Privacy Policy
Operated by Flats Bratislava s. r. o. · Last updated 12 October 2026
This policy explains what personal data we collect when you use luxury.host, why we collect it, how long we keep it and how you can have it deleted. Flats Bratislava s. r. o. is the data controller and processes personal data under the EU General Data Protection Regulation (GDPR).
Who we are
Flats Bratislava s. r. o., Doležalova 3424/15C, 821 04 Bratislava-Ružinov, Slovakia, IČO 57512655. You can reach us at [email protected]. Our full company details are at the bottom of this page.
What we collect
What we receive depends on how you use luxury.host.
If you apply for the private beta
When you submit the beta application form, we receive:
- your name and email address
- the city or market your property is in
- how many properties you operate
- which kinds of booking platform you use (major OTAs, regional sites, direct bookings)
- optionally, the tools you use or want integrated, and a free-text description of your biggest operational problem
- your IP address and the country it resolves to, recorded automatically with the submission
- which advertisement or link brought you to the page, if any
If you book a demo call
Your name, email address and the answers you give when you book a demo call at luxury.host/book. Our scheduling provider, Cal.com, handles the booking on our behalf.
If you use the product
- Account data: name, email, company and billing details.
- Operational data: reservations, guest messages, access codes, prices, tasks and accounting records that you or your booking channels send us.
- Guest data: names and contact details of your guests. We process these on your behalf, as described in the Data Processing Addendum.
- Usage and technical data: logs, device and browser information, and essential cookies.
Why we use it and on what legal basis
- Beta application. We use it only to assess your application and reply to you. The legal basis is your consent, which you give by submitting the form. We do not sell or rent application data, share it with third parties for their own marketing, or use it to build advertising audiences.
- Product, demo and setup calls. We use the data to provide and secure the service, process bookings and messages, bill you, give support, meet legal obligations and improve the product. Depending on the purpose, the legal basis is the performance of our contract with you, our legitimate interests, your consent where the law requires it, or a legal obligation.
- Analytics and advertising cookies. The legal basis is your consent, which you give by accepting them in the banner shown on your first visit.
You can withdraw your consent at any time. For your application data, email us (see Your rights). For the cookie choice, clear the site data for this domain in your browser.
Who processes data for us
- Cloudflare Workers KV stores beta application records.
- Resend emails each application to us and sends you a confirmation.
- Cal.com handles call bookings.
These providers act as processors, on our instructions. For the product itself we use a small set of vetted providers for hosting, infrastructure, payments, email and AI inference. You can ask us for the current list at [email protected]. We give notice of material changes in advance.
Where data is processed
The luxury.host application runs on servers in the EU (Germany). Backups and uploaded files may be stored in other locations. Some of the providers mentioned above, for example for email and AI inference, may also store or process data in other locations. When a provider operates outside the European Economic Area, we rely on an adequacy decision or on Standard Contractual Clauses.
How long we keep it
- Beta applications: for as long as the private beta runs and up to 12 months after it ends, unless you ask us to delete them sooner. We delete declined applications within 3 months.
- Product accounts: for as long as your account is active and as long as we need the data to provide the service or meet legal obligations, such as invoicing. After the account ends, we delete or anonymise the data within 30 to 90 days, unless the law requires us to keep it longer.
- Other personal data, including call bookings: only as long as we need it to provide the service or meet a legal obligation.
Analytics and advertising
On the home page, the booking page and the Slovak register page we use
Google Analytics 4 to count visits and booked calls. On the beta application
page we use Google Analytics 4 and a Google Ads conversion tag to count how many
visitors reach and complete the form. They run with allow_ad_personalization_signals and
allow_google_signals turned off. They measure conversions only and
do not build remarketing audiences or personalise ads. We do
not upload applicant email addresses to Google.
If you accept cookies in the banner, the home page, the booking page and the
Slovak register page also load the Meta Pixel (Meta Platforms Ireland Ltd.).
It sets the _fbp cookie and tells Meta that a page was viewed, that
the booking link was used and that a call was booked, so we can see which of our
Facebook and Instagram ads lead to booked calls and Meta can show them to people
likely to book. It does not receive what you type into the booking form. If you
decline, or until you choose, it does not load at all.
We also count visits without cookies. When a page opens or closes, your browser sends us an anonymous signal: which page it was, roughly how long the visit lasted, how far down the page you got, whether you used the booking link, and the campaign tag of the link you came from. We keep only daily totals. Nothing in it identifies you, nothing is stored in your browser, and we do not store your IP address.
Cookies and browser storage
Google Analytics and the Google Ads conversion tag set cookies for measurement, but only after you accept them. On your first visit a banner asks. Until you choose, and if you decline, no analytics or advertising cookies are stored and both tags run in a consent-denied state. Your browser remembers your choice. You can reset it at any time by clearing the site data for this domain.
We also keep the referring campaign in your browser's
sessionStorage, so we know which channel an application came from.
It is cleared when you close the tab.
The product uses essential cookies to keep you signed in and your session secure. The Cookie Policy has the details.
Your rights
Under the GDPR you can ask for access to your data, its correction or erasure, restriction of processing, or a copy in a portable format. You can also object to certain processing. Email us and we will act on your request within 30 days. You can also complain to the Slovak data protection authority, Úrad na ochranu osobných údajov Slovenskej republiky.
Security
We use encryption in transit and at rest, access controls, least-privilege access and audit logging. No system is perfectly secure, but we take reasonable and appropriate measures.
Contact
Questions about your data go to [email protected] or to the postal address below.