Privacy policy

Šapirum Property is operated by [[COMPANY LEGAL NAME]] ("Šapirum", "we"), a company in Sweden. Address: [[COMPANY ADDRESS]]. Organisation number: [[ORGANISATION NUMBER]].

For the data this policy describes, we are the controller, except for the data that hosts enter about their guests and team (see the next section).

Privacy questions: [[PRIVACY CONTACT EMAIL]]. Security reports: security@sapirum.com.

Data protection officer: [[DATA PROTECTION OFFICER: name and contact details, or a statement that none is appointed]].

A host who enters personal data about guests, co-hosts, cleaners or properties (for example a guest's first name or booking code, the dates and size of a stay, notes, photos of rooms and checklists) decides why and how that data is used. For that data the host is the controller and Šapirum is the host's processor, under a data processing agreement ([[DATA PROCESSING AGREEMENT: reference or link]]).

Guests do not have an account with us. If you stayed at a property whose host uses Šapirum Property and you have a question about your data, start with your host. If you are a co-host or a cleaner, start with the host who invited you. You are also welcome to contact us, and we will help.

We collect the following, and use it only for the purpose given.

• Access requests. Your name, email address, optional phone number and company, whether you are a host, a co-host or cleaner, or something else, your optional message, your language, and the fact that you confirmed you had read this policy. We use it to answer you.
• Accounts. Name, email address, optional phone number, preferred language, role (host, co-host, cleaner or platform admin), and sign-in security data such as a password hash and, if you turn it on, your two-step verification settings. We use it to give you access and keep the account secure.
• Stays and guests, entered by hosts and their teams. For each stay: the dates and times, the number of guests, the source (for example Airbnb, Booking.com or direct), a label that is a guest's first name or a booking code, and optional notes. A calendar imported from a channel brings dates and, at most, a reservation code: we do not keep guest names, phone numbers or other text from an imported calendar. We ask hosts to keep guest data to this, and not to enter guests' contact details, national identity numbers, payment details or other data that the service does not need. A cleaner sees the stay's dates, its label and the number of guests, but no guest contact details.
• Properties, checklists and photos. Property details, rooms, inventory, meter readings, documents (for example a permit or insurance) and checklists, with the answers, notes and photos that hosts, co-hosts and cleaners add, for example photos of rooms at a check-out inspection. Photos are stored without location or camera data. Hosts decide what to enter.
• Calendar links. The iCal link of a listing that a host connects. It is a secret, so we store it encrypted and never show it again. The export link we give a host carries anonymous blocked dates only: no names and no details.
• Security and technical records. Sign-in events (time, network address and browser type), password resets and error identifiers. We do not record passwords, sign-in links, calendar links or the contents of your messages in logs.
• Cookies and similar storage. Only the strictly necessary ones described in the cookie policy.

Under the GDPR we need a legal basis for each use of personal data. We rely on these:

• Contract. Providing accounts and the service to hosts and, through the host, to co-hosts and cleaners.
• Steps you ask for before a contract. Answering your access request.
• Legitimate interests. Keeping the service secure, preventing abuse, answering enquiries and improving the product, where your rights do not outweigh those interests. For the data that hosts enter about their guests and team, the host decides the legal basis.
• Legal obligation. For example accounting and security duties.

The tick box on the request form confirms that you have read this policy. It is not a request for your consent: we use the details to reply, on the bases above. You can ask us to stop using your details at any time.

We use a small number of service providers (processors) who handle data on our instructions:

• Resend sends our emails: sign-in links, password resets, invitations, notifications such as a turnover reminder or a changed stay, and the notification we receive when someone requests access. The recipient address and the message content pass through it. [[EMAIL PROVIDER: sending region and transfer safeguard]]
• [[HOSTING PROVIDER NAME AND LOCATION]] hosts the servers and storage where the service runs.
• Have I Been Pwned (Pwned Passwords) checks new passwords against a list of leaked ones. Only the first five characters of a one-way fingerprint of the password are sent, never the password itself or your identity.
• Map and address search. In the signed-in app, map tiles are loaded from OpenFreeMap, which means the tile server can see your network address. If address search is used, the text of the search is sent from our server, not your browser, to our geocoding provider ([[GEOCODING PROVIDER NAME]]).
• Booking channels (for example Airbnb and Booking.com). They are not our processors. When a host connects a calendar link, our server reads that link from the channel's servers, so the channel sees a request from our server for that listing's calendar. When a host shares an export link, the channel that imports it receives the blocked dates only. Each channel's own privacy policy applies to its data.

Inside a host's workspace, data is visible to the host and to the co-hosts and cleaners the host has given access to. A co-host sees the properties assigned to them; a cleaner sees only the turnover tasks of the properties assigned to them, with no guest contact details. People at Šapirum who run and support the platform can access data when it is needed to operate, secure or support the service; their access is limited to those who need it and is protected by mandatory two-step verification.

We do not sell personal data and we do not use it for advertising. We may disclose data if the law requires it.

Where the service is hosted is named in the list of service providers above. Some providers, for example for email delivery, may process data outside the EU and EEA, and the booking channels you connect have their own locations. Where we send data outside the EU and EEA we rely on safeguards recognised by EU law, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

[[INTERNATIONAL TRANSFERS: confirm which providers process data outside the EU/EEA and the safeguard used for each]]

We keep personal data only as long as we need it:

• Access requests: [[RETENTION: ACCESS REQUESTS, e.g. 12 months after our last contact]], then deleted.
• Accounts and workspace data, including stays, guest labels and photos: for as long as the host's agreement with us lasts. After it ends we delete or anonymise the data within [[RETENTION: AFTER ACCOUNT CLOSURE, e.g. 90 days]], unless the law requires us to keep something longer.
• Security and audit records: [[RETENTION: LOGS, e.g. 12 months]].
• Backups: if backups are kept, they are held on a rolling basis for [[RETENTION: BACKUPS, e.g. 14 days]], then overwritten.

Under the GDPR you can ask us to:

• give you access to your personal data and a copy of it;
• correct data that is wrong or incomplete;
• delete your data, where there is no good reason for us to keep it;
• restrict how we use your data, or object to use based on our legitimate interests;
• give you your data in a portable format; and
• stop using data that we use on the basis of your consent, at any time (this does not affect earlier use).

To use a right, write to [[PRIVACY CONTACT EMAIL]] and tell us what you would like: access, correction, deletion or another right. Our team handles these requests by hand; the app has no self-service export or deletion yet. We may ask you to confirm who you are, and we aim to reply within one month. If you are a guest, a co-host or a cleaner, we may pass your request to your host, who is responsible for the data they entered about you.

You also have the right to complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY, imy.se), or to the authority in the country where you live or work.

We protect data with the measures described on our security page. No system is perfectly secure. If a personal data breach puts you at risk, we will tell the people and authorities concerned as the law requires.

The service is meant for businesses and for adults who run, clean or look after rentals. It is not directed at children, and we do not knowingly collect their data.

We will update this page when our practices change and show the date at the top. For significant changes we will tell hosts and users in advance where we can.

Privacy: [[PRIVACY CONTACT EMAIL]]. Security: security@sapirum.com. Postal address: [[COMPANY LEGAL NAME]], [[COMPANY ADDRESS]].