Privacy policy

Povilas Adomas Brukas (Individual activity certificate No. 1544921, Rasytes g. 30-52, Kaunas 48117, Lithuania) operates Bookeba and is the controller for owner accounts and for the running of the website. Contact for anything in this policy: hello@bookeba.com.

What we store: your email and password hash; the details you enter about your properties; the calendar links you paste (treated as secrets, never displayed back or logged); the Stripe account identifier and whether it can accept payments (never card or bank details — Stripe holds those); your subscription status; the contact email and phone you choose to show guests; and, for tax reporting, your legal name, address and tax identification number.

Why (legal basis): to provide the service you subscribed to (contract); to bill you (contract); to meet DAC7 tax-reporting and accounting duties (legal obligation); to keep the service secure and tell you about problems with your listings (legitimate interest).

How long: while your account is open, then as long as accounting and tax law requires for booking, payment and reporting records (up to ten years in Lithuania). Everything else is deleted when your account is closed.

When you book through an owner’s page, the owner is the controller of your booking data — they are the host you have a contract with — and Bookeba processes it on their behalf as a processor. Bookeba’s terms of service oblige owners to handle your data lawfully, and this policy describes what actually happens to it.

What is stored: your name, email, phone if given, the dates, number of guests and any requests you entered, the price you paid, and a private link to your booking. Card details go directly to Stripe and never reach Bookeba or the owner.

What is not shared: nothing about you is sent to Airbnb or Booking.com. The calendar links they read from us contain dates only — no names, no prices, no contact details.

Emails you get: the booking confirmation and any change or cancellation notice, sent on the owner’s behalf. No marketing.

How long: as long as the owner’s accounting duties require, typically ten years for the payment record; you can ask the owner or us to remove anything not needed for that.

We use a small number of providers to run the service. Each is bound by a data-processing agreement and only processes data for the purpose listed.

• Supabase (AWS) — Database, authentication and file storage. London, United Kingdom (AWS eu-west-2).
• Railway — Application hosting. EU/US data centres per Railway’s region settings.
• Stripe — Card payments, subscriptions and connected-account payouts. EU/US, under Stripe’s own data-transfer safeguards.
• Resend — Transactional email delivery. EU/US.
• Meta Platforms Ireland — Ads measurement, only for visitors who accept it on our marketing pages. Ireland, with transfers under Meta’s own EU standard contractual clauses.

Where a provider stores data outside the EU, the transfer relies on an adequacy decision (the United Kingdom) or on the EU standard contractual clauses in that provider’s agreement. We do not sell data. The only advertising tool is Meta’s ads measurement, described below, and it runs only for visitors who accept it.

To run the service Bookeba sets a sign-in session cookie for owners, a short-lived cookie during the Stripe connection flow, a cookie remembering the language you chose, and browser storage for your theme and sidebar preferences. On our public pages it also sets two first-party cookies: bookeba_ft, kept for 90 days, which records how you first found us (the campaign or the site that linked to us) and is never shared with anyone; and bookeba_consent, which remembers your answer to the cookie bar for six months. The cookie bar asks about one thing only, ads measurement by Meta, and it stays off unless you accept.

We count visits with a cookie-free counter that stores no IP addresses. To know which country a visit, or a new account, comes from, our own server looks the IP address up in a local copy of MaxMind’s GeoLite2 country database and keeps only the two-letter country code; the address is not sent anywhere and not stored. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

If you accept ads measurement on our marketing pages, Meta’s pixel loads and Meta Platforms sets its own cookies in your browser (_fbp, and _fbc when you arrive from a Meta ad). The pixel tells Meta that a page was viewed, that you opened the page we advertise, and that you asked us to set up your page or created an account. When you create an account, and when you publish your first property (which is what starts your trial), our server also reports it to Meta. Those server reports carry your email address, an identifier for your account and your country as one-way hashes, Meta’s two cookies, and — not hashed, because this is how Meta matches them — your IP address and your browser’s user-agent string. We do not keep the IP address: it lives only for as long as it takes to send the event and never reaches our database or our logs. We keep Meta’s cookies with your account and use them only while your acceptance stands. Nothing is loaded or sent before you accept, and the pixel is never loaded on your dashboard or on a guest booking page.

You can change your mind at any time with “Cookie settings” in the footer, and a choice lasts six months. If you decline, the site works exactly as before: our own cookie-free counter still counts the visit, and we still record which campaign brought you, which is our own first-party record and involves Meta in no way.

Under the GDPR you can ask for access to your data, correction, deletion, a copy in a portable format, or restriction of processing, and you can object to processing based on legitimate interest. Owners can export their account and bookings from Settings at any time, and close the account from Settings. Guests should contact the owner first (their details are in the confirmation) or write to us and we will coordinate.

We answer within one month. You can also complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or to the authority in your own country.

Data is encrypted in transit and at rest by our providers. Access to production data is limited to the people who run the service. Calendar links and booking links are unguessable random tokens; the private booking link is the only credential a guest has, so it should not be shared. If a breach ever affects you, we will tell you and the authority as the law requires.

We will post changes here with a new effective date and, for material changes, email owners in advance. See also the terms of service.