What we hold, why, and for how long.

1. Who is responsible

Anystay is a product of Easy Host Oy, business ID 3288005-7, Sörnäistenkatu 19 B 21, 00580 Helsinki, Finland. For data about you as a visitor to anystay.io or as our customer, Easy Host Oy is the data controller. Contact: joona@anystay.io.

For data about your guests, owners and staff inside Anystay, you — the operator — are the controller and Easy Host Oy is your processor, acting only on your instructions under the Data Processing Agreement.

2. Visitors to anystay.io

• Demo and beta form: your name, work email, the number of units you manage, the towns you work in, what you run today, roughly what you pay for it, and who cleans — plus technical metadata (IP address, browser, timestamp). We use it to prepare and hold the call you asked for, and to place you in the beta. Legal basis: steps before a contract (GDPR Art. 6(1)(b)) and our legitimate interest in answering you (Art. 6(1)(f)).
• Analytics: which pages are viewed and what is clicked on them, device type and approximate location, through PostHog in the EU region. Without your consent this is counted without cookies or storage on your device (legal basis: our legitimate interest in knowing how the site is used, Art. 6(1)(f)). The analytics cookie is set only with your consent (Art. 6(1)(a)), which you can withdraw from the cookie settings in the footer at any time.
• Strictly necessary cookies: one to remember your cookie choice. No consent is needed for it and it is never used for tracking.

Form submissions are kept for up to 24 months after our last contact, then deleted, unless they lead to an agreement we must retain for accounting reasons.

3. You, as our customer

When you open an account we hold your name, work email, phone number, company details, the users you invite, billing records and the support conversations we have with you. Legal basis: performance of the contract (Art. 6(1)(b)) and the accounting obligations of Finnish law (Art. 6(1)(c)).

We keep this for as long as your account is open. When it closes, it is deleted 60 days later, as the Terms of service set out, except invoices and accounting records, which Finnish accounting law requires us to keep for six years after the end of the financial year. Support happens by email, and we delete support emails 24 months after the conversation ends.

We do not sell customer data and we do not use it for advertising.

4. Your guests, owners and staff — as your processor

Everything you put into Anystay about the people in your business — guest names, contact details, stays, messages, identity documents where you collect them, access codes, owner statements, cleaner accounts — is processed on your instructions. You decide what is collected and how long it is kept. Anystay deletes support-line call recordings on a fixed schedule, deletes anything else you ask it to, and deletes all of it when the agreement ends.

Where you run a cleaning business, the same applies to your customers: their contact details, home address and access instructions, agreements, visits, visit reports and payment status are processed on your instructions only. We do not use them for any business of our own and never contact your customers except with the messages you set the Service to send.

We do not use guest data for our own purposes, we do not train models on it, and we never sell it. Where an AI feature drafts a reply, the guest’s message and your own house facts are sent to the AI provider for that draft only and are not retained by it for training.

The full terms, the security measures and the list of subprocessors are in the Data Processing Agreement.

5. Where data lives

Anystay runs on EU-hosted infrastructure. The application and database run on Railway in the EU; media (photos, documents) is stored on Cloudflare R2 in the EU jurisdiction. Guest personal data is not transferred outside the EU for processing, with the exceptions listed in the subprocessor list and covered by Standard Contractual Clauses.

6. Who processes data for us

We use vetted processors under data processing agreements. The list is published and versioned in the DPA; the main ones today:

• Railway — application hosting and database, EU region.
• Cloudflare — network, DNS and media storage (R2), EU jurisdiction.
• Resend — transactional email (magic-link sign-in, notifications, email to task addresses), USA, under Standard Contractual Clauses.
• Twilio — SMS delivery and, for support lines, call routing, voicemail recordings, recordings of answered calls where the operator turns recording on, and call records, only where SMS or a support line is enabled, Ireland (EU) region; US company, under the EU–US Data Privacy Framework and Standard Contractual Clauses.
• OpenAI — transcription of voicemail recordings and recorded calls on a support line, only where a support line is enabled, USA, under Standard Contractual Clauses; not used for training.
• Google — sign-in with Google, and address lookup and travel times for cleaning routes, under Standard Contractual Clauses.
• Sentry — error reporting with personal data removed, EU region (Germany).
• Stripe — payments for direct bookings and subscriptions; Stripe is an independent controller for the payment itself.
• PostHog: analytics on anystay.io, EU region; cookies only with consent.
• Anthropic — AI features: drafting and translating guest messages, sorting messages, reviews and photos, summarising notes and recorded support-line calls, and the chat assistant on booking sites, USA, under Standard Contractual Clauses; no training on your data.
• DeepL — translation of texts you ask to translate, EU.

7. Your rights

You have the right to access, rectify, erase, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time. Write to joona@anystay.io. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

If you are a guest of an operator using Anystay, your rights are exercised through that operator, who is the controller. We help them answer you, and the request is handled in-product rather than by email archaeology.

8. Changes

We will post changes to this policy here, with the version and date above. A material change is announced to customers by email before it takes effect.