Privacy Policy

This Privacy Policy explains how Stayblox collects, uses, shares and protects personal information. Stayblox is a property management platform that gives hosts and property managers a reservation system (PMS), a booking engine, their own website, a guest CRM and an open ecosystem of apps and integrations. It should be read together with our Cookie Policy and our Terms of Service. If there is any conflict between this Privacy Policy and the Terms of Service in relation to personal information, this Privacy Policy governs.

By accessing or using our website and the Stayblox platform (together, the "Services"), you acknowledge that you have read and understood this Privacy Policy.

Who we are

The Services are operated by MAVA Design EOOD ("Stayblox", "we", "us" or "our"), a company registered in Bulgaria at Bukova polyana 112, Smolyan, Bulgaria, VAT BG204539189. For any privacy question or to exercise your rights, contact us at [email protected].

Who this policy applies to and our role

Different people interact with Stayblox in different ways, and our role under data-protection law (including the EU/UK General Data Protection Regulation, "GDPR") depends on who you are:

• Visitors to our marketing website (stayblox.com). We are the controller of the information described here.
• Account holders — the hosts, property managers, agencies and their staff who register for and use the platform. We are the controller of your account, billing and usage information.
• Guests and other contacts whose information an account holder stores or manages in Stayblox (for example, people who book through a host's website or are added to a host's guest CRM). For this information we act as a processor on behalf of the account holder, who is the controller. The host's own privacy notice governs how that data is used, and the host decides what is collected and why. We process it only to provide the Services and on the host's instructions.

Personal information we collect or process

"Personal information" means any information that identifies or is reasonably linked to an individual. Depending on how you use the Services, this may include:

• Account & profile information: full name, email address, password, company or property name, phone number, language preference, and any profile details or photos an account holder adds for themselves or their team.
• Billing & subscription information: plan, billing cycle, invoices, VAT/tax details and partial payment-card data. Card payments for your Stayblox subscription are handled by our payment processor; we do not store full card numbers.
• Team & access information: staff accounts, assigned roles (such as owner, manager or cleaner), custom permissions and, for agency accounts, owner-portal and per-client access.
• Property & website content: the properties, rooms, rates, availability, descriptions, pages, themes and files (including images in your media library) you create and publish through the website builder.
• Reservation & guest data (as a processor): guest names, contact details, stay dates, number of guests, room and rate details, special requests, notes and guest history stored in the reservation system and guest CRM, plus messages exchanged with guests. This data belongs to the account holder, who is its controller.
• Payment data for guest bookings: where an account holder connects a payment app, guest payment details are handled directly by that payment provider under its own terms. We receive only transaction status and limited reference data, not full card numbers.
• Communications & support: messages, enquiries, contact-form submissions and support requests you send us, and our replies.
• Device & usage information: IP address, browser and device type, operating system, pages viewed, referring pages, actions taken in the platform, and information collected through cookies and similar technologies (see our Cookie Policy).

Sources of personal information

• Directly from you, when you visit our site, register, subscribe, build your website, manage reservations, contact us or otherwise use the Services.
• From account holders, when a host adds guest, booking or team information to their workspace.
• From guests and visitors of a host's website, when they make or request a booking, including through an AI assistant (see "AI features and AI-bookable storefronts" below).
• Automatically, through cookies and analytics tools that help us operate and improve the Services.
• From service providers and connected apps, such as our hosting, email and payment providers, and the channel managers, payment apps and other integrations an account holder chooses to connect.

How we use personal information

We use personal information to:

• Provide and operate the Services, including the reservation system, booking engine, website builder, guest CRM, media library, reporting and team management.
• Process direct bookings made through an account holder's website, confirm availability in real time and record reservations.
• Process subscription payments, manage plans and trials, issue invoices and prevent payment fraud.
• Communicate with you about your account, bookings, support requests, service updates and important changes.
• Maintain security and integrity, authenticate users, detect and prevent fraud, abuse and unauthorised access, and back up data.
• Improve and develop the Services, understand how features are used, and troubleshoot problems, using aggregated or anonymised data where possible.
• Send marketing about Stayblox where you have consented or where permitted by law. You can opt out of marketing at any time.
• Comply with legal obligations, such as tax, accounting and reporting requirements, and to establish, exercise or defend legal claims.

