Privacy Policy

SummerFlow · Last updated: 26 October 2026

This policy explains how personal data is handled when hosts use SummerFlow and when guests use a host's booking page. It applies the EU General Data Protection Regulation (GDPR) and Portuguese data-protection law.

1. Who is responsible

Host account data (your login, business details, usage): SummerFlow is the controller — Permanent Summer, Lda., NIPC 516416804, Casas da Alcaria, Lote 81, 8950-413 Altura, Portugal, christopher@permanentsummer.co.
Guest and booking data that a host enters or that guests submit on the host's booking page: the host is the controller; SummerFlow is the processor, acting only on the host's instructions.

2. What we process, why, and on what basis

Data	Purpose	Legal basis
Host: email, name / business name, phone, password (stored hashed), settings, properties, reservations, finance entries	Create and run your account and the service	Contract (Art. 6(1)(b))
Guest: name, email, phone, dates, number of guests, notes, quoted price	Handle the booking request; send confirmations; show it to the host	For the host: steps requested by the guest before a contract (Art. 6(1)(b)); for SummerFlow as processor: the host's instructions
Notifications: device push subscription (browser endpoint and keys)	Send you new-request and daily-summary notifications	Your consent (the browser permission prompt); you can turn it off at any time
Technical data: IP address, device/browser type, error and security logs, email-delivery logs	Security, abuse prevention, rate limiting, troubleshooting	Legitimate interest (Art. 6(1)(f))
Legal records (for example invoices we issue to you)	Tax and accounting duties	Legal obligation (Art. 6(1)(c))

We do not sell personal data, do not use it for advertising, do not profile people, and do not make automated decisions with legal effect.

3. Cookies and local storage

SummerFlow uses only strictly necessary browser storage: your login session and a few preferences (language, theme, remembered view). There are no advertising or analytics cookies. Because they are strictly necessary, no consent banner is required.

4. Who we share data with

Provider	Role	Where
Supabase (database, authentication, file storage, serverless functions)	Processor	EU — Ireland (AWS eu-west-1)
Resend (sending booking and account emails)	Processor	USA / EU — safeguards below
GitHub Pages (hosting the website files)	Processor (receives visitors' IP address)	USA — safeguards below
Google Fonts and public script libraries (CDNs) used by some pages	Independent recipients (receive the visitor's IP address when a page loads)	USA / global
Browser push services (Apple, Google, Mozilla) delivering notifications	Independent	Global

Hosts' guests' details are visible only to the host they booked with. Each host account can access only its own data; this is enforced in the database. We may disclose data if required by law or to protect our rights.

International transfers

Where data goes outside the EEA, we rely on the EU–US Data Privacy Framework (where the provider is certified) or the EU Standard Contractual Clauses, plus the providers' own security measures.

5. How long we keep data

While your account is active: your data stays until you delete it.
Account deletion (Account → Delete my account): your data is removed from our live systems immediately; copies in encrypted backups, if any, are overwritten within 30 days.
Guest requests and bookings: kept by the host for as long as the host decides, and in any case deleted with the account. Hosts should not keep guest data longer than needed and legally required.
Security and email logs: a limited period (typically up to 90 days).
Accounting records we are legally required to keep: as the law requires (currently up to 10 years in Portugal).

6. Security

Data is encrypted in transit (HTTPS) and stored with access control per account (row-level security), passwords are hashed, administrative access is limited, and public functions are rate-limited. No system is perfectly secure; if a breach affects your data we will notify you and the authority as the law requires.

7. Your rights

You can request access, correction, deletion, restriction, portability and objection, and withdraw consent at any time, by writing to christopher@permanentsummer.co. Guests: for data entered on a host's booking page, please contact the host first; the host controls it. If we receive such a request we will forward it to the host or help the host respond. You may also complain to the Portuguese data-protection authority, the CNPD (www.cnpd.pt), or the authority in your own country.

8. Children

SummerFlow is for professionals and is not directed at children under 16. Hosts must not collect data from minors except what the law requires for a stay.

9. Processor terms (data processing agreement for hosts)

These terms apply between each host (controller) and SummerFlow (processor) under Article 28 GDPR for guest and booking data:

Subject and duration: providing the SummerFlow service while the account is active. Data and people: as in section 2 (guests and the host's staff). Instructions: we process the data only on the host's documented instructions, which are the host's use of the service and these terms.
Confidentiality: people with access are bound by confidentiality.
Security: the measures in section 6.
Sub-processors: those listed in section 4. We will inform hosts of material changes (by email or in the app) and hosts may object or end the service.
Assistance: we help hosts answer data-subject requests and comply with security and breach-notification duties, and notify the host without undue delay after becoming aware of a breach affecting their data.
End of service: on deletion the data is erased as in section 5, unless the law requires keeping it. Hosts can export their data before.
Audit: we make available the information necessary to show compliance and allow reasonable audits, on written request and notice.

10. Changes

We may update this policy. For material changes we will notify hosts by email or in the app.