How we process your guests’ data on your behalf.

1. Parties and roles

The customer (“Controller”) is the operator that holds the Anystay account. Easy Host Oy, business ID 3288005-7, Helsinki, Finland (“Processor”) provides the Anystay service and processes personal data on the Controller’s behalf.

The Controller determines the purposes and means of the processing; the Processor acts only on the Controller’s documented instructions, which are these terms, the Terms of service and the settings the Controller makes in the Service.

2. Subject matter, duration, nature and purpose

• Subject matter: the operation of the Controller’s short-stay, rental or cleaning business in the Anystay service.
• Duration: for as long as the Controller’s account is open, plus the 30-day export period and the 90-day deletion period after it closes.
• Nature: storing, organising, transmitting and displaying data; sending messages on the Controller’s behalf; generating documents (statements, invoices, contracts); creating and revoking access codes; drafting, translating and sorting messages, reviews and photos with an AI provider.
• Purpose: to provide the Service as described in the Terms of service. No other purpose.

3. Categories of data subjects and data

• Guests: name, contact details, nationality and identity-document data where the Controller collects it, stay dates and unit, messages, payment status (never full card numbers), reviews, access codes and access events, lost-and-found records.
• Owners and clients: name, contact details, company details, bank details for payouts, statements and invoices.
• Cleaning customers: name, contact details, home address, access instructions and key arrangements, agreement and prices, visits, notes to the cleaner, visit reports and photos, ratings, the terms they accepted, and payment status (never full card numbers).
• Staff, cleaners and partners: name, contact details, role, work assignments, hours and pay records where the Controller uses those modules, photos they upload as proof of work, location of jobs.
• Special categories: none by design. The Controller must not store health or other special-category data in free-text fields; the Processor cannot check this and is not responsible for it.

4. The Processor’s obligations

• Process personal data only on the Controller’s documented instructions, including for transfers outside the EU, unless required to by EU or Finnish law — in which case the Processor informs the Controller before processing, unless the law forbids it.
• Ensure that every person with access to the data is bound by confidentiality.
• Processor staff open the Controller's data in the Service only (a) as a member the Controller has invited to its workspace, (b) in a support session the Controller has started, which is limited in time, shown in the Service while it lasts, and logged so that the Controller can see what was opened, or (c) to deal with a security incident or to comply with a legal obligation, in which case the Processor records the reason and tells the Controller unless the law forbids it. Otherwise Processor staff see only what billing and running the Service require: the company's contact and billing details, the number of billable units and usage, and whether integrations and the acceptance of these terms are in place.
• Implement the technical and organisational measures in section 6 and keep them current.
• Assist the Controller in answering data-subject requests, in the Service where possible, and within ten working days otherwise.
• Assist the Controller with security, breach notification, impact assessments and prior consultation, taking into account the nature of the processing and the information available to the Processor.
• Notify the Controller of a personal-data breach without undue delay and in any case within 48 hours of becoming aware of it, with what is known at that time and updates as more becomes known.
• Delete or return all personal data at the end of the Service, at the Controller’s choice, and delete remaining copies within 90 days, unless EU or Finnish law requires storage.
• Make available the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates, once a year on 30 days’ notice, at the Controller’s cost, without disrupting other customers.
• Inform the Controller immediately if, in its opinion, an instruction infringes the GDPR or other EU or Finnish data-protection law.

The Controller’s customers and staff remain the Controller’s. The Processor does not use the Controller’s personal data, or its bookings, prices, schedules and customer lists, for any purpose of its own — including any business the Processor operates in the same field as the Controller. It does not contact, market to or recruit the Controller’s customers or staff; the only messages they receive through the Service are those the Controller has set it to send. It does not disclose one customer’s data to another customer of the Service, or combine data across customers to benchmark, price or advise others. Bookings made through the Controller’s booking page are recorded for the Controller only. Production access by the Processor’s staff under section 6 is used only to operate, secure and support the Service.

5. Subprocessors

The Controller gives general authorisation to the subprocessors below. The Processor tells the Controller by email at least 30 days before adding or replacing one; the Controller may object on reasonable data-protection grounds within that time, and if no solution is found may end the agreement without penalty for the affected part of the Service.

