Privacy Policy — GetAll Guide

1. Who we are

ASQUARED SRL, a company incorporated in Romania, operates GetAll Guide.

Registered office: Brasov, Romania
Trade Register number: J2024032303003
Sole registration code (CUI): RO50719801
Contact for privacy matters: hello@getallguide.com

We have not appointed a Data Protection Officer, because we are not required to. Privacy questions go to the address above and are answered by a person.

2. The two roles we play

This is the most important thing to understand about how data flows through GetAll Guide, because it determines who is responsible for what.

For host account data, we are the controller. We decide why and how we process the data of the people who sign up.

For guest data, the host is the controller and we are the processor. A host decides whether to collect anything from guests, what to collect, why, and for how long to keep it. We store and present it on the host’s instructions. We do not decide what happens to it, we do not use it for our own purposes, and we never sell it or use it for advertising.

If you are a guest and want to exercise your rights over your data, contact the host who sent you the link. If you cannot reach them, write to us and we will pass the request on and help where we can.

3. Host data: what we process and why

Data	Why	Legal basis
Name, email address, password (stored hashed by our authentication provider)	To create and secure your account	Performance of a contract, Art. 6(1)(b)
Google account identifier, name, email and profile image, if you sign in with Google	To let you sign in without a separate password	Performance of a contract, Art. 6(1)(b)
Property details, guide content, uploaded images and video	To provide the Service	Performance of a contract, Art. 6(1)(b)
Billing name, address, country, tax identification number, subscription status and history	To take payment, apply the correct VAT, and keep accounting records	Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c)
Account activity: sign-in times, last seen, actions taken in the application	To keep the account secure, prevent abuse, and support you	Legitimate interests, Art. 6(1)(f)
Technical data: IP address, browser and device information, in server logs	Security, abuse prevention, diagnosing faults	Legitimate interests, Art. 6(1)(f)
Emails you send us	To answer you, and to keep a record of what was agreed	Legitimate interests, Art. 6(1)(f)

Where we rely on legitimate interests, our interest is in operating a secure, functioning service and defending it against abuse. We have considered your rights and consider these uses to be within your reasonable expectations.

We do not use your data for advertising, we do not sell it, and we do not profile you or take automated decisions that produce legal effects for you.

4. Payment data

Payments are processed by Stripe. Card numbers are entered on Stripe’s own checkout page. We never receive, handle or store your card details. We receive the outcome of the payment, the subscription status, and the billing details needed for invoicing and tax.

5. Guest data: what the Service can process

What follows is processed on the instructions of the host. Not all of it applies to every host: several of these are switched on only if the host chooses.

Always, for a booked stay: the guest’s name as the host enters it, the dates of the stay, the number of guests, and the room where the host uses rooms.

If the host asks for arrival times: the arrival time the guest gives and any note they add.

If the host switches on guest registration: full name, date of birth, place of birth, nationality, residency status, document type, document series and number, personal numeric code (CNP) where Romanian law requires it for that document, and home address. The guest may instead photograph their identity document, in which case we store the photograph.

If the host uses cleaner links: the checklist entries, notes and photographs a cleaner submits.

Aggregate counts: how many times a guide link was opened, when it was last opened, and how many times each section was opened. These are plain counters. We do not build a profile of any guest, we do not record who opened what, and we do not log guest IP addresses against a guide.

Guests never create accounts, are never asked for a password, and are never tracked across websites.

5.1 The legal basis for guest data belongs to the host

The host decides why guest data is collected and on what legal basis. For guest registration this is usually a legal obligation in the host’s country — in Romania, the obligation to record the arrival and departure of tourists. Hosts are responsible for telling their guests what is collected and why, and for not collecting more than they need.

6. Special protection for identity data

Where a host uses guest registration, we apply specific safeguards, because this data is sensitive in practice even where it is not “special category” data under Article 9 GDPR:

Encryption at rest of the most sensitive fields. The document number, the CNP and the home address are encrypted with AES-256-GCM before they are written to the database.
Private storage for document photographs. They are held in a private bucket, are never publicly readable, and are shown to the host only through short-lived signed links.
Server-side access only. Guest data is read on our servers. A guest’s browser never holds a credential to our database.
Automatic deletion. Identity submissions carry a deletion date and are purged automatically — see section 8.
No third-party enrichment. Identity data is never sent for translation, never sent to any analytics service, and never used to train any model.

Processing of the CNP is subject to Article 87 GDPR and to Romanian Law 190/2018. The measures above are applied specifically to meet that requirement. Hosts must not use the registration feature to collect a CNP where they have no legal basis to do so.

7. Reveal-gated content

Where a host sets a reveal time on a section — typically a door code — that content is withheld on our servers until the reveal moment. It is not sent to the guest’s device and hidden there. Before the reveal time, it is not present in the page at all.

8. How long we keep things

Data	Retention
Host account and guide content	For as long as the account is open, then deleted within 90 days of closure
Guest identity submissions	A period the host sets, from 1 to 365 days after check-out; 30 days by default. Deleted automatically after that
Document photographs	Deleted together with the submission they belong to
Stay records and guest links	For as long as the property exists, unless the host deletes them
Aggregate open counts	For as long as the stay record exists
Invoices, payment and accounting records	10 years, as Romanian accounting and tax law requires
Server and security logs	Up to 12 months
Backups	Overwritten on a rolling cycle, normally within 30 days
Record of your acceptance of our terms	For as long as the account is open, and for 3 years afterwards, as evidence of the contract

Deletion from live systems is immediate. Deletion from backups happens when the backup expires on its cycle.

We do not sell personal data. We share it only with the providers below, each of which processes it on our instructions, under a contract that meets Article 28 GDPR.

Provider	What it does	Where
Google Ireland / Google LLC (Firebase Authentication, Cloud Firestore)	Sign-in, and the database holding account, guide, stay and guest data	EU, with possible access from the United States
Scaleway SAS	Object storage for images, video and identity document photographs	France
Vercel Inc.	Hosting and delivery of the application	EU region, with possible access from the United States
Stripe Payments Europe Ltd / Stripe Inc.	Payment processing, invoicing, tax calculation	EU, with possible access from the United States
DeepL SE	Machine translation of guide text, only where a host uses the translation feature	Germany

DeepL receives guide content only. Identity data, guest names and stay details are never sent for translation.

We may also disclose data where we are legally required to, to a public authority acting within its powers, or to establish, exercise or defend legal claims. If we are ever compelled to disclose data, we will tell the affected host unless the law forbids it.

If our business is sold or merged, data may transfer to the buyer, who will remain bound by this policy or by one no less protective. We will tell you before that happens.

10. International transfers

Our providers are established in the EU or process data in the EU. Some of them are part of groups with entities in the United States and may allow access from there for support and infrastructure purposes.

Where personal data is transferred outside the European Economic Area, it is protected by an adequacy decision of the European Commission — including the EU–US Data Privacy Framework where the recipient is certified — or by the European Commission’s Standard Contractual Clauses together with any additional measures needed. You can ask us for details of the safeguards applying to a particular transfer.

11. Cookies and similar technologies

We do not use advertising cookies, analytics cookies, tracking pixels or third-party trackers, on the website or in the application. There is no consent banner because there is nothing to consent to.

We use:

A session cookie in the application, which keeps you signed in. It is strictly necessary, is httpOnly and sameSite, and expires after 14 days.
Local storage on a guest’s device, where a guest’s browser saves a guide so it works offline. That copy lives on the guest’s own device and is never sent to us.

Strictly necessary cookies do not require consent under Article 5(3) of the ePrivacy Directive.

This section is the written contract required by Article 28(3) GDPR between a host, as controller, and us, as processor, for Guest Data. It takes effect when the host accepts our Terms of Service, and lasts as long as we process Guest Data for that host.

12.1 Subject matter and duration. We process Guest Data to provide the Service, for as long as the host’s account is open, subject to the retention periods in section 8.

12.2 Nature and purpose. Storing, organising, presenting, exporting and deleting guest information so that the host can run their property and meet their own record-keeping obligations.

