Privacy Policy

Who we are

SukiStay ("we", "us") operates sukistay.com, a subscription service that lets staycation hosts create direct-booking pages for their units. This policy explains what data we handle when you use the marketing site, the host Studio, and guest booking pages.

What we collect

Hosts (account holders): email address, password (stored as a secure hash), tenant and page settings, uploaded images, PDF templates, booking records you manage in the Studio, and payment proof you upload for subscription billing.

Guests (no account required):name, email, mobile number, stay dates, guest count, ID type and number, optional ID photo, and any voucher code entered on a host's booking page. Guests pay hosts directly — SukiStay does not process guest payments.

Automatic data: session cookies for logged-in hosts, first-party analytics events (page views and booking funnel steps), and hashed IP addresses on booking submissions for abuse prevention.

How we use data

• Run your account, pages, bookings, calendars, and PDF generation.
• Send transactional emails (booking alerts, confirmations, password resets).
• Roll up anonymous usage stats for your dashboard.
• Prevent spam, double-bookings, and abuse of public endpoints.
• Bill and support your subscription (manual GCash/bank flow in MVP).

We do not sell personal data. We do not use guest data for advertising.

Guest ID photos and retention

When a host requires an ID upload, the image is stored in private storage and is only accessible to that host through the authenticated Studio. ID files are scheduled for automatic deletion 30 days after checkout, as shown in the host dashboard. Hosts should download what they need for building admin (for example Guest Advise Forms) before that window closes.

Where data is processed

We use trusted infrastructure providers, including:

• Vercel (hosting and file storage)
• Neon (database)
• Resend (email delivery)
• Cloudflare Turnstile (optional bot protection on booking forms)

Each provider processes data only to deliver the service. Hosts are independent controllers of their guest booking data; SukiStay provides the tools to collect and organize it.

Your choices

• Hosts: update profile and notification settings in the Studio; export booking history; request account deletion by contacting us.
• Guests:contact the host directly for booking changes; ID retention follows the host's page policy above.

Security

Passwords are hashed with scrypt. Studio sessions use httpOnly cookies. Sensitive files are not served via public URLs. Tenant data is isolated per account in our application layer.

Children

SukiStay is a business tool for adult hosts. Booking pages may record children as guests of a stay, but we do not knowingly collect data directly from children under 13.

Changes

We may update this policy as the product evolves. Material changes will be noted on this page with a new "Last updated" date.

Contact

Privacy questions: sukistaypage@gmail.com or Facebook.