Privacy

We process as little data as possible. Ordinary visits are not tracked. After a Google Ads visit, campaign attribution is stored and shared only if you explicitly allow it.

Controller

Scafa Investments LLC, 9830 Bahama Dr, Cutler Bay, FL 33189, USA — contact details in the imprint. As the controller is based in the United States, your data is processed there.

If you are only looking

No account is needed to browse or search, and ordinary visits receive no advertising or analytics cookie. After a Google Ads visit, we ask before storing attribution. While you are signed out, your wishlist stays in your browser (localStorage). If you sign in, the saved entry identifiers are merged once into your account wishlist.

If you create an account

We store your email address, your name and a password check value. We do not store the password itself — only a value computed with scrypt, from which it cannot be worked back. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Signing in and sessions

After you sign in we set a technically necessary cookie holding a random session id. Its only purpose is to keep you signed in, and it expires after 30 days. Signing out deletes the session on the server.

Signing in with Google or Apple

If you choose “Continue with Google” or “Continue with Apple”, that provider confirms who you are and sends us basic profile details — your name and email address — to create or match your account. Nothing more is asked, and we use it only to sign you in. This involves a transfer of data to the United States. Google’s and Apple’s own handling of your data is governed by their privacy policies. Legal basis: Art. 6(1)(b) GDPR.

If you list a property

Property details, descriptions, prices and pictures are stored and published. Calendar addresses from other portals (iCal) are fetched regularly to keep availability in step; only date ranges are stored from them, never guest data from those portals.

Inquiries to owners

We pass your name, email address, phone number and dates to the owner of the property you asked about — that is what the enquiry is for. Nothing is passed on beyond that.

Server logs

Requests produce log data as a technical necessity (IP address, time, address requested, browser identification). It serves operation and the prevention of abuse, and is deleted after seven days. Legal basis: Art. 6(1)(f) GDPR.

Fonts

The “Figtree” typeface is hosted on our own server. There is no connection to Google Fonts, and your IP address is not sent there.

Google Ads attribution

We do not load Google Analytics, Google Tag Manager or a Google advertising script. If you arrive through Google Ads, we show a choice first. Only after you agree do we store the click identifier and campaign parameters in a first-party, HTTP-only cookie for up to 90 days. If you create an account, that attribution is attached to it so a later listing can be credited to the original campaign. Selected funnel events may then be sent to Google Ads through its server-side Data Manager API. Google receives the click identifier, event type, event time, transaction id and conversion value used for campaign optimisation; ad personalisation remains denied. The legal basis is your consent (Art. 6(1)(a) GDPR). You can switch future measurement off below at any time. Refusing has no effect on the site or your account.

The map

The map is the one exception. Map images come from OpenFreeMap (map data: OpenStreetMap contributors). That service therefore learns your IP address — technically unavoidable, since it has to deliver the images.

When that happens: on the results page the map loads with the results on a phone and only after choosing the map view on a computer. On accommodation and venue pages it loads when the map area comes near the visible viewport. OpenFreeMap sets no cookies and needs no key. Legal basis: Art. 6(1)(f) GDPR, because showing places on a map is part of accommodation and local-area search.

Payments and payouts through Stripe

When you pay for a booking or set up host payouts, Stripe processes the contact, booking, amount and payment data needed for that purpose. You enter bank and card details directly with Stripe; BookNoFees does not see or store them. Stripe may process data in the United States and other countries. The legal basis is Art. 6(1)(b) GDPR; legally required retention is based on Art. 6(1)(c) GDPR.

Translations and image descriptions

Published titles and descriptions may be sent to DeepL or Moonshot AI (Kimi) for translation. Uploaded images may be sent together with the listing or venue name and place to Moonshot AI (Kimi) or Anthropic to create factual alt text. If the relevant access key is not configured, that processing does not take place. The legal basis is Art. 6(1)(f) GDPR, so content remains understandable in the domain language, to search engines and to screen readers.

Address and location search

For place search and map positioning, we send an entered address or coordinate to Nominatim or other OpenStreetMap project services. Names, email addresses and booking data are not sent with it. Legal basis: Art. 6(1)(b) and (f) GDPR.

Hosting, protection and email delivery

Cloudflare and our hosting provider process IP addresses and technical connection data to deliver the site and defend it against attacks. For confirmations, bookings and messages, we send the recipient address and message content to our SMTP mail server or configured transactional mail provider. This processing is necessary for operation, security and performance of the contract (Art. 6(1)(b) and (f) GDPR).

Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection, as well as the right to complain to a supervisory authority. California residents have comparable rights under the CCPA. A short email to support@booknofees.com is enough.