Privacy Policy

We collect the following information when you use our Service:

• Account information: Name, email address, and hashed password when you register.
• Site content: Text, images (up to 15 photos per site), and configuration data you enter in the website builder. Images are compressed and stored as base64-encoded data within your site record.
• Payment information: Processed securely by Stripe. We do not store credit card numbers, CVV, or full card details on our servers. We only store transaction references (payment IDs, invoice IDs, amounts).
• Usage data: Server logs may include IP addresses, browser types, and pages visited for security and troubleshooting purposes.

• To provide, operate, and maintain the Service
• To process your subscription payments
• To send you transactional emails (payment confirmations, subscription expiry, password resets)
• To respond to your inquiries and support requests
• To detect and prevent fraud or abuse
• To improve the Service

• We do not sell your personal data to third parties.
• We do not share your information with advertisers.
• We do not send marketing emails unless you explicitly opt in.
• We do not use your content for any purpose other than hosting your website.

We use the following third-party services:

• Stripe — for payment processing. Stripe has its own Privacy Policy.
• SMTP email provider — for sending transactional emails (password resets, subscription notifications).

These services receive only the minimum data necessary to perform their function.

• Your data is stored on secure servers.
• Passwords are encrypted using bcrypt (one-way hashing) and cannot be read by anyone, including us.
• All communications with our servers are encrypted via SSL/TLS (HTTPS).
• While we implement reasonable security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

• Active accounts: Your data is retained for as long as your account is active.
• Cancelled subscriptions: Site data (including all uploaded images) is retained for 90 days after subscription expiry, then may be permanently deleted.
• Account deletion: You can request full deletion of your account and data by emailing contact@getdirectstay.com. We will process deletion requests within 30 days.
• Payment records: Transaction records may be retained for up to 7 years for tax and legal compliance purposes.

• We use essential cookies only — specifically an authentication token (JWT) to keep you logged in.
• We do not use tracking cookies, analytics cookies, or advertising cookies.
• No third-party tracking scripts are loaded on our platform.

You have the right to:

• Access your personal data — visible in your dashboard and account settings.
• Correct inaccurate data — by editing your site or contacting us.
• Delete your account and data — by emailing contact@getdirectstay.com.
• Export your site data — your website content is accessible from your dashboard.
• Withdraw consent — by cancelling your subscription and deleting your account.

When someone visits a website created by one of our customers:

• We do not collect personal data from those visitors.
• No cookies are set on visitor browsers by our platform.
• No analytics or tracking scripts are embedded in customer websites by default.
• The customer (website owner) is solely responsible for any data they collect from their visitors through external links or booking platforms.