Privacy Policy

1. Data Controller

Amistayapp is the controller of personal data processed on the platform, under art. 5, VI of the LGPD, and is responsible for decisions regarding the processing of that data.

2. Data We Collect

• Signup data: name, email, city, state, country, and preferred language.
• Invite chain data: who invited the user and which invites the user has generated.
• Listing data (Host): photos, address, property description, price, house rules.
• Booking data: dates, amounts, approval/payment status, messages exchanged in chat with another user.
• Payment data: processed directly by the payment provider (Stripe); Amistayapp only stores the data necessary for financial reconciliation and reporting, and never stores full card data.
• Review data: comments and ratings given after each stay.
• Report data: records of reports made or received by the user.
• Usage data: technical information about access to the platform (device, language, access logs).

3. Legal Bases for Processing

Amistayapp's processing of personal data relies on the following legal bases under art. 7 of the LGPD:

• Contract performance: to enable signup, booking, and payment between Host and Guest.
• Consent: for marketing communications and optional features.
• Legitimate interest: for fraud prevention, platform security, and service improvement.
• Compliance with a legal or regulatory obligation: for tax and accounting purposes related to processed payments.

4. Purpose of Processing

• Enabling account creation and invite-only access.
• Processing bookings, payments, and payouts between parties.
• Enabling communication between Guest and Host via chat.
• Displaying reviews and users' reputation history.
• Investigating reports and applying security measures, including account suspension or banning.
• Sending transactional communications (invite, booking request, approval, confirmation, cancellation, password recovery) in the user's language.
• Calculating and processing Representative Program commissions.

5. Sharing Data with Third Parties

Amistayapp shares personal data with the following third parties, to the extent necessary to provide the service:

• Stripe (payment processing): data necessary for charging, payouts, and splitting funds.
• Transactional email provider: contact data and communication content.
• A Representative linked to a booking: limited access to the data necessary to calculate their commission, without access to sensitive personal data of the Guest or Host.

Amistayapp does not sell personal data to third parties.

6. Data Retention

Personal data is kept for as long as necessary to fulfill the purposes described in this Policy, subject to the legal retention periods applicable to financial and tax data. Chat and review data is kept while the account remains active, and may be retained for an additional period for security and dispute resolution purposes.

7. Data Subject Rights

Under art. 18 of the LGPD, the user may request, at any time:

• Confirmation of whether their data is being processed.
• Access to the personal data processed.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary data or data processed in violation of the LGPD.
• Portability of data to another service provider.
• Deletion of data processed based on consent.
• Withdrawal of consent at any time.

Requests can be made through the contact channels listed in section 12.

8. Information Security

Amistayapp adopts reasonable technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or improper disclosure, including access control on the admin panel and encryption of sensitive data in transit.

9. International Data Transfer

Certain data may be processed outside Brazil by the payment provider (Stripe), including for currency conversion on bookings made by international guests. These transfers follow the protection mechanisms required by the LGPD for international data transfers.

10. Data of Minors

The platform is not intended for anyone under 18. Amistayapp does not intentionally collect data from minors, and if it identifies an account belonging to a minor, it will close that account.

11. Cookies and Similar Technologies

The Amistayapp site may use cookies for basic functionality, authentication, and usage analysis.

12. Data Protection Officer (DPO) and Contact

Questions, requests, or complaints related to this Privacy Policy can be sent to Amistayapp's Data Protection Officer at contato@amistayapp.com.

13. Changes to This Policy

This Policy may be updated periodically. Material changes will be communicated to users through the platform's official channels.