Privacy Policy – Casa Maku

1. Who is responsible

• The owners named above are the data controller for everything described here. Write to info@casamaku.com with any question, or with any of the requests in section 9.

• This booking site, our calendar and your stay page run on Posadita (posadita.com), which processes your data only on our instructions, as our processor. Its own privacy policy at posadita.com/privacy sets out how it does that.

2. What we collect, and when

• When you ask to book: first and last name, email address, a phone number if you give one, arrival and departure dates, how many adults and children, anything you write in the message box, and the language you were reading the page in.

• When you pay by card: the payment is handled by Stripe and the card details go straight to them. We never see your card number — not the full number and not the last four digits. What we keep is the amount, the currency, the date and Stripe's own reference for the payment.

• Before you arrive, for the guest register Spanish law requires (section 5): full name, date of birth, sex, nationality, home address, and — for every guest aged 18 or over — the type, number, expiry date and issuing country of your passport or ID card, plus the número de soporte if it is a Spanish DNI or NIE. For a guest under 18 we record their relationship to an adult travelling with them.

• If you fill that form by photographing your document, the photo is sent to be read and is not saved anywhere, by us or by anyone on our behalf. Only the fields read out of it are kept, and you see and confirm them before they are.

• Messages you send us through this site or your stay page, and our replies. If you use the assistant on your stay page, the question you type.

• Technical records the site keeps in order to stay up and stay safe: your IP address and browser, and how many booking requests have come from one address.

• We run no analytics and no advertising trackers on this site.

3. Why we use it, and on what legal basis

• To give you what you booked — performance of our contract with you: holding and confirming the booking, taking payment, arranging your arrival, answering you, and preparing the flat for you.

• Because the law requires it — legal obligation: the traveller register under Real Decreto 933/2021, and invoicing and accounting records under Spanish tax law.

• To protect the flat and the booking — legitimate interest: keeping the site secure, refusing fraudulent or abusive bookings, dealing with damage or a deposit claim, and defending a legal claim if one is ever made.

• We do not send you marketing. If that ever changes, it will be something you have agreed to, with a way to stop it in every message.

4. Who else sees it

• Posadita, the system we run the flat on, and the companies it relies on: Supabase, which holds the database and the files on AWS in Frankfurt, Germany; Vercel, which serves this site from Frankfurt; Resend, which delivers the email we send you; and Anthropic, whose model reads a document photo and answers stay-page questions — under its terms that content is not used to train it.

• Stripe, for the payment. Stripe is responsible for your card data in its own right and under its own privacy policy.

• The Spanish authorities — see section 5.

• The people who look after the flat: the cleaner, and a tradesperson where something needs repairing. They are told your name, your dates and what they need in order to do the work, and nothing else.

• If you booked through Airbnb or Booking.com rather than here, that platform has its own privacy policy and passes us a limited part of your booking.

• We never sell your personal data, and we give it to nobody else unless a law or a court requires us to.

5. The guest register

• Real Decreto 933/2021 requires the owner of a tourist rental in Spain to record the details in section 2 for everyone staying and to file them with the Ministerio del Interior through its SES.HOSPEDAJES system, normally within 24 hours of arrival.

• It is an obligation on us rather than a choice either of us has: we cannot host you without it and we cannot leave a guest out on request.

• The register has to be kept for three years from the end of the stay. For that period this particular data stays with us even if you ask us to delete everything else.

6. Where your data is kept

• In the European Union: the database and the files in Frankfurt, Germany, and this site served from Frankfurt.

• Some of the companies named in section 4 are American — Vercel, Stripe and Anthropic. Where data reaches them it travels under the European Commission's standard contractual clauses and the data-processing terms each of them has signed.

7. How long we keep it

• Guest register data: three years, as section 5 requires.

• Booking, payment and invoicing records: as long as Spanish tax and accounting law requires them to be kept.

• Messages, your stay page and anything you wrote to us: while the stay is live and for as long afterwards as a question about it can still reasonably arise — then deleted.

• The photograph of your document: never stored, so there is nothing to delete.

• Technical security records: about 30 days.

8. Cookies

• Only the ones the site cannot work without: NEXT_LOCALE, which remembers the language you chose, and posadita_stay, which keeps you signed in to your own stay page.

• No analytics, advertising or profiling cookies — which is why this site never asks you to accept anything.

9. Your rights

• You can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to hand it to you in a portable form, or to object to the processing we base on legitimate interest. Where we have asked for your consent, you can withdraw it at any time.

• Write to info@casamaku.com. We will answer within one month.

• Deletion has one limit and it is the law's rather than ours: the guest register described in section 5.

• If you think we have handled your data badly, you can complain to the Spanish data protection authority — the Agencia Española de Protección de Datos, www.aepd.es — or to the authority in the EU country where you live.

10. Guests under 18

• Where a guest is under 18, we take their details from the adult travelling with them, who confirms they are entitled to give them. Section 5 requires those details as well.

• We do not knowingly collect personal data from a child directly.

11. Changes to this policy

• We update this policy when what we do with your data changes. The date shown at the top of the page is when it last changed, and the version on this page is the one that applies to your stay.