Privacy Policy
1. Who we are
The operator of the bookup.ge platform (hereinafter "BOOKUP") and the controller responsible for processing your data is VAIS LLC (identification code: 404706181; legal address: Krtsanisi Street 1/7, Tbilisi; email: info@bookup.ge).
This policy is based on the Law of Georgia on Personal Data Protection and the European Union's General Data Protection Regulation (GDPR).
2. What data we process
2.1. Guests
Registration data: name, email, phone number (optional), password (in irreversibly encrypted form, so that we cannot see it) and the date you accepted the terms.
Booking data: property, dates, price, booking status, the date and time you accepted the cancellation terms, and the cancellation reason.
Invoices that the system generates in the Host's name after the booking is confirmed.
Additional information, if the Host requests it (for example, driving licence details).
Reviews, support requests and messages that you write or receive on the platform.
2.2. Hosts and Co-hosts
Account data: name, email, contact phone number, password (in irreversibly encrypted form), the Host page address and name, and the logo (an uploaded file or a link).
Host details: legal form, legal name (an individual's full name or a company's name), personal number (individual) or identification code (legal entity) and bank account number (IBAN), for invoices and tax documents.
Listings: description, location, photos (uploaded files or links), prices and calendar.
Subscription and payment data: plan, subscription status and payment history. We do not store card numbers: card data is processed by the payment provider.
Co-hosts' email addresses and their permissions.
Registration source: if you reached the registration page through a link that carries advertising campaign tags (utm_ parameters), we keep those tags with your account. They show which advertisement or channel brought you to BOOKUP, and we use them only to measure the results of our marketing. Only BOOKUP's administrators can see them, and they are deleted when your account is closed.
2.3. All visitors
IP address and technical browser information: to protect the platform (including against bots) and keep it running reliably.
Interface language: kept in a cookie. For a signed-in user, the account's language is also stored with the account; it decides the language of emails, SMS and push notifications, and of the site after sign-in.
In the event of a technical error: a description of the error, the browser type and, if you are signed in, your account identifier.
If you are signed in and enable push notifications: your browser's technical address and browser type.
Messages sent through the site's contact form: name, email, subject and message text. We use them to answer you.
Analytics: only after you give consent (details in the Cookie Policy).
2.4. Signing in with Google
If you choose to sign in with Google, Google tells us your name, your email address, whether Google has confirmed that address, and an identifier for your Google account. We use them only to create your account and to sign you in. We do not receive your Google password, and we do not keep your profile picture or any access to your Google account. The link to your Google account is removed when your BOOKUP account is deleted.
3. Purposes and legal bases of processing
Creating an account, fulfilling bookings, sending notifications and the Host subscription: performance of a contract (GDPR, Article 6(1)(b)).
Platform security, preventing fraud and abuse, fixing technical errors and auditing actions: our legitimate interest (Article 6(1)(f)).
Measuring which advertising campaigns bring Hosts to the platform (the registration source, see 2.2): our legitimate interest (Article 6(1)(f)).
Keeping financial records and tax documents: a legal obligation (Article 6(1)(c)).
Analytics and push notifications: your consent (Article 6(1)(a)). You may withdraw your consent at any time.
4. Who we share data with
4.1. The Host. When you make a booking, the Host and their Co-hosts see your name, email, booking details and, if the Host requests it, additional information. Once the Host receives this data, the Host is independently responsible for processing it. After the booking is confirmed, the Guest sees the Host's name, identification code or personal number, and bank account on the invoice, and the Host's contact phone number and email.
4.2. Public information. Listings and Host pages are visible to all visitors. The review author's first name and the first letter of their surname (for example, "Nino B.") are also visible to all visitors.
4.3. Service providers. We use the following providers to operate the platform:
Railway Corp. (USA): servers and database. Data is stored in the European Union, in the Netherlands (Amsterdam).
Vercel Inc. (USA): website hosting. Requests are processed in the European Union, in Germany (Frankfurt).
