Privacy Policy

At Nuvastay, your privacy is not merely a legal obligation — it is a foundational pillar of the trust we build with every guest and host on our platform. Nuvastay S.L. ("Nuvastay", "we", "us", or "our") operates a luxury property rental marketplace connecting discerning travelers with exceptional residences worldwide.

This Privacy Policy describes how we collect, use, store, and protect your personal information when you access or use our website, mobile applications, and related services (collectively, the "Platform"). By using the Platform, you acknowledge that you have read and understood this policy. It applies to all users including guests booking accommodations, hosts listing properties, and visitors browsing our content.

We collect information you provide directly, including account registration data (full name, email address, phone number, date of birth, profile photo), identity verification documents such as government-issued ID or passport details, and payment information processed securely through our payment providers. We also collect messages exchanged between guests and hosts, support tickets, reviews, and property details provided by hosts.

We collect information automatically when you use our Platform, including device and browser data (IP address, device type, operating system, unique device identifiers), usage data (pages visited, search queries, booking history, session duration), and approximate or precise location data depending on your device permissions. When you connect via social login providers such as Google or Facebook, we receive basic profile information as permitted by those platforms.

We use your personal information to provide and improve our services — processing bookings, facilitating payments, enabling communication between guests and hosts, and delivering customer support. We verify your identity to prevent fraud and ensure our community remains safe and trustworthy.

We personalize your experience by recommending properties, tailoring search results, and surfacing relevant content based on your preferences and history. We send booking confirmations, receipts, reminders, and service-related notifications. With your consent, we may also send promotional communications. We use aggregated analytics to understand Platform usage and improve our features, and we retain records as required by applicable financial and legal regulations.

We do not sell your personal information. When a booking is confirmed, limited profile and contact information is shared between the relevant guest and host to facilitate the stay. We engage trusted third-party vendors including payment processors, cloud infrastructure providers, analytics tools, and customer support platforms who process data on our behalf under strict data processing agreements.

We may disclose information when required by law, court order, or governmental authority, or when necessary to protect the rights, property, or safety of Nuvastay, our users, or others. In the event of a merger, acquisition, or sale of Nuvastay's assets, your information may be transferred as part of that transaction, with prior notice to you. We may share information for any other purpose with your explicit consent.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy. Account data is kept for the duration of your account and up to five years after closure to comply with legal and tax obligations. Transaction records are kept for at least seven years in accordance with financial regulations. Communications between users are retained for up to three years after a booking to facilitate dispute resolution.

Usage and analytics data is typically aggregated and anonymized after 24 months. When data is no longer required, we securely delete or anonymize it in accordance with our data disposal procedures.

Depending on your location, you may have the right to access a copy of the personal data we hold about you, request correction of inaccurate information, request deletion of your data subject to legal exceptions, receive your data in a portable format, object to processing based on legitimate interests, and withdraw consent at any time without affecting prior processing.

To exercise any of these rights, contact us at privacy@nuvastay.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority. To opt out of promotional emails, use the unsubscribe link in any marketing communication or update your notification preferences in your account settings.

We use cookies and similar technologies to operate and improve the Platform. Strictly necessary cookies are essential for session management and security and cannot be disabled. Functional cookies remember your preferences such as language and login state. Analytics cookies help us understand how users interact with the Platform — data is aggregated and anonymized where possible. Marketing cookies, used with your consent, deliver relevant advertising and measure campaign performance.

You can manage your cookie preferences through your browser settings or the cookie consent tool in our Platform. Disabling certain cookies may affect the functionality of the Platform.

Nuvastay employs administrative, technical, and physical safeguards to protect your data against unauthorized access, alteration, disclosure, or destruction. All data in transit is encrypted using TLS 1.2 or higher, and sensitive data at rest is encrypted using AES-256. Access to personal data is restricted to authorized personnel on a need-to-know basis, and we conduct regular security assessments and penetration testing.

Payment information is processed by PCI DSS-compliant providers — Nuvastay does not store full card numbers. No method of electronic storage is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant authorities as required by applicable law.

Nuvastay operates globally and your data may be transferred to, stored, and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home country. When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to other countries, we rely on Standard Contractual Clauses approved by the European Commission, adequacy decisions by relevant authorities, or Binding Corporate Rules for intra-group transfers.

Our Platform may contain links to third-party websites, services, or integrations such as Google Maps, social sharing tools, and payment gateways. These third parties have their own privacy policies, and we encourage you to review them. Nuvastay is not responsible for the privacy practices of any third-party service.

When you choose to connect a third-party account (Google, Facebook) to your Nuvastay account, we receive information from those platforms as authorized by you. You may disconnect these integrations at any time from your account settings.

The Nuvastay Platform is not directed to children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a child under 18, please contact us at privacy@nuvastay.com and we will take steps to delete that information promptly.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will post a prominent notice on our Platform and send an email to the address associated with your account, updating the "Last updated" date at the top of this page.

Your continued use of the Platform after changes become effective constitutes acceptance of the revised policy. We encourage you to review this policy periodically.