Privacy Policy
1. Who we are and our two roles
ArriveCasa is operated by Lidus Mila Group SL, a company established in Spain ("ArriveCasa", "we", "us"). You can reach us at casamilocasa@gmail.com.
Under the General Data Protection Regulation (GDPR) we act in two different roles:
- Controller for the data of hosts: the account you create, your properties, and how you use the service and website.
- Processor for guest registration data: when a guest checks in through a host's link, the host is the controller and we process the data on the host's instructions under our Data Processing Agreement. If you are a guest and want to exercise your rights, please contact your host first (see section 8).
2. What we process
Hosts
- Account data: email address, a securely hashed password (we never store your password in readable form), and the time you signed up.
- Property data: the names, addresses, country and settings of the properties you add, and the check-in information you choose to share with guests.
- Booking data: the stays you add or that guests create through your link, and their status.
- Billing data: the bank-transfer reference we use to match your payment. We do not receive or store card numbers.
- Login sessions: a random session token, valid for 30 days or until you log out.
Guests (processed for the host)
- Full name, date of birth, nationality, travel document type and number, home address, purpose of stay, and stay dates and party size.
- The photo of the travel document is not sent to us. When a guest scans a document, the text is read by software running in their own browser and only the resulting fields are sent.
Technical data
- IP addresses, used briefly to limit abuse (for example repeated login attempts). These counters expire automatically within an hour.
- Standard server logs kept by our hosting provider for security and troubleshooting.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the host account and dashboard | Performance of a contract (Art. 6(1)(b)) |
| Registering guests so the host can meet legal reporting and record-keeping duties (for example to the Czech or Slovak foreign police) | The host's legal obligation (Art. 6(1)(c)); we process on the host's behalf |
| Security, preventing abuse and fraud, keeping the service running | Our legitimate interests (Art. 6(1)(f)) |
| Confirming a host's email address and sending service messages about their account | Performance of a contract and our legitimate interests |
| Meeting our own legal obligations (for example tax and accounting) | Legal obligation (Art. 6(1)(c)) |
We do not use personal data for advertising, we do not build marketing profiles, and we do not make automated decisions that have legal effects on anyone.
4. Who receives data
- The host of the property a guest registers for.
- Public authorities that the host is legally required to report to. Today the host submits reports themselves; ArriveCasa does not yet file with authorities on a host's behalf.
- Service providers (sub-processors) who help us run the service, listed below.
| Provider | What they do for us |
|---|---|
| Vercel Inc. | Hosts the website and application servers |
| Redis Ltd. (Redis Cloud) | Hosts the database where accounts, properties and bookings are stored |
| Resend (Plus Five Five, Inc.) | Sends account emails such as email confirmation, once that feature is switched on |
| Cloudflare (cdnjs) and jsDelivr | Serve the open-source text-recognition library and its language files, only when a guest chooses to scan a document |
Our typefaces are hosted on our own servers, so your browser does not contact Google or any font service when a page loads. We do not sell personal data and we do not share it with anyone else except where the law requires it.
5. Transfers outside the European Economic Area
Some providers above are based in, or may process data in, the United States or other countries outside the EEA. Where that happens we rely on the safeguards the GDPR allows, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. You can ask us for details at the address in section 10.
6. How long we keep data
- Host accounts and properties: for as long as the account exists. You can delete your account and all its data yourself in Settings, or ask us to.
- Guest registration data: kept for the host until the host deletes it, or until the host's own "Guest data retention" settings remove it automatically. Hosts are responsible for keeping their own records for the period their country's law requires (see the compliance pages in the dashboard), and for exporting or being emailed a copy before that data is deleted.
- Login sessions: up to 30 days. Email confirmation links: 24 hours. Abuse-prevention counters: under one hour.
- Accounting records: for as long as tax and commercial law require.
Hosts can delete individual bookings (together with their guests' details), whole properties, or their entire account themselves in the dashboard at any time, and deletion removes the data from our database. Hosts can also turn on, in Settings, an automatic email of each stay's guest details after checkout, and/or automatic deletion of a guest's document and address details a couple of weeks after checkout — both off by default. Turning on automatic deletion does not change how long a host is legally required to keep their own records; it only affects how long ArriveCasa itself holds the data.
7. How we protect data
- All connections use HTTPS encryption.
- Passwords are stored only as salted hashes, and login attempts are rate-limited.
- Guest data is visible only to the host who owns the property, and each guest can reach only their own check-in.
- Text entered on our forms is filtered so it cannot be used to inject code into other users' screens.
- Guest document photos never leave the guest's device.
No online service can promise perfect security. If a breach affects personal data, we will notify the affected hosts without undue delay and support them in meeting their own notification duties.
8. Your rights
Under the GDPR you may have the right to access your data, have it corrected, deleted or restricted, receive a copy in a portable format, and object to certain processing. Where processing is based on consent, you can withdraw it at any time.
- Hosts: write to us and we will respond within one month.
- Guests: your host decides how your registration data is used, so please contact your host first. You can also write to us and we will pass your request to the host and help them respond.
You also have the right to complain to a data protection authority, for example the Spanish Agencia Española de Protección de Datos (where we are established) or the authority in your own country, such as the Czech Úřad pro ochranu osobních údajů or the Slovak Úrad na ochranu osobných údajov.
9. Cookies and browser storage
We do not use advertising or analytics cookies. We store a small amount of information in your browser only to make the service work:
- Hosts: your login session and which property you have selected.
- Guests: your chosen language, and a key that lets you return to your own check-in on the same device.
Because this storage is strictly necessary to provide the service you asked for, it does not require consent.
10. Contact and changes
Lidus Mila Group SL, Spain — casamilocasa@gmail.com.
We may update this policy as the service grows (for example when automatic filing with authorities is added). We will change the date at the top, and tell hosts about significant changes.