Persónuverndarstefna

QRiousStay is a service provided by Laine Digital AB, organisation number 559571-5722, Arås 7, 504 94 Borås, Sweden. Laine Digital AB is the data controller for the personal data described in this policy.

Privacy questions and requests: contact@qriousstay.com.

• Account & profile — name, email address, phone number if you add one, password (stored as a secure hash, never readable), language, time zone and avatar.
• Google sign-in — if you choose to sign in with Google, we store your Google account identifier and email address. We never receive or store your Google password.
• Your accommodations — names, locations, descriptions, photos, themes, services, custom services and everything you put in your guest guides, including translations of that content.
• Public guide identity — each accommodation’s permanent QR identity (PublicId) and the public web address (slug) you choose.
• Scan statistics — when a guest opens a guide we record the accommodation, the time, the chosen language and a one-way hashed technical identifier derived from the network address. We do not store guests’ raw IP addresses.
• Subscription & billing — your plan, subscription status and history, payment records, and your customer and subscription identifiers at our payment provider Stripe. Card details never reach our servers.
• Technical information — server logs needed to operate, secure and troubleshoot the service.

• Providing the service (performance of contract) — accounts, guest guides, QR identities, translations, subscriptions and support.
• Billing and bookkeeping (legal obligation) — payment records are kept as Swedish accounting law requires.
• Security and abuse prevention (legitimate interest) — protecting accounts, guides and the platform.
• Communication (performance of contract / legitimate interest) — service messages and replies to your requests.

We do not use automated decision-making or profiling, and we do not sell personal data. QRiousStay is a tool for accommodation hosts and is not directed at children.

You decide what your published guest guides contain. If you choose to include personal data in a guide — for example a caretaker’s phone number — you are responsible for having the right to publish it. QRiousStay processes that content on your behalf in order to host, display and translate it.

About guests who open a guide, QRiousStay deliberately stores only the minimal statistics described above — no accounts, no names, no readable addresses.

• Stripe — payment and subscription processing. Your card details go directly to Stripe and never touch our servers.
• Microsoft Azure — application hosting, database, file storage, email delivery and automatic translation.
• Google — optional Google sign-in, and map functionality inside the app.
• OpenStreetMap (Nominatim) — converting accommodation addresses into map positions.

These providers process data on our behalf under data processing agreements. Where a provider processes data outside the EU/EEA, the transfer relies on safeguards approved under the GDPR, such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

We keep your data for as long as your account is active. If you ask us to delete your account, we delete or anonymise your personal data without undue delay, except where we must keep it — for example, accounting records are kept for seven years under Swedish bookkeeping rules.

You can download a copy of your data yourself at any time under Settings → Privacy & data → Export your data.

You can also close your account yourself under Settings → Closing your account. Closing ends your access, stops your guest guides working, cancels any subscription, and deletes or anonymises your personal data — subject to the records described under Retention above.

For all other requests, email contact@qriousstay.com — we respond without undue delay. Where processing is based on consent, you can withdraw it at any time.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

• Access
• Correction
• Erasure
• Restriction
• Objection
• Portability

QRiousStay sets no cookies. The host application stores only what it needs in your browser: the token that keeps you signed in, and your own choices such as interface language, appearance and how lists are displayed. We use no advertising cookies, no analytics and no third-party trackers.

Data is encrypted in transit, passwords are stored as secure hashes, and access to production data is restricted. No method of storage is perfectly secure, but we work to protect your data with appropriate technical and organisational measures.

If we make material changes to this policy, we will inform you in the application. The date above always shows the current version.