12.3 Types of data and categories of data subject. The data described in section 5, relating to the host’s guests and any cleaner the host gives access to.

12.4 Instructions. We process Guest Data only on the host’s documented instructions, which include the settings the host chooses in the application and these terms, unless we are required to process it by EU or Member State law. If we are so required, we will tell the host first unless the law forbids it. We will tell the host if, in our opinion, an instruction infringes data protection law.

12.5 Confidentiality. Everyone we authorise to process Guest Data is bound by an obligation of confidentiality.

12.6 Security. We implement the measures described in section 13.

12.7 Sub-processors. The host gives general authorisation to the sub-processors listed in section 9. We will give at least 30 days’ notice before adding or replacing one, by email or in the application. A host who objects on reasonable data protection grounds may terminate the affected part of the Service before the change takes effect, and we will refund any unused prepaid fees for that part. We remain liable for our sub-processors’ performance.

12.8 Assisting the host. Taking into account the nature of the processing, we will assist the host by appropriate technical and organisational measures in responding to requests from data subjects, and will assist with security, breach notification, data protection impact assessments and prior consultation, so far as the information is available to us.

12.9 Breach notification. We will notify the host without undue delay after becoming aware of a personal data breach affecting Guest Data, with the information the host needs to meet its own obligations.

12.10 Deletion and return. On the host’s instruction, and on termination, we delete Guest Data in accordance with section 8. The host can export stay and registration data from the application at any time while the account is open.

12.11 Audit. We will make available the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits by the host or an auditor the host mandates. Audits must be at reasonable notice, no more than once a year unless a breach or a supervisory authority requires otherwise, must not disrupt the Service, must respect the confidentiality of other customers’ data, and are at the host’s cost.

13. How we protect data

Access to the database is server-side only. Client access rules deny all direct access by default.
Guest-facing links use unguessable tokens, expire automatically after check-out, and can be revoked at any time by the host.
The most sensitive identity fields are encrypted at rest with AES-256-GCM.
Identity document photographs are stored in a private bucket and served only through short-lived signed links.
Passwords are never stored by us in readable form; authentication is handled by Google Firebase.
Transport is encrypted with TLS. Security headers, a content security policy and rate limiting are applied.
Administrative access is restricted to named accounts, and every administrative action is written to an append-only audit log. Guest registration data is never displayed in our internal administration tools.

No system is perfectly secure. We cannot guarantee absolute security, and hosts must play their part by keeping credentials safe and issuing links only to the people who should have them.

14. Your rights

If we are the controller of your data — that is, if you are a host — you have the right to:

access the personal data we hold about you, and receive a copy;
rectify data that is inaccurate or incomplete;
erase your data, where one of the grounds in Article 17 applies;
restrict processing in the circumstances set out in Article 18;
portability: receive data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
object to processing based on legitimate interests, on grounds relating to your particular situation;
withdraw consent at any time, where we rely on consent, without affecting processing carried out before withdrawal.

Write to hello@getallguide.com. We will respond within one month. We may extend that by two further months for complex requests, and will tell you if we do. We may ask you to confirm your identity before we act. Exercising these rights is free, unless a request is manifestly unfounded or excessive.

If you are a guest, the host who issued your link is the controller. Contact them. We will help them respond, and will pass on any request you send us.

15. Complaints

If you are unhappy with how we handle your data, please tell us first.

You also have the right to complain to a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP), whose details are published at dataprotection.ro. You may also complain to the authority in the EU country where you live or work.

16. Children

The Service is not directed at children and we do not knowingly collect data from anyone under 18 through a host account. A guest’s details may include a minor travelling with their family, where the host’s legal obligations require it; that data is the host’s responsibility as controller and is subject to the same protection and deletion rules as any other identity submission.

17. Changes to this policy

We may update this policy. The version number and effective date at the top of this page always show the current version. Where a change materially affects how we process personal data, we will notify hosts by email or in the application at least 30 days before it takes effect, unless a shorter period is required by law.

18. Contact

Questions, requests and complaints: hello@getallguide.com.