Introduction
HelloGuestbook ("we," "our," or "us") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, store, and protect your information when you use our digital guestbook service for vacation rentals and short-term accommodations.
We want to be transparent about our data practices and believe you have the right to understand exactly how your information is handled. This policy is written in plain language to make it as clear and accessible as possible.
This policy describes how we handle your personal data in accordance with the GDPR and the Norwegian Personal Data Act (Personopplysningsloven). We process your data only where we have a valid legal basis — primarily to perform our contract with you, to comply with legal obligations, or where we have a legitimate interest that does not override your rights.
Information We Collect
Account Information
When you create an account, we collect information necessary to provide our service and manage your account.
- Full name and email address
- Profile/avatar images (optional)
- Authentication credentials (securely encrypted)
- Account preferences and settings
Property & Guestbook Content
We collect information you provide when creating and managing your digital guestbooks.
- Property title, location, and description
- Property images and media files
- WiFi network credentials
- Emergency contact information
- Custom pages and content
- External links and resources
Technical Information
We automatically collect certain technical information to ensure our service works properly and securely. We use cookieless tracking methods to respect your privacy.
- IP address and general location (anonymized)
- Browser type and version
- Device information and operating system
- Usage patterns and feature interactions
- Error logs and performance data
- Analytics data (via Pirsch Analytics)
- Error monitoring and performance data (via Sentry)
Error Monitoring & Performance
We use Sentry to monitor application errors and performance. This helps us identify and fix issues quickly.
- Error reports and stack traces (may include account identifiers or request context)
- Performance metrics and response times
- Browser and device information for debugging
- Session replay data
Payment Information
Payment processing is handled securely through Stripe. We do not store your full credit card information.
- Stripe customer ID (for subscription management)
- Subscription status and billing history
How We Use Your Information
We use the information we collect for the following purposes:
Service Delivery
To provide and maintain our digital guestbook service, manage your account, process subscriptions, and enable you to create and share guestbooks with your guests.
Security & Protection
To protect our service from fraud, abuse, and security threats. We monitor for suspicious activity and maintain system security.
Service Improvement
To understand how our service is used, identify issues, and improve features. We analyze usage patterns and monitor errors to enhance user experience.
Communication
To respond to your inquiries, send important service updates, and provide customer support. We may also send promotional emails with your consent.
Information Sharing
We only share your personal information in specific, limited circumstances. We never sell your personal information to third parties for marketing purposes.
- We never sell. Your personal information is never sold, rented, or shared with third parties for their marketing purposes.
- Service providers only. We only share data with trusted service providers to deliver our service.
We work with trusted third-party service providers to operate HelloGuestbook. Each provider only receives the data needed for their role:
- Vercel: Website hosting, serverless functions — EU (Stockholm) for compute; global CDN edge; US-based provider (EU-US DPF).
- Supabase: Database hosting, authentication, and file storage — EU (EU-North).
- Cloudflare Turnstile: Bot protection on forms — Global. See their Turnstile Privacy Addendum.
- Stripe: Payment processing and subscription management — US (EU-US DPF). See their Privacy Policy.
- Resend: Transactional emails — US (SCCs).
- Pirsch Analytics: Cookieless website analytics — EU (Germany). See their Privacy Policy.
- Sentry: Error monitoring and performance tracking — US (SCCs). See their Privacy Policy.
A complete list with data categories and processing locations is available on our Subprocessors page.
Data Security
We implement industry-standard security measures to protect your personal information from unauthorized access, disclosure, alteration, and destruction.
Data Encryption
All data transmitted using HTTPS/TLS encryption. Sensitive data encrypted at rest.
Secure Infrastructure
Hosted on Vercel and Supabase with enterprise-grade security and compliance.
Access Controls
Role-based access controls and monitoring for suspicious activity.
Data Retention
Active accounts: We retain your personal information for as long as your account is active or as needed to provide our services.
Account deletion: When you delete your account, we will permanently delete your personal information and guestbook content within 30 days. Some data may be retained longer if required by law or for legitimate business purposes (such as preventing fraud).
Backups: Data in our system backups may persist for up to 90 days after deletion.
Your Rights
Under GDPR and the Norwegian Personal Data Act you have the following rights regarding your personal data. You can exercise them by contacting us at support@helloguestbook.com or through your account settings.
Access Your Data
Request a copy of all personal information we hold about you, including your guestbook content and account details.
Correct Your Data
Correct or update inaccurate personal information directly in your account settings or by contacting us.
Delete Your Data
Request deletion of your account and all associated personal data. Some data may be retained where required by law.
Data Portability
Receive your personal data in a structured, commonly used, machine-readable format and transfer it to another service.
Restrict Processing
Request that we limit how we process your data — for example while a dispute about its accuracy is resolved.
Object to Processing
Object to processing based on legitimate interests. We will stop unless we have compelling grounds that override your rights.
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe we are processing your personal data unlawfully.
Contact Us
If you have questions about this Privacy Policy or want to exercise your privacy rights, please reach out. We aim to respond to all privacy-related inquiries within 30 days as required by GDPR.
Norway (EEA — GDPR applies)
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make significant changes, we will notify you by email (to the address associated with your account) or through a notice on our service.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. The "Last updated" date at the top of this page indicates when this Privacy Policy was last revised.
Your continued use of HelloGuestbook after any changes constitutes your acceptance of the updated policy.