Legal bases for processing

Where the GDPR applies and we act as a controller, we rely on the following legal bases: performance of a contract (to provide the Services you sign up for); legitimate interests (to secure, improve and promote the Services, balanced against your rights); consent (for non-essential cookies and certain marketing, which you can withdraw at any time); and legal obligation (for tax, accounting and similar duties). Where we act as a processor for an account holder, that account holder is responsible for the legal basis of the guest data it manages.

Apps, integrations and the developer API

Stayblox is built as a lean core that you extend with apps. When an account holder installs an app or connects an integration — for example a channel manager, a payment provider such as Stripe, a dynamic-pricing tool, a reviews app or an analytics tool — personal information may be shared with that provider so the integration can work. Some apps are built by Stayblox and others by third-party developers. We also offer a developer API (GraphQL) that, with the account holder's authorisation, lets approved applications access workspace data. Third-party apps and integrations process data under their own privacy policies and terms; the account holder is responsible for the apps it chooses to enable.

AI features and AI-bookable storefronts

Stayblox includes AI features, such as an AI assistant available on certain plans, and supports the Universal Commerce Protocol (UCP) so that every storefront is "AI-bookable". This means AI assistants and agents can discover a host's rooms, check live availability and place direct bookings on the host's behalf. When a booking is made through an AI assistant, we process the booking and guest details needed to confirm and record the reservation, in the same way as any other direct booking. We do not use the content of your guest data to train third-party AI models, and any AI providers we use act as our processors under appropriate contractual safeguards.

How we share personal information

We do not sell personal information. We share it only as described here:

• Service providers (sub-processors) who help us run the Services, such as cloud hosting and storage, email delivery, our subscription payment processor, customer-support tools and analytics providers. They may process personal information only on our instructions and under appropriate data-protection terms.
• Connected apps and integrations that an account holder enables, as described above.
• Account holders, who can access the guest, booking and team data within their own workspace.
• Guests, where information is shared to confirm a booking (for example, a confirmation sent to the email a guest provides).
• Legal and regulatory authorities, where required by law or to protect our rights, users or the public.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to the protections in this policy.

Cookies and similar technologies

We use cookies and similar technologies to enable core functionality (such as secure login and remembering your preferences), to understand how the site is used, and — only with your consent — for analytics and marketing. You can review and change your choices at any time. For full details, including the cookies we use and how to manage them, see our Cookie Policy.

International transfers

Stayblox is operated from the European Union, and we host data with providers in the EU where possible. Some of our service providers may process personal information in countries outside your own. Where we transfer personal information internationally, we put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses, to protect it.

Data retention

We keep personal information only as long as necessary for the purposes set out in this policy, to comply with legal, tax and accounting obligations, and to resolve disputes or enforce our agreements. For account holders, when a subscription ends your content becomes read-only and your workspace data is eligible for deletion after the period described in our Terms of Service. For guest data that we process on behalf of an account holder, retention is controlled by that account holder, and we delete or return it on their instruction or when our services to them end.

Data security

We use appropriate technical and organisational measures to protect personal information, including encryption of data in transit and at rest, access controls that limit access to authorised personnel, and regular review of our systems. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident, including notifying affected users and authorities where required by law.

Your rights

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you;
• Rectification — ask us to correct inaccurate or incomplete information;
• Erasure — request deletion of your personal information in certain circumstances;
• Portability — receive your information in a structured, commonly used, machine-readable format;
• Restriction or objection — restrict or object to certain processing, including direct marketing;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

Account holders can update much of their information directly in the platform and can delete their account from their account settings. To exercise any of these rights, contact us at [email protected]; we will respond within the time required by applicable law (generally within 30 days). You also have the right to lodge a complaint with your local data-protection authority — in Bulgaria, the Commission for Personal Data Protection (CPDP).

Guests and other data subjects of our customers

If your information is held in Stayblox because you booked with, or were added by, a host that uses our platform, that host is the controller of your data. To access, correct or delete your information, please contact the host directly. If you reach out to us, we will refer your request to the relevant host or assist them in responding.

Children's data

The Services are intended for businesses and are not directed at children under 16 (or the age required in your jurisdiction). We do not knowingly collect personal information from children. Account holders are responsible for any guest information they choose to store.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Services or for legal or operational reasons. When we do, we will revise the "Last updated" date at the top of this page and, where changes are material, take reasonable steps to notify you.

Contact

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us or email [email protected]. You can also write to us at MAVA Design EOOD, Bukova polyana 112, Smolyan, Bulgaria.