Privacy policy
How Gjestly processes personal data, for the guesthouses using us and their guests.
1. Data controller
This section is under legal review and is not final.
2. What we collect
Account data, booking data, payment references, technical logs.
3. Purposes and legal basis
This section is under legal review and is not final.
4. Sub-processors
See the table below: Supabase, Vercel, Stripe, Resend.
5. Retention and deletion
This section is under legal review and is not final.
6. Your rights
Access, rectification, erasure, portability, complaint to the Norwegian DPA.
7. Third-country transfers
This section is under legal review and is not final.
8. Contact
This section is under legal review and is not final.
Sub-processors
| Vendor | Role | What is processed | Data location | Transfer basis |
|---|---|---|---|---|
| Supabase | Database and authentication | Bookings, guest register, invoices, user accounts | Not confirmed yet | Not confirmed yet |
| Vercel | Application hosting | Traffic to the websites and booking pages | Not confirmed yet | Not confirmed yet |
| Stripe | Payment processing | Payments. Card data is processed by Stripe, never by Gjestly | The Stripe group (global) | EU-US Data Privacy Framework |
| Resend | Transactional email | Email addresses and booking confirmations | Not confirmed yet | Not confirmed yet |
The fields that are not confirmed yet are filled in once the vendor agreements have been reviewed. If you need them before that, get in touch and we will send what we have.