Privacy Policy
Last updated: 27 July 2026
Staylo helps you search hotels with transparent, AI-assisted scoring. This page explains what data we collect, why, how long we keep it, and your rights. We aim to collect the minimum data needed to run the service.
What we collect & why
- Account data (if you sign in): your email address. Sign-in uses Supabase Auth; if you set a password it is stored hashed by Supabase and we never see it. Magic-link sign-in is also available. Purpose: to give you an account, saved favorites, and sign-in.
- Searches: your search text, the parsed filters, language, and IP address. Purpose: to run and improve the search. Kept 30 days, then automatically deleted.
- Favorites: hotels you save, linked to your account. Purpose: to show your saved list. Kept until you remove them (or delete your account).
- Click logs: when you click “View on Booking”, we log the hotel, city, destination link, referral/UTM tags, and IP. Purpose: to measure referrals that fund the service.
- IP address: used briefly for rate-limiting and abuse prevention. Rate-limit records are deleted after 24 hours. (IP also appears in search logs, which expire after 30 days, and in click logs.)
- Analytics cookies (only with your consent): if you click Accepton our cookie banner, we load Google Analytics 4, which sets cookies to measure aggregate usage (pages, visits). If you Decline, no analytics cookies are set and Analytics does not load. You can decline at any time.
Who processes your data
We use trusted providers only for what’s needed: Supabase(database & auth), Vercel (hosting), Google (hotel data via Places API; Analytics if you consent), liteAPI/Nuitee (hotel availability), Mapbox (maps), and Cloudflare Turnstile (bot protection). We don’t sell your data.
Your rights (GDPR / KVKK)
You can access, correct, or delete your data. In the app you can remove any saved favorite at any time; search and rate-limit data expire automatically. To delete your account and all associated data, email us at privacy@staylo.tech and we’ll process it.
Data retention summary
Searches: 30 days · Rate-limit / IP records: 24 hours · Favorites & account: until you delete them · Click logs: retained to measure referrals.
Children: Staylo is not directed at anyone under 16.
Changes: we may update this policy; the date above reflects the latest version.