Privacy Policy

Effective date: September 11, 2026

This Privacy Policy explains how personal data is collected, used, shared, and protected in connection with the bemyguest website, accounts, digital guest guides, and related services (together, the "Service").

The Service is operated by MANDARINO, obrt za informatičke usluge, vl. Giorgio Nikolov, an obrt (a Croatian sole proprietorship / registered trade business) established in Croatia, with its registered address at Ulica Giuseppea Tartinija - Via Giuseppe Tartini 12, 52210 Rovinj-Rovigno, Croatia, registration number MBO (matični broj obrta) 99365219, and VAT or tax number HR97152348356.

Privacy contact: hello@bemyguest.link

1. Scope

This Policy applies to:

• people who visit the bemyguest website;
• accommodation operators and their team members who create or manage accounts;
• guests who open or interact with a guest guide;
• people who contact support, request information, or communicate with us;
• personal data processed through AI-assisted and guest-assistant features.

Payment processing by Paddle is also subject to Paddle's own privacy notice. Third-party websites and services linked from the Service have their own privacy practices.

2. Our privacy roles

2.1 When we act as controller

bemyguest acts as a controller when we determine why and how personal data is used for purposes such as:

• creating and administering accounts;
• operating and securing the website and Service;
• providing customer support;
• communicating about subscriptions and product updates;
• service analytics and improvement;
• fraud prevention and legal compliance.

2.2 When we act as processor or service provider

Accommodation operators may enter personal data about guests, such as a guest's name, stay dates, or welcome message.

For this customer-provided guest data:

• the accommodation operator normally acts as the controller or business;
• bemyguest normally acts as the processor or service provider;
• we process the data on the operator's documented instructions to provide the Service.

Guests should normally direct requests concerning data placed in a guide to the accommodation operator that created the guide. Guests may also contact us at hello@bemyguest.link, and we will assist or forward the request where appropriate.

The Data Processing Addendum is available here.

3. Personal data we collect

Depending on how the Service is used, we may collect the following categories.

3.1 Account and profile data

• name;
• email address;
• password-related authentication records, where applicable;
• profile photograph or avatar;
• language and account preferences;
• organisation, accommodation, or business name;
• account role and team membership.

Authentication credentials are stored in protected or hashed form by our authentication provider. We do not have access to a readable copy of your password.

3.2 Property and guide content

• property name, address, coordinates, and directions;
• property and entrance photographs;
• arrival, parking, check-in, and checkout information;
• Wi-Fi details;
• access or door codes;
• house rules and policies;
• appliance instructions;
• local recommendations, notes, activities, events, and collections;
• services or extras offered to guests;
• welcome messages and other Customer Content.

Some of this information may relate to an identifiable owner, manager, employee, contractor, neighbour, or other person.

3.3 Guest data provided by an accommodation operator

• guest name;
• stay dates;
• personalised welcome message;
• guest email address or phone number, if the operator provides it;
• guide access details or identifiers;
• preferences or other information the operator chooses to enter.

Accommodation operators must not submit unnecessary sensitive personal data.

3.4 Guest-guide interaction data

When a guest opens or uses a guide, we may collect:

• IP address;
• browser type and version;
• device type and operating system;
• approximate location derived from IP address;
• date and time of access;
• pages, sections, buttons, and links used;
• referral and error information;
• guide identifier and session information.

3.5 AI and assistant data

When an AI feature is used, we may process:

• prompts and questions;
• relevant property and guide content;
• generated responses;
• feedback on generated content;
• technical metadata needed to provide and secure the feature.

AI chat or prompt retention: guest-assistant conversations are stored to keep the conversation going within a session. Accommodation operators do not currently have a dashboard feature to view guest chat transcripts. These logs are not yet subject to a fixed deletion schedule and are retained until a scheduled deletion process is introduced.

Do not include sensitive personal data, financial information, health information, government identifiers, or confidential access credentials in prompts unless strictly necessary, lawful, and appropriately protected.

3.6 Support and communication data

• messages sent to support;
• account verification information;
• survey, feedback, and research responses;
• records of requests, complaints, and resolutions;
• email-delivery and engagement information, where lawful.

3.7 Subscription and transaction data

Paddle processes payment-card and payment-method information as Merchant of Record.

We may receive from Paddle:

• buyer name and email;
• billing country and tax-related information;
• plan, price, and currency;
• transaction and subscription identifiers;
• payment, renewal, cancellation, and refund status;
• limited fraud and dispute information.

We do not receive or store complete payment-card numbers.

3.8 Cookies and similar technologies

We use essential technologies needed for:

• authentication;
• security;
• session management;
• load balancing;
• user preferences;
• subscription and checkout functionality.

Analytics status and provider: Vercel Analytics

Cookie consent provider: none — the Service does not currently set non-essential cookies

Where required by law, non-essential cookies or similar technologies will be used only after consent. You can change available choices through the cookie settings link.

