Last updated: 24 August 2026
This policy explains what personal data we collect when you use saristays.com, when you complete the legally required guest check-in at checkin.saristays.com, and when you message or call us before, during or after your stay, why we collect it, who we share it with and what you can do about it. It is written to meet Regulation (EU) 2016/679 (the GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
The controller is Valvest Capital Partners S.L.U., which operates SariStays.
Where this policy says “we”, “us” or “SariStays”, it means Valvest Capital Partners S.L.U.
Data you give us
To answer routine questions quickly, Anthropic’s Claude AI model reads these messages and helps draft our replies, and it powers the phone assistant. We also use Claude in our own administration: it helps generate booking statistics, prepare invoices and run operational checks, for example that your entry code was issued before your arrival (see sections 5 and 11).
Check-in registration data
Before arrival you complete the guest registration that Spanish law requires, at checkin.saristays.com (the GuestDock check-in platform, which processes this data on our behalf). There we collect:
To save you typing, Google’s Gemini AI model reads the printed text on the document photo and you confirm the extracted details yourself — see sections 5 and 11.
Payment data
Data collected automatically when you use the site
Data we receive from others
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Creating and managing your booking, blocking the calendar, and sending your confirmation and practical arrival information | Booking and account details | Performance of a contract — art. 6(1)(b) |
| Taking payment and preventing payment fraud | Payment reference, amount, method and outcome | Performance of a contract — art. 6(1)(b); legitimate interest in fraud prevention — art. 6(1)(f) |
| Answering your questions and providing support, including AI-assisted replies to routine messages and calls | Contact details, message content or call transcript, booking details | Performance of a contract — art. 6(1)(b) |
| Keeping invoices and accounting records | Booking and invoice data | Legal obligation — art. 6(1)(c) |
| Running our administration with AI assistance: booking statistics, invoice preparation and operational checks (for example that your entry code was issued before arrival) | Booking details, stay dates and amounts | Performance of a contract — art. 6(1)(b); legitimate interest in efficient administration — art. 6(1)(f) |
| Registering guests and reporting their details to the Spanish Ministry of the Interior (SES.HOSPEDAJES), as Royal Decree 933/2021 and Organic Law 4/2015 require | Check-in registration data | Legal obligation — art. 6(1)(c) |
| Verifying that the person checking in matches the booking and the presented document (AI-assisted document reading, and liveness detection where enabled) | Check-in registration data | Legal obligation — art. 6(1)(c); explicit consent for the facial scan — art. 9(2)(a) |
| Understanding how the site is used, finding faults and improving the booking flow, including session recordings | Usage, device, origin and error data | Consent — art. 6(1)(a) |
| Measuring which advertisements and campaigns lead to bookings | Origin and campaign data, the value of a completed booking, and a booking reference used to avoid double counting | Consent — art. 6(1)(a) |
| Sending you offers and newsletters, if you asked for them | Email address, name | Consent — art. 6(1)(a) |
| Protecting the site against abuse, and establishing or defending legal claims | Usage and booking data | Legitimate interest — art. 6(1)(f) |
Where we rely on your consent you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it. Where we rely on a legitimate interest, you have the right to object — see section 8.
A cookie is a small file placed on your device. We also use your browser’s local storage, which works in much the same way. These are the cookies this website places.
None of the analytics or advertising cookies below are placed unless you accept them. If you decline, or simply ignore the banner, we still count your visit, but without storing anything on your device: PostHog then derives a temporary identifier from your IP address and browser using a key that changes every day, which cannot be traced back to you and does not follow you from one day to the next. Session recordings and advertising measurement do not run at all in that case.
| Name | Placed by | Purpose | Lifetime |
|---|---|---|---|
ph_…_posthog | PostHog | Recognises your browser across pages and visits, so usage statistics and session recordings can be grouped into a single visitor. Only placed if you accept | 12 months |
_gcl_au | Links a click on a Google advertisement to a later booking, so advertising performance can be measured | About 90 days | |
__stripe_mid | Stripe | Payment fraud prevention. Placed when the payment step loads | 12 months |
__stripe_sid | Stripe | Payment fraud prevention within one session. Placed when the payment step loads | 30 minutes |
sb-…-auth-token | SariStays | Keeps you signed in. Only placed if you log in | Until you log out or the session expires |
| Local and session storage | SariStays and PostHog | Holds a discount code you applied during checkout, and the analytics identifier described above | Until you clear your browser storage |
Opening a page also sends your IP address to the providers that deliver parts of that page: Google (maps on the home, search and property pages), Stripe (the payment form) and Guesty (property photographs). That is unavoidable for those components to display.
You can delete cookies and block new ones in your browser settings. Blocking the payment and login cookies will stop the booking flow from working.