Current list (version 1.3):

• Railway Corp. — application hosting and PostgreSQL database — EU (Amsterdam) region.
• Cloudflare, Inc. — DNS, network security and media storage (R2) — EU jurisdiction setting; US company, Standard Contractual Clauses.
• Resend, Inc. — transactional email (sign-in links, notifications, guest and owner messages by email, email to task addresses) — USA, Standard Contractual Clauses.
• Stripe Payments Europe, Ltd. — payment processing for direct bookings and subscriptions — Ireland; independent controller for the payment itself.
• NextPax.com B.V. — channel connectivity: listing content, availability, prices, reservations and guest messages exchanged with Airbnb, Booking.com and other channels, only where the Controller connects channels — EU (the Netherlands, Germany and Finland).
• Anthropic, PBC — AI features: drafting and translating guest messages, sorting messages, reviews and photos, summarising notes and recorded support-line calls, and the chat assistant on booking sites — USA, Standard Contractual Clauses, no training on customer data.
• DeepL SE — machine translation of texts the Controller asks to translate — Germany.
• Seam Labs, Inc. — smart-lock connectivity, only for locks the Controller connects — USA, Standard Contractual Clauses; receives access codes and lock events, not guest identities.
• Twilio Inc. — SMS the Controller sends, and for support lines the routing of guests’ calls, voicemail recordings, recordings of answered calls where the Controller turns call recording on, and call records — Ireland (EU) region, only where SMS or a support line is enabled; US company, EU–US Data Privacy Framework and Standard Contractual Clauses.
• OpenAI Ireland Ltd (OpenAI, L.L.C.) — transcription of voicemail recordings and recorded calls on a support line, only where a support line is enabled — processed in the USA, Standard Contractual Clauses; not used for training, kept by OpenAI for up to 30 days for abuse monitoring.
• Google LLC — sign-in with Google; address geocoding and travel times for cleaning routes — USA, Standard Contractual Clauses.
• Functional Software, Inc. (Sentry) — error reporting, with personal data scrubbed before sending — EU (Germany) region.
• OpenStreetMap Foundation — map tiles on the booking sites the Service generates; receives the visitor’s IP address, not booking data — UK, adequacy decision.

Services the Controller connects on its own account — Hostaway, Netvisor, Slack and similar — are the Controller’s own providers, not subprocessors: the Service sends them the data the Controller has told it to send. Each subprocessor is bound by written terms that impose the same data-protection obligations as this agreement. The Processor remains fully liable to the Controller for the subprocessor’s performance.

6. Security measures

• Tenant isolation enforced in the database itself: every table that holds customer data carries a row-level policy, and the application connects as a role that cannot bypass it. A query outside a tenant’s scope returns nothing.
• Encryption in transit everywhere (TLS), and at rest for the database and media storage. Personal identity codes collected in client and booking records are encrypted at the application level in addition.
• Access by role. Staff, cleaners, owners and guests each see their own slice; access to a unit’s door is logged per person and per event.
• Sign-in by single-use magic link or Google; no passwords stored. Sessions are invalidated server-side on sign-out.
• Daily backups: a copy with a second provider, encrypted at rest, and snapshots with the hosting provider; a restore has been tested. No backup is kept for longer than a month, so data deleted from the Service is gone from every backup within a month.
• Logging of administrative actions; error reporting with personal data scrubbed from URLs.
• Direct access to the production database limited to named Easy Host Oy staff, under confidentiality, used only as section 4 (c) allows, and reviewed when someone leaves.

7. International transfers

Personal data is processed in the EU. Where a subprocessor is in the USA, transfers rely on the European Commission’s Standard Contractual Clauses (2021) with the supplementary measures those providers publish, or on the EU–US Data Privacy Framework where the provider is certified. The Processor does not transfer guest data outside the EU for any other reason.

8. The Controller’s obligations

• Have a lawful basis for the data it collects and give guests, owners and staff the notices the GDPR requires.
• Use the Service’s settings — message templates, roles, call recording — in line with its own obligations, and tell the Processor what to delete where its own retention periods require it.
• Not enter special-category data into free-text fields.
• Respond to data-subject requests it receives; the Processor assists.

9. Liability and term

Liability under this agreement follows section 10 of the Terms of service. This agreement runs for as long as the Processor processes personal data for the Controller and survives the end of the Terms of service for as long as that lasts.

Finnish law applies. Disputes are heard by the District Court of Helsinki.