Resend, Inc. (USA): sending email. The sending servers are located in Japan (Tokyo).
Cloudflare, Inc. (USA): domain services, bot protection (Turnstile), forwarding of email received at info@bookup.ge, and storage of photos and logos uploaded by Hosts (Cloudflare R2; data is stored in the European Union).
Functional Software, Inc. (Sentry, USA): logging of technical errors. Data is stored in the European Union.
Google (Google Ireland Limited, Google LLC): analytics (only with your consent), storage of email received at info@bookup.ge, and sign-in with Google, if you choose it (see 2.4).
Browser push services (Apple, Google, Mozilla): delivery of push notifications, if you enable them.
Photos and logos uploaded by Hosts are stored with Cloudflare R2. A Host may instead use a link to an image on another site; when you open such a page, your browser connects to that site.
4.4. Public authorities. We disclose data to public authorities only in cases provided for by law.
4.5. We do not sell your data to anyone.
5. Transfers of data to other countries
Some providers (for example, Resend, Cloudflare and Google) process data outside the European Union and Georgia. Such transfers are based on one of the following mechanisms: a European Commission decision on the adequate level of protection in a country (for example, Japan), the EU–U.S. Data Privacy Framework, or the European Commission's standard contractual clauses.
6. How long we keep data
Account data: for as long as the account is active.
Deletion of a Guest account: after the request, your name, email and phone number are usually deleted within 24 hours. If you have upcoming or active bookings, the request is carried out after they are completed or cancelled. Booking history remains in anonymised form, because it is part of the Host's records. Reviews and support requests also remain, without the author's name.
Closing a Host account on request: a Host may request closing their account in the account settings. From the request onwards, no new bookings are accepted, and bookings already made are served. The account is closed after the last stay ends, and until then the Host may withdraw the request. On closing, the Host's personal data, the photos and logos they uploaded, and their Co-hosts' email addresses are deleted; booking and invoice records are kept for the period established by law. The Host receives an email when the request is made and when the account is closed.
Host account: 12 months after suspension the account is closed, and the Host's personal data and the photos and logos they uploaded are deleted; we will notify you of this by email 30 days in advance and again 7 days in advance. Booking and invoice records are kept for the period established by law.
Identity document numbers that a Host requested for a booking: the Host stops seeing them 30 days after check-out. They remain stored with the booking, are disclosed only on an official request of a competent authority, and are deleted when the Guest's account is deleted.
Payment records and invoices: for the period established by the laws of Georgia.
Audit records (who performed which action, and when): 24 months.
Records of notifications sent: 12 months. The notification history in your account is kept for as long as the account exists and is deleted with it.
Messages sent through the contact form: 12 months.
Sign-in session: 30 days from the last activity.
Technical error records (Sentry): no more than 90 days.
Google Analytics data: 14 months.
Database backups: no more than one month. Deleted data disappears from backups once this period has passed.
7. Your rights
You have the right to:
receive information about which data we process, and obtain a copy of it;
request correction of inaccurate data;
request deletion of data;
request restriction of processing, or object to processing that is based on our legitimate interest;
receive the data you provided in a machine-readable format;
withdraw your consent at any time (for example, to analytics);
lodge a complaint with the Personal Data Protection Service of Georgia; users residing in the European Union also have the right to contact the data protection authority of their own country.
To exercise your rights, write to us at info@bookup.ge. We will respond to your request within one month. You can request deletion of your account from your account settings or by writing to info@bookup.ge. Before fulfilling a request, we may ask you to verify your identity.
8. Security
To protect data we use: irreversible encryption of passwords, encrypted HTTPS connections, separation of Hosts' data from one another at the database level, limits on the number of requests, and bot protection. In the event of a security incident, we will notify the relevant authority and you, as required by law.
9. Changes
If this policy changes, the new version will be published on the site. We will notify you of significant changes by email before they take effect.
10. Contact
VAIS LLC, Krtsanisi Street 1/7, Tbilisi. Email: info@bookup.ge