Privacy policy

1. Who is responsible for your data

TripFavo is operated by Rocket Science B.V., which is the controller of your personal data within the meaning of the GDPR:

For any question about your privacy you can contact us at email@rocketsciencebv.nl.

2. Which personal data we process

Your account

• your first name, middle name (optional) and last name, and your email address;
• your password, which we never store as such: we only keep a salted one-way cryptographic hash of it (PBKDF2 with SHA-256 and 100,000 iterations; accounts created earlier may still have a bcrypt hash);
• a profile photo, if you upload one;
• your preferred language, whether your email address has been verified, your account role (guest, host) and the date your account was created.

Email verification

When you sign up we email you a six-digit verification code. We store the code, its expiry time and the number of attempts. A code is valid for at most one hour and becomes unusable once it has been used or after five wrong attempts.

Listings (hosts)

If you list a property we process the information you enter: title, descriptions, type of accommodation, floor plan, capacity, amenities, prices (seasonal rates, cleaning fee, deposit), photos and the address with its geographic coordinates. To help you enter the address we send what you type in the address field to an address lookup service (see below). Other users only see the approximate location of your property until you confirm their booking (see “What other users can see”).

Booking requests and bookings

When you request a booking we process the dates, the number of guests (adults, children, infants, pets), the price breakdown, the status of the request (for example pending, confirmed, declined, cancelled or expired) and which guest and property it concerns. If a host cancels a confirmed booking, we also process who cancelled, when, and the reason the host gives. We also keep the properties you save as favourites.

Messages between guests and hosts

Once a booking request has been sent, the guest and the host can write to each other about it in TripFavo. We store these messages with their sender and time, and when each of you last read the conversation and was last notified of it, to provide this messaging feature (performance of a contract). Only the guest and the host of that booking can read the messages; we do not use them for advertising or profiling. When you receive a new message we may send you an email notification with the text of that message through our email provider Resend (see below), at most once every 15 minutes per conversation.

Technical data

Like every website, our servers receive your IP address, browser type, the requested page and the time of the request. We use this data to deliver the website, to keep it secure (for example to limit the number of login and verification attempts) and to fix errors.

Communication

If you email us we process your message and contact details to answer you.

3. What other users can see

• Published listings are public. Anyone can see the listing details, its photos, its town, region and country, and the host's first name, profile photo and membership date. The map only shows an approximate area of about one kilometre around the property, never the exact spot: the public page does not contain the street, house number, postal code or apartment details, and its coordinates are rounded to about one kilometre.
• The exact address is only shown to a guest once the host has confirmed their booking, in that guest's own booking details and confirmation email.
• When you send a booking request, the host receives your first name, profile photo, membership date and the details of your request, so that they can decide on it.
• If you cancel a confirmed booking as a host, the guest sees the reason you give, on the booking and in the cancellation email.
• Messages about a booking are only visible to the guest and the host of that booking. Your messages show your first name, never your email address or last name.
• We never show your email address or last name to other users.

4. Why we process your data and on which legal basis

• Performance of a contract (art. 6(1)(b) GDPR): creating and managing your account, publishing your listings, handling booking requests, and sending the related service emails (verification codes, booking requests, confirmations and cancellations).
• Legitimate interests (art. 6(1)(f) GDPR): securing the platform and preventing fraud and abuse (including rate limiting and short-lived security logs), keeping booking records for a limited time to handle questions, disputes and abuse, establishing, exercising or defending legal claims, remembering your language, fixing errors and answering your questions. We have weighed these interests against your privacy and keep the data involved to a minimum.
• Legal obligation (art. 6(1)(c) GDPR): handling reports of illegal content and complaints under the EU Digital Services Act, keeping the bookkeeping records of Rocket Science B.V. for the statutory period, and responding to lawful requests from authorities.

5. Service providers we use

We use the following service providers (processors) that process personal data on our behalf, under a data processing agreement:

• Hetzner Online GmbH (Germany, EU): hosting of the website and the database on servers in Germany, managed with the deployment tool Coolify.
• UploadThing (United States): storage and delivery of profile photos and listing photos.
• Resend (United States): sending service emails such as verification codes and booking notifications.
• LocationIQ (Unwired Labs Pte Ltd, Singapore): address suggestions and geocoding while a host enters a property address. Only the address query you type is sent, from our server, without your name, account details or IP address.