We do not sell your personal data. We use the providers below, each of which acts on our instructions under a data processing agreement unless stated otherwise.
| Provider | What they do | Where |
|---|---|---|
| Vercel Inc. | Hosts the website; our server-side code runs on Vercel infrastructure | United States |
| Supabase | Database and login system holding your account and booking data | European Union |
| Stripe | Processes your payment. Stripe is also an independent controller for fraud prevention and its own legal obligations | Ireland and the United States |
| Guesty | Property management system in which your reservation is created | United States |
| GuestDock (Landed B.V.) | Our own check-in platform (checkin.saristays.com), built and operated by our parent company Landed B.V., through which your identity document and registration details are collected and stored on our behalf | European Union and United States |
| PostHog | Usage statistics, error reporting and session recordings | European Union |
| Google Ireland Ltd. / Google LLC | Advertising conversion measurement and maps: receives campaign and click data and the value of a completed booking, not your name or email address. During check-in, Google's Gemini API additionally reads the photo of your identity document (and a short facial scan where liveness detection is enabled) as a sub-processor — see sections 2 and 11 | Ireland and the United States |
| Resend | Sends your booking confirmation and other transactional email | United States |
| Slack Technologies | Internal notifications to our team; a new-booking message contains your name and email address | United States |
| DeepL | Translates property descriptions and guest reviews into other languages | European Union |
| Anthropic, PBC | Provider of the Claude AI models that classify the messages you send us, help draft our replies and power our AI phone assistant, and that assist our administration (booking statistics, invoice preparation and operational checks); receives message or call content and the booking details needed for those tasks. Anthropic does not use this data to train its models | United States |
| ElevenLabs | Runs the speech technology behind our AI phone assistant: it converts your speech to text and back and passes the conversation to the Claude model; receives the call audio and transcript | United States |
| Telnyx | Telephone network that connects your call to our phone assistant, office or voicemail; receives your phone number and the call audio | United States |
| Railway | Hosts the services behind our guest messaging, our AI assistants and our internal administration; the containers holding that data run in the Amsterdam region | European Union (Amsterdam); provider established in the United States |
| Meta Platforms Ireland Ltd. | Carries the WhatsApp messages you exchange with us. Meta is not acting on our instructions here: it processes your messages and phone number as a controller under the WhatsApp terms you accepted | Ireland and the United States |
| Nuki Home Solutions GmbH | Creates the door code for your stay. It receives the booking reference and the period the code must work, not your name or contact details | Austria |
We are legally required to report the registration details of every guest (the identity document details collected at check-in) to the Spanish Ministry of the Interior through its SES.HOSPEDAJES system, under Royal Decree 933/2021 and Organic Law 4/2015. The Ministry is a public authority that processes this data under its own responsibility.
We also share data with the owner or manager of the property you booked, so far as needed to give you access to the accommodation, and with other public authorities, courts or professional advisers where the law requires it or where we need to establish or defend a legal claim.
Several of the providers listed above process data in the United States. That includes the servers running our own website code, so booking data is processed outside the EEA in the ordinary course of using this site.
These transfers take place under the European Commission’s standard contractual clauses, or because the provider is certified under the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards that apply to a particular provider by writing to support@saristays.com.
| Data | Retention |
|---|---|
| Booking, invoice and accounting records | 6 years after the stay, as required by Spanish commercial and tax law |
| Your account | Until you ask us to delete it; the underlying booking and invoice records are then kept for the period above |
| Guest check-in registration data (identity document details and document photo) | 3 years, as required by Royal Decree 933/2021 |
| Facial scan (liveness detection) | Deleted immediately after verification |
| Support correspondence, guest messages and phone-call transcripts | 6 years after the stay: they form part of the booking record and are kept for the same period as the records above |
| Usage statistics and error data | 84 months (7 years). This is statistical data about how the site is used, not a record about you personally |
| Session recordings | 30 days |
| Marketing consent and newsletter subscription | Until you withdraw it |
Under the GDPR you have the right to:
Write to support@saristays.com and we will respond within one month. We may ask you to confirm your identity first, so that we do not disclose your data to someone else.
If you are not satisfied with our response you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es), or to the supervisory authority in the EU country where you live.
Traffic to and from this website is encrypted. Access to booking data is limited to the people who need it for their work, and payment card details never reach our systems. No system is free of risk; if a breach occurs that is likely to result in a high risk to your rights, we will inform you and the supervisory authority as the GDPR requires.
The booking service is intended for adults. We do not knowingly create accounts for children under 16. Children can of course be included as guests in a booking made by an adult.
We do not take decisions about you by automated means that produce legal effects or similarly significantly affect you. Stripe applies automated fraud checks to payments; if a payment is refused on that basis, contact us and we will look at it ourselves.
During check-in, Google’s Gemini AI model reads the text on your identity document and, where liveness detection is enabled, compares your facial scan with the document photo. You review and confirm the extracted details yourself before they are saved, so no decision is taken by automated means alone. If you prefer not to use the AI-assisted reading, or verification fails, contact us and we will register your details manually.
Routine guest messages are answered with the help of Anthropic’s Claude AI model: it classifies your message and drafts a reply, which is sent automatically for common questions such as check-in times or directions. Anything unusual, and every complaint or emergency, is passed to a member of our team. Our AI phone assistant works the same way and tells you at the start of the call that you are speaking with an AI. If you would rather deal with a person, just say so in your message or call, or write to support@saristays.com. Claude also assists our administration (booking statistics, invoice preparation and operational checks); that work supports our team and takes no decisions about you.
This site links to websites we do not operate. We are not responsible for how they handle your data; their own privacy policies apply.
We update this policy when the way we handle data changes. The date at the top shows when it was last revised. Significant changes will be announced on the website.
Valvest Capital Partners S.L.U.
Carrer de Daniel Balaciart 4, Piso 1, Oficina 3
46020 València, Spain
CIF B09658493
support@saristays.com