Privacy Policy
Effective as of 31 July 2026
This policy explains what personal data Quietaway processes, why, and what rights you have. We only describe what we actually do.
1. Controller
The controller is the operator of Quietaway:
Jakub Šťastný Company ID (IČO): 08542953 Registered office: Rečkova 1597/6, 130 00 Praha 3, Czech Republic Email: hello@quietaway.com
2. What data we process
Depending on how you use Quietaway, we may process:
- Identity and contact: email, and name if you provide it.
- Account and use: access status, favourites, basic referral-program activity (for example active days and place detail views).
- Payments: purchase and subscription data (plan type, status, period, Stripe identifiers). Card data is handled by Stripe; we do not store card numbers.
- Technical data: IP address (for example on login, referral abuse protection, security), browser type, language.
- Communications: emails you send us.
- Newsletter: whether you opted in, and when.
- Cookies and similar technologies: see our Cookie Policy.
The catalogue may show host contacts (phone, email, links) for booking outside Quietaway. That is service content, not “your account” data.
3. Purposes and legal bases
| Purpose | Examples | Legal basis |
|---|---|---|
| Account and catalogue access | email, session, favourites | contract |
| Payment and subscription management | email, purchase data | contract |
| Magic-link and operational emails (payment, trial, referral reward) | email, name | contract / legitimate interest |
| Newsletter about new places | consent (withdraw anytime) | |
| Product improvement (analytics without cookies) | product events, locale | legitimate interest |
| Analytics with cookies and session replay | PostHog cookies, masked recordings | consent |
| Marketing measurement (Meta Pixel and Conversions API) | Meta cookies, hashed email, IP, user-agent on conversion | consent |
| Referral abuse protection and security | IP, activity | legitimate interest |
| Legal obligations (accounting, tax, complaints) | purchase data, correspondence | legal obligation |
Legitimate interest for cookieless analytics: we need to know which parts of the catalogue work, without marketing cookies. We minimise data (we do not send email as a routine PostHog property) and we do not use session replay without consent.
4. Recipients / processors
Data may be processed by:
- Stripe (payments and customer portal),
- Resend (email),
- PostHog (product analytics, EU region),
- Meta Platforms (Pixel / Conversions API, only with marketing consent),
- Neon (database),
- Vercel (hosting, photo storage).
Each processes data as needed for their service under their terms and processing agreements where applicable.
When you follow a link to a host or OTA (Airbnb, Booking, and similar), you leave Quietaway and that party’s terms apply.
5. Transfers outside the EU
We prefer EU providers (for example PostHog EU). Some providers (Stripe, Meta, Vercel, Resend) may process data outside the EU. Where required, we rely on appropriate safeguards under GDPR (for example standard contractual clauses).
6. Retention
We keep data only as long as needed:
- account and purchase history: for the relationship, then as required by accounting and tax rules (often up to 10 years for tax records),
- login tokens: short lifetime (minutes); expired records are limited over time,
- session cookie: on the order of months,
- newsletter: until you withdraw consent or the account ends,
- analytics and marketing via cookies: per tool settings and your consent,
- IP and anti-abuse data: for a period reasonable to protect the service (months to a few years in suspicious cases).
After that we delete or anonymise data unless the law requires longer retention.
7. Your rights
You have rights of access, rectification, erasure, restriction, portability (where applicable), and objection to processing based on legitimate interest. You may withdraw consent (newsletter, cookies) at any time without affecting lawfulness before withdrawal.
To exercise rights, email hello@quietaway.com. We respond without undue delay and within one month (extendable in complex cases under GDPR).
You may also lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz) or your local supervisory authority.
8. Children
The service is not directed at children under 16. We do not knowingly collect children’s data. If you believe a child has an account, contact us.
9. Cookies
Details are in our Cookie Policy.
10. Changes
We may update this policy. The current version is always on this page with its effective date. For material changes we will notify you on the site or by email.