Privacy Policy — "Hola Stay" app

Last updated: 23 July 2026

This privacy policy covers the "Hola Stay" application (the "App") — an internal tool for managing short-term rental apartments (bookings, settlements, invoices, property documents). The App runs on mobile devices (Android, iOS), Mac computers and in a web browser. This policy explains what data the App processes, where it is stored and who it is entrusted to.

*Polska wersja / Polish version: Polska wersja

1. Data controller

The controller of personal data processed in the App is:

• HolaStay — Damian (sole trader / autónomo)
• NIF: Y9967168Y
• E-mail: contact@holastay.eu
• Phone: +34 625 088 586
• Website: https://holastay.eu
• Address: Calle Abel 19, 30720 Santiago de la Ribera, Murcia, Spain

For any matter regarding personal data and this policy, please contact contact@holastay.eu.

2. Nature of the App

The App is a business tool for the owner and the team servicing the apartments. It is not intended for guests or the general public.

Access requires signing in with three credentials: company number, e-mail address and password. Accounts are created only by an administrator — the App offers no self-registration. Each company has its own separated data space; a user of one company cannot access another company's data.

3. What data is processed

• Guest data from bookings: first and last name, phone number, e-mail address, stay dates, number of guests, property, source booking portal.
• Registration data required by Spanish law (traveller register, SES): identity document details, nationality, date of birth, address.
• Settlement and invoice data: amounts, buyer, NIF, invoicing details, costs, payments.
• Property documents and cards: values/numbers (e.g. contract numbers, meter readings) and attachments (scans and photos of documents, invoices, faults).
• Team account data: name, e-mail address, role, permissions and a sign-in log (passwords are stored only as a cryptographic hash — never in plain text).

4. Where data is stored

Data is stored in two places at the same time:

1. In the company cloud — in the database and file storage of Google Firebase (Firestore and Cloud Storage), on servers located in the European Union. This lets the team work on shared, up-to-date data across all devices.
2. Locally on the device — as a working copy that allows the App to be used without an internet connection (offline mode). Once the connection is restored, data synchronises with the company cloud.

Cloud data is written into a space assigned to the company number and protected by server-side access rules — reading and writing are possible only for signed-in members of that company.

Attachments (scans, photos, generated PDF documents) are stored on the device and, to the extent enabled by the administrator, also in the company file storage in the European Union.

5. Processors and server locations

Document scanning in the browser and desktop versions reads text from the image using Google Cloud Vision in the European Union region — the image is transmitted solely to read its text and is not retained outside the company file storage. On phones, reading happens entirely on the device.

Firebase services are configured so that App data is stored on servers in the European Union. If, within the provider's services, data is transferred outside the European Economic Area, this takes place on the basis of standard contractual clauses approved by the European Commission.

6. Source of booking data (IdoBooking)

The App downloads bookings from the IdoBooking system through an iCal feed — read-only. The App neither writes nor modifies anything in IdoBooking.

Downloading happens in two ways: directly from the App, and periodically (roughly every 15 minutes) through a server-side service running in the European Union, which writes bookings into the company cloud. Thanks to this the schedule stays current even when nobody has the App open.

The booking system provider (IdoBooking) is a separate entity — its processing rules are described in that provider's documents.

7. Device permissions

• Internet — synchronising data with the company cloud, downloading the iCal feed, downloading offline assistant models and (optionally) the "cloud AI" mode.
• Camera — scanning invoices and documents.
• Gallery / photos — selecting a photo of an invoice or document to attach to a settlement or property card.
• Notifications — reminders about arrivals, departures and tasks.

8. No tracking, no ads

The App does not track users, does not use an advertising identifier (IDFA), contains no ads and no third-party analytics tools. It does not profile users or guests.

9. Data recipients

Data processed in the App is never sold or shared for marketing purposes. Beyond the processors listed in section 5, data may be passed on only to:

• public authorities — to the extent required by law (including submitting registration data to the SES / Guardia Civil traveller register),
• a recipient chosen by the user — when the user deliberately shares a generated file (e.g. an invoice PDF) using an application of their choice (mail, messenger).

"Cloud AI" assistant mode (optional, disabled by default): if the administrator enables "AI (cloud)" in Settings and enters an API key, the content of the query and property data (e.g. Wi-Fi, hours, address) are sent to the model provider (OpenAI) to generate a reply. When the mode is off, the assistant works locally and no data is sent to that provider.

10. Backups

The administrator can export the company data into a single backup file and store it outside the App (e.g. on a drive or external medium). Such a file contains personal data — responsibility for storing it securely rests with the administrator.

11. Retention period

Some data is subject to mandatory archiving required by law and is kept for the period required by it, in particular: (a) guest registration data (traveller register — SES/Guardia Civil) and (b) settlement documentation and invoices (accounting and tax regulations). We do not delete this data before the legally required period has passed.

Remaining data is kept for as long as it is needed for the day-to-day operation of the apartments — both in the company cloud and in the local copy on devices. Deleting data in the App also removes it from the company cloud.

12. Legal basis and data subject rights (GDPR)

Data is processed on the basis of the controller's legitimate interest (handling bookings and settlements) and legal obligations (traveller register, accounting and tax documentation).

Data subjects (including guests) have the right to: access their data, rectification, erasure, restriction of processing, objection and data portability, as well as the right to lodge a complaint with a supervisory authority (in Spain: Agencia Española de Protección de Datos). To exercise these rights, please contact: contact@holastay.eu.

The rights to erasure and objection are limited to the extent that the law imposes an obligation to retain data (including the SES traveller register and accounting/tax documentation). In that scope, data is deleted only after the legally required period has passed.

13. Security

We apply the following safeguards:

• three-factor sign-in (company number + e-mail + password) and no self-registration — accounts are created only by an administrator,
• passwords stored solely as a salted cryptographic hash (never in plain text), with a forced password change at first sign-in,
• server-side access rules — company data visible only to signed-in members of that company; company spaces are separated from one another,
• encryption in transit (HTTPS/TLS) and encryption at rest on the cloud provider's side,
• a sign-in log making it possible to establish who used the App and when,
• client app verification (Firebase App Check) limiting database access to the genuine App.

14. Account and data deletion

Accounts are created and removed by the administrator. A request to delete an account or data can be submitted to contact@holastay.eu or through the form available at: Account & data deletion

Deletion covers the account data and the company data linked to that account, except for data subject to mandatory legal archiving (section 11), which is deleted once the required period has passed.

15. Children

The App is a business tool and is not directed at children. We do not knowingly collect children's data. Data of minors may appear only to the extent required by registration regulations (traveller register), when a minor is a participant of a stay.

16. Changes to this policy

This policy may be updated. The current version is available in the App (Settings → Privacy and data) and at https://hola-stay.web.app/polityka-prywatnosci/en. The date of the last update appears at the top of the document.

17. Contact

For matters regarding privacy and personal data: HolaStay — contact@holastay.eu — +34 625 088 586