Privacy Policy

This Privacy Policy explains how StayToEnjoy Technologies UG (haftungsbeschränkt) ("StayToEnjoy", "we", "us", or "our") collects, uses, shares, and protects your personal information when you use our platform and related services.

The controller responsible for data processing on this platform is:

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related communications
• Send service updates, security alerts, and support messages
• Personalize your experience and deliver relevant content
• Analyze usage patterns to understand how people use our platform
• Detect, prevent, and address fraud and security issues
• Comply with legal obligations

We process your personal data on the following legal bases:

• Contractual necessity: to provide the services you requested
• Legitimate interests: to improve the platform and prevent fraud
• Legal obligation: to comply with applicable laws and regulations
• Consent: for specific processing activities where you have given explicit consent

We use cookies and similar technologies to provide and improve our services. Cookies are small data files stored on your device that help us remember your preferences and understand how you use our platform.

• Necessary cookies and storage: sign-in, session, security (CSRF protection), language, cart and your cookie decision. Always active.
• Functional and marketing cookies: we currently use none. If this changes, only with your consent.
• Analytics (only with your consent in the cookie banner): our own pseudonymous usage signals — for example which search results, posts or recommendations were shown to you and which of them you opened, saved, liked, followed or booked — used to improve search and recommendations, plus a random session identifier in session storage (not a cookie). No third-party analytics service (no Google Analytics, no advertising pixels). Pseudonymous does not mean anonymous.
• Personalization (a separate setting, off by default): only if you also switch on “Personalized feed” are these signals linked to a random pseudonym of your account, an interest profile derived from them, and your feed and recommendations ordered personally.
• Payments: only when you open a payment flow does your browser load the Stripe script (js.stripe.com); Stripe then sets the cookies __stripe_mid (1 year) and __stripe_sid (30 minutes) for fraud prevention.

Search, the feed, liking, following, saving, booking and buying all work without any optional consent. You can change or withdraw your decisions at any time with effect for the future — via “Cookie settings” in the profile menu or in the footer, and via “Personalized feed” in your settings. When you withdraw analytics consent or sign out, the session identifier is deleted immediately, in your browser and on our servers; from then on no new learning signals are created, including queued ones, and an interest profile is no longer updated. If you are signed in, we store your decisions in your account together with the time and the version of the text you were shown. Details, including all cookies and their durations, are in our Cookie Policy.

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit and at rest, access controls, and regular security audits.

Personal data is retained only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. When data is no longer needed, it is securely deleted or anonymized.

Account deletion works in three phases: after you request deletion, your account is immediately hidden and you have 30 days to cancel by simply logging in. After this window, your data is irreversibly deleted from our active systems within a further 14 days. Backup copies are retained for a maximum of three months and overwritten in their regular rotation cycle. Data subject to statutory retention (e.g. invoices, § 147 AO — 10 years) is restricted instead of deleted (Art. 18 GDPR); reviews you wrote remain without your name, and messages you sent stay visible to their recipients, attributed to a deleted account.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Obtain a copy of your personal data we hold
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restriction: Request limitation of processing in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or direct marketing
• Right to withdraw consent: Revoke consent at any time without affecting prior processing

Our platform is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected such information, please contact us immediately so we can take appropriate steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated via email or prominent notice on the platform at least 30 days before taking effect.

We encourage you to review this Privacy Policy periodically. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how we handle your personal data, please contact our Data Protection team: