages and dashboard we also use Google Analytics, which sets cookies and therefore loads only after you accept it — decline and nothing is requested from Google. It never runs on a host’s property website. We use no advertising cookies and no cross-site tracking, and you can change your answer at any time on the cookies page.

• Passwords are stored using a salted, computationally hard hash — never in readable form.
• All traffic is encrypted in transit with TLS.
• Sessions use a signed, HTTP-only cookie that JavaScript cannot read.
• Email confirmation and password-reset links are single-use and expire.
• Card details never reach our servers; they are handled by our payment provider.
• Access to production data is limited to those who need it to operate the service.

If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and inform affected users without undue delay.

The service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

Changes are posted here with the date above updated. Where a change materially affects your rights we will notify account holders by email before it takes effect.