Privacy and personal data

Who controls the data

The legal operator and privacy contact are shown at the top of this page when configured by the service administrator. Public registrations should remain disabled until these details are complete.

Data we process

Account data can include name, email address, authentication identifiers, role and login timestamps. Host workflows can also include property claims, offers and information supplied to manage a listing.

First-party analytics can record page paths, a random session identifier, referrer host, campaign parameters, locale, device category and coarse location supplied by the hosting edge. BnB.city does not intentionally store the visitor IP address in the analytics table.

If notifications are enabled, the service stores the browser push endpoint and cryptographic subscription keys required to deliver notifications.

Why we process it

Data is used to provide authentication, saved items, host tools, property claims, service security, operational analytics and communications requested by the user. Marketing communications require a separate opt-in and can be withdrawn.

Service providers

BnB.city currently relies on infrastructure providers including Vercel for application hosting and Supabase for database and authentication services. Additional processors must be listed here before they are used for production marketing or other personal-data workflows.

Retention and rights

Data is retained only for as long as needed for the service, legal obligations, security and dispute handling. Users can request access, correction, deletion, restriction or withdrawal of optional consent through the privacy contact published on this page.