Privacy Policy

Effective as of 1 September 2026

This policy explains what personal data Quietaway processes, why, and what rights you have. We only describe what we actually do.

1. Controller

The controller is the operator of Quietaway:

Jakub Šťastný Company ID (IČO): 08542953 Registered office: Rečkova 1597/6, 130 00 Praha 3, Czech Republic Email: hello@quietaway.com

2. What data we process

Depending on how you use Quietaway, we may process:

• Identity and contact: email, and name if you provide it.
• Google sign-in: email and name that Google sends us at sign-in. We do not load anything else from the Google account and we do not call Google APIs later. We use the email the same way as with a magic link: to run the account and to match it with a payment.
• Account and use: membership status, favourites, home municipality, saved filters, basic referral-program activity (for example active days and place detail views), and your score in the game we run on the site.
• Payments: purchase and membership data (plan type, status, period, Stripe identifiers). Card data is handled by Stripe; we do not store card numbers.
• Stay plans: the name you pick in the plan, home municipality (for splitting the drive), car and passengers, expenses, shopping list, notes, and photos you upload, including the capture date from EXIF. A plan is entered by link, so a participant does not need an account with us; we recognise such a participant by a cookie and by the name they chose. Whoever puts content into a plan is responsible for it (see section 9 of our Terms).
• Hosts: contact details (name, email, phone), information about the property, and a record of the publication consent they gave (date and time, IP address, browser, and the full wording shown at that moment), plus any change requests they send us. We keep the consent record as evidence for both sides.
• Technical data: IP address (for example on login, referral abuse protection, security), browser type, language.
• Communications: emails you send us.
• Newsletter: whether you opted in, and when.
• Creator collaborations: for influencers who have signed a collaboration agreement with us, additionally name, postal address, bank account number, company ID (IČO) if any, commission and payout records, and proof of signature (date and time, IP address, browser, and the full wording shown at that moment).
• Cookies and similar technologies: see our .

The catalogue may show host contacts (phone, email, links) for booking outside Quietaway. We do not show them to signed-out visitors or to search engines. The organiser of a stay plan can share them once with the people they are travelling with.

3. Purposes and legal bases

Legitimate interest for cookieless analytics: we need to know which parts of the catalogue work, without marketing cookies. We minimise data (we do not send email as a routine PostHog property) and we do not use session replay without consent.

4. Recipients / processors

Data may be processed by:

• Stripe (payments and customer portal),
• Google (Google account sign-in),
• Resend (email),
• PostHog (product analytics, EU region),
• Meta Platforms (Pixel / Conversions API, only with marketing consent),
• Neon (database),
• Vercel (hosting, photo storage),
• Seznam.cz / Mapy.com (drive-time and route calculation; we send the coordinates of the municipality and the place, not your identity).

Each processes data as needed for their service under their terms and processing agreements where applicable.

When you follow a link to a host or OTA (Airbnb, Booking, and similar), you leave Quietaway and that party’s terms apply.

5. Transfers outside the EU

We prefer EU providers (for example PostHog EU). Some providers (Stripe, Google, Meta, Vercel, Resend) may process data outside the EU. Where required, we rely on appropriate safeguards under GDPR (for example standard contractual clauses).

6. Retention

We keep data only as long as needed:

• account and purchase history: for the relationship, then as required by accounting and tax rules (often up to 10 years for tax records),
• login tokens: short lifetime (minutes); expired records are limited over time,
• session cookie: on the order of months,
• newsletter: until you withdraw consent or the account ends,
• analytics and marketing via cookies: per tool settings and your consent,
• IP and anti-abuse data: for a period reasonable to protect the service (months to a few years in suspicious cases),
• stay plans including photos: for as long as the organiser's account exists, or until deleted on request; when the organiser closes their account the whole plan goes with it, including other participants' content,
• host data and the record of their consent: for as long as the property is in the catalogue, and three years after that,
• creator collaboration records (signed agreement, commissions, payouts): for the collaboration, then as required by accounting and tax rules (10 years).

After that we delete or anonymise data unless the law requires longer retention.

7. Your rights

You have rights of access, rectification, erasure, restriction, portability (where applicable), and objection to processing based on legitimate interest. You may withdraw consent (newsletter, cookies) at any time without affecting lawfulness before withdrawal.

To exercise rights, email hello@quietaway.com. We respond without undue delay and within one month (extendable in complex cases under GDPR).

If you are in a stay plan as a guest without an account, you can delete the expenses, list items, and photos you added yourself. Removing your name from a plan, or deleting a whole plan, is not yet possible in the interface, because the cost split hangs off the names. Email hello@quietaway.com and we will do it for you. A plan also ends by itself when the organiser closes their account.

On request we delete the account in full: your email, name, access and purchase history in our database, favourites, referral programme links, and your contact at Resend. Of the deletion itself we keep only a record without your email address (a hash of it and the date), so that we can demonstrate the request was handled. Proof of payment remains with Stripe for as long as accounting and tax rules require.

You may also lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz) or your local supervisory authority.

8. Children

The service is not directed at children under 16. We do not knowingly collect children’s data. If you believe a child has an account, contact us.

9. Cookies

Details are in our .

10. Changes

We may update this policy. The current version is always on this page with its effective date. For material changes we will notify you on the site or by email.