The maps on listing pages use map tiles from the OpenStreetMap Foundation (United Kingdom). Your browser loads these tiles directly from the Foundation's tile servers, which therefore receive your IP address, browser information and the address of our website (not the page you are viewing). The OpenStreetMap Foundation processes this data as an independent controller, under its own privacy policy. The United Kingdom has an adequacy decision of the European Commission. Map data © OpenStreetMap contributors.

Apart from these providers, we only share data with the guest or host involved in a booking (as described above), or with authorities when the law requires us to.

6. Transfers outside the European Economic Area

Some providers are based outside the European Economic Area (EEA) or may process data there:

• UploadThing and Resend (United States): under the EU-US Data Privacy Framework where the provider is certified under it, and otherwise under the Standard Contractual Clauses adopted by the European Commission.
• LocationIQ (Singapore): under the Standard Contractual Clauses adopted by the European Commission.
• OpenStreetMap Foundation (United Kingdom): the European Commission has adopted an adequacy decision for the United Kingdom.

Where needed we add supplementary safeguards, and we only send the minimum data the service needs. You can ask us for a copy of the relevant safeguards at email@rocketsciencebv.nl.

7. How long we keep your data

• Account data: for as long as you have an account. If you ask us to delete your account we do so within 30 days, except for data we must keep by law.
• Booking requests and bookings: two years after the end date of the stay, so that we can handle questions, disputes and abuse; longer only where needed to establish, exercise or defend legal claims. TripFavo does not process payments, so bookings are not part of our tax records. The bookkeeping records of Rocket Science B.V. itself are kept for the statutory retention period.
• Messages between guests and hosts: they are part of the booking record, so we keep them until two years after the end date of the stay and then delete them together with the booking. If you ask us to delete your account, we delete the messages you sent within the same 30 days, unless we need them to establish, exercise or defend legal claims. The messages the other party sent stay in their own booking record.
• Listings and photos: until you delete them or your account, subject to the booking records above.
• Verification codes: valid for at most one hour; they cannot be used after they expire.
• Security and server logs: no longer than 30 days, unless we need them to investigate a specific incident.
• Emails to us, reports and complaints: as long as needed to handle them, and no longer than two years after they are closed.

8. Cookies and local storage

We only use cookies and similar technologies that are strictly necessary for the website to work. We do not use analytics, advertising or tracking cookies, which is why we do not ask for cookie consent.

• authjs.session-token (on our live site with the prefix __Secure-): keeps you logged in; it is removed when you log out and expires after at most 30 days.
• authjs.csrf-token (prefix __Host- on our live site) and authjs.callback-url: protect the login against forged requests and bring you back to the right page after logging in; they last for your browser session.
• NEXT_LOCALE: remembers the language you chose, for one year.
• userMode (session storage in your browser, not a cookie): remembers whether you are browsing as a guest or a host until you close the tab.

9. How we protect your data

We take appropriate technical and organisational measures, including encrypted connections (HTTPS), hashed passwords, access control, limits on login and verification attempts, and hosting in the EU. Only people who need access to do their job can access personal data.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have incorrect data corrected;
• have your data erased;
• restrict the processing of your data;
• receive your data in a structured, machine-readable format (data portability);
• object to processing based on our legitimate interests.

You can change most account details yourself in your account settings. For anything else, email us at email@rocketsciencebv.nl. We respond within one month and may ask you to confirm your identity. We do not make decisions about you based solely on automated processing.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, www.autoriteitpersoonsgegevens.nl) or with the supervisory authority in the EU country where you live. We would appreciate the chance to resolve your concern first.

11. Minimum age

TripFavo is intended for people aged 18 and over. We do not knowingly process personal data of children. If you believe a child has created an account, please contact us and we will delete it.

12. Changes to this policy

We may update this policy when our service or the law changes. The date at the top shows when it was last changed. If a change significantly affects you, we will inform you by email or on the website before it takes effect. Please also read our terms of use.

13. Contact

For questions about this privacy policy or your personal data, contact Rocket Science B.V. at email@rocketsciencebv.nl or by post at Top Naefflaan 56, 1403 GB Bussum, the Netherlands.