1. Data controller
- Controller: Lookinfy S.L.
- Address: Pl. Europa 126, 8.D, Districte Econòmic, 08902 – L'Hospitalet de Llobregat (Barcelona), Spain
- Contact: support@lookinfy.atlassian.net
2. Data we process
- Account data: name, email and avatar provided by Google when signing in via OAuth.
- Profile and billing data: address, tax ID, phone and tax information that you voluntarily provide.
- Activity data: published listings, bookings made, messages, ratings and IP addresses.
- Payment data: managed directly by Stripe and Stripe Connect. Lookinfy does not store bank card data.
- GDPR consent record: date and version of accepted terms and policies.
3. Purposes
- Create and manage your Host or User account and profile.
- Verify and publish space listings.
- Process bookings, authorize and capture payments, transfer amounts to Hosts deducting the 18% commission and issue invoicing.
- Handle your queries and send operational communications related to your bookings.
- Comply with legal obligations (tax, accounting, anti-fraud, anti-money laundering prevention).
- Improve the Platform through aggregated analytics and fraud prevention.
4. Legal basis
Processing is based on:
- The execution of the contract when using the Platform and making bookings.
- Compliance with legal obligations (tax, commercial, GDPR).
- Your consent for non-essential cookies and commercial communications.
- Legitimate interest in preventing fraud and improving the service.
5. Recipients
We share data only with providers necessary to operate the service:
- Supabase (hosting and database in the EU) — data processor.
- Stripe Payments Europe Ltd. (payment processing and Host KYC onboarding via Stripe Connect).
- Google Ireland Ltd. (OAuth authentication).
- Public administrations and competent authorities when required by law.
6. Retention
We retain data while you have an active account and, after deletion, for the applicable legal periods: up to 6 years for tax and accounting data (General Tax Law) and the limitation periods for legal actions.
7. Your rights
You can exercise your rights of access, rectification, deletion, opposition, limitation and portability, as well as withdraw your consent, by writing to support@lookinfy.atlassian.net. You can also file a complaint with the Spanish Data Protection Agency (www.aepd.es).
8. International transfers
Some providers (such as Stripe or Google) may process data outside the EEA. These transfers are made under standard contractual clauses approved by the European Commission or other adequate safeguards provided by GDPR.
9. Security
We apply appropriate technical and organizational measures (TLS encryption in transit, access control, Row-Level Security in database, federated OAuth authentication) to protect your data against unauthorized access, loss or alteration.
10. Modifications
Lookinfy may update this policy. Modifications will be published on the Website with their effective date.