We do not use personal data for targeted advertising unless this Policy and the consent interface are updated before such use begins.

4. How we obtain personal data

We obtain data:

• directly from account holders, guests, and people who contact us;
• from accommodation operators who create guest guides;
• automatically from devices and browsers;
• from Paddle in connection with subscription transactions;
• from authentication, hosting, database, email, analytics, map, AI, and support providers;
• from public or licensed place-information sources when creating recommendations.

5. Why we use personal data and our legal bases

The legal basis depends on the data, purpose, and country.

5.1 Provide and administer the Service

We use account, guide, transaction, and usage data to:

• create and manage accounts;
• display and share guest guides;
• personalise guides;
• provide requested features;
• administer subscriptions;
• respond to support requests.

Legal bases may include performance of a contract, steps requested before entering a contract, and our legitimate interest in providing the Service.

5.2 Process guest data for customers

We process customer-provided guest data to provide the Service under the accommodation operator's instructions.

The accommodation operator is responsible for identifying its own lawful basis, which may include performance of an accommodation contract, legitimate interests, consent, or another basis available under applicable law.

5.3 Secure and protect the Service

We use account, device, log, and activity data to:

• authenticate users;
• detect abuse, fraud, malware, and unauthorised access;
• investigate incidents;
• protect guests, customers, the Service, and third parties.

Legal bases may include legitimate interests and compliance with legal obligations.

5.4 Improve and develop the Service

We may analyse usage, errors, feedback, and de-identified or aggregated information to:

• understand feature use;
• fix problems;
• improve usability;
• develop new functionality;
• measure performance.

The legal basis is generally our legitimate interest in maintaining and improving the Service. Where consent is required for analytics technologies, we rely on consent.

5.5 Communicate with you

We may send:

• service and security notices;
• subscription and billing information;
• support responses;
• changes to policies or features;
• product updates and marketing where permitted.

Transactional communications are based on contract, legal obligations, or legitimate interests. Marketing is based on consent where required, or another lawful basis permitted by local law.

You can unsubscribe from optional marketing, but not from necessary service, security, or transaction messages.

5.6 Comply with law and protect rights

We may process data to:

• meet legal, accounting, tax, and regulatory obligations;
• respond to lawful requests;
• establish, exercise, or defend legal claims;
• enforce agreements;
• protect people and property.

Legal bases include compliance with law and legitimate interests.

5.7 Consent

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal.

6. How we share personal data

We may share personal data with the following categories of recipients.

6.1 Service providers

Core service providers may include:

• Paddle for checkout, subscription billing, tax, fraud prevention, and refunds;
• Supabase for database, authentication, storage, and backend infrastructure;
• Vercel for web hosting, delivery, and analytics;
• OpenAI or another listed AI provider for AI-assisted features;
• Resend for transactional email;
• map, place-information, activity, and travel-data providers used by enabled features;
• support, security, and professional-advisory providers.

We do not currently use a dedicated error-monitoring provider. A current subprocessor list is available in Annex 3 of our Data Processing Addendum.

Service providers may process data only for agreed purposes and subject to appropriate contractual duties.

6.2 Accommodation operators and their authorised users

Guest interactions and requests may be visible to the operator that created the guide and authorised team members, depending on the feature configuration.

AI assistant conversation visibility: accommodation operators do not currently have a dashboard feature to view guest chat transcripts.

6.3 Guests and people with a guide link

Content placed in a guest guide is displayed to people who have the link or other access credentials.

Accommodation operators control what content is published. A forwarded link may allow another person to view the guide. Do not treat a standard link as equivalent to a highly secure private vault.

6.4 Legal, safety, and compliance disclosures

We may disclose data where reasonably necessary to:

• comply with law, court orders, or lawful authority requests;
• protect legal rights;
• investigate fraud, abuse, or security incidents;
• protect a person from serious harm;
• enforce our agreements.

6.5 Business transfers

If the business or Service is reorganised, financed, sold, merged, or transferred, personal data may be disclosed to advisers, potential counterparties, and a successor, subject to appropriate confidentiality and legal safeguards.

6.6 With your direction or consent

We may share data when you direct us to do so or give valid consent.

7. Public and link-accessible guide content

A guest guide may contain property details, personal messages, guest names, stay dates, photographs, or access information.

Depending on the configuration, anyone with the link may be able to view that content.

Accommodation operators should:

• include only information needed for the stay;
• avoid unnecessary personal or sensitive data;
• use guest-specific or expiring links where available;
• regenerate or disable links when appropriate;
• remove or change access codes after the stay where reasonably possible;
• avoid posting permanent credentials in broadly shared guides.

Guests should avoid forwarding personal guide links or publishing screenshots containing private information.

8. International data transfers

The Service is available worldwide and uses providers that may process data in more than one country.

Primary hosting and processing regions: Supabase (database, authentication, storage) is hosted in the EU West region (Ireland). Vercel (hosting and delivery) operates a global edge network with primary regions in the EU and US.

Where personal data is transferred outside the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with transfer restrictions, we use an approved mechanism where required, such as:

• an adequacy decision;
• standard contractual clauses;
• the UK International Data Transfer Agreement or UK Addendum;
• another lawful safeguard or exception.

You may request more information about relevant safeguards by contacting hello@bemyguest.link.

9. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including legal, security, accounting, and dispute requirements.

Current retention periods:

• active account data: for the life of the account;
• account data after closure: deleted within 30 days after account closure;
• deleted data in backups: removed within 90 days after deletion from active systems;
• security and technical logs: retained for 90 days;
• guest names, stay dates, and personalised guide data: deleted immediately when the associated guide or account is deleted;
• AI prompts and assistant conversations: retained to maintain conversation history within a session; not currently subject to a fixed deletion schedule;
• billing and transaction records: as required by Paddle and applicable accounting, tax, and legal obligations;
• support records: retained for 2 years.

We may keep data longer where required by law, necessary to resolve a dispute, or needed to prevent fraud or abuse.

Aggregated or irreversibly de-identified information may be retained without the same time limits.

10. Data security

We use reasonable technical and organisational measures designed to protect personal data, including access controls, encryption in transit, managed infrastructure, logging, backups, and security monitoring where appropriate.

No online service is completely secure. We cannot guarantee that unauthorised access, loss, misuse, or disclosure will never occur.

Account holders are responsible for using strong credentials, limiting team access, protecting guest links, and keeping access information current.

If we become aware of a personal-data breach, we will investigate and provide notifications required by applicable law.

11. Your privacy rights

Depending on your location and the context, you may have rights to:

• request access to personal data;
• correct inaccurate data;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests;
• receive portable data;
• withdraw consent;
• opt out of certain marketing;
• lodge a complaint with a data-protection authority;
• appeal a refusal where local law provides an appeal right.

To make a request, email hello@bemyguest.link.

We may need to verify your identity and authority. We will not require more information than reasonably necessary for verification.

If your request concerns data placed in a guide by an accommodation operator, we may refer the request to that operator and assist them as required.

You may also complain to the supervisory authority in your country. Our lead supervisory authority is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), azop.hr.

12. European Economic Area, United Kingdom, and Switzerland

If the GDPR, UK GDPR, or Swiss data-protection law applies, the sections above describe:

• the controller's identity and contact details;
• purposes and legal bases;
• categories of recipients;
• international transfers;
• retention;
• rights and complaint options.

Data Protection Officer: Not applicable

EU representative: Not applicable — the operator is established in Croatia (EU)

UK representative: Not applicable

No solely automated decision described in this Policy produces legal or similarly significant effects about account holders or guests.

13. United States privacy disclosures

State privacy laws may provide eligible residents with rights to know, access, correct, delete, or obtain a copy of personal data, and to opt out of certain sales, sharing, targeted advertising, or profiling.

We do not sell personal data for money.

We do not share personal data for cross-context behavioural advertising or use it for targeted advertising unless this Policy and the relevant privacy controls are updated before that activity begins.

We do not discriminate against a person for exercising an applicable privacy right.

Where legally required, an authorised agent may submit a request, subject to verification of authority and identity.

The categories collected, sources, business purposes, and recipients are described in Sections 3 through 6.

14. Children

Accounts are not intended for anyone under 18.

The Service is not directed to children under 13, and we do not knowingly collect personal data directly from children under 13.

An accommodation operator may include information about a travelling party that includes a child. The operator is responsible for ensuring that any such processing is lawful, necessary, and appropriately disclosed.

If you believe a child provided personal data directly to us without appropriate permission, contact hello@bemyguest.link.

15. Third-party links and embedded services

Guest guides may link to maps, restaurants, booking services, review platforms, activities, transport providers, and other third parties.

When you interact with a third party, that party may collect data under its own privacy policy. We do not control its privacy practices.

16. Changes to this Policy

We may update this Policy when the Service, law, or our processing practices change.

We will publish the revised version and update the effective date. Where required, we will provide additional notice or request consent.

17. Contact

Controller or operator: MANDARINO, obrt za informatičke usluge, vl. Giorgio Nikolov
Registered address: Ulica Giuseppea Tartinija - Via Giuseppe Tartini 12, 52210 Rovinj-Rovigno, Croatia
Country: Croatia
Registration number: MBO (matični broj obrta) 99365219
VAT or tax number: HR97152348356
Privacy email: hello@bemyguest.link
Support email: hello@bemyguest.link
Privacy request method: email