Privacy Policy

Last Updated: 13 April 2026. This policy is provided in compliance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Who We Are and How to Contact Us

YourGuide (“we”, “us”, “our”) is the data controller responsible for your personal data. We are a business based in Waterford, Ireland, operating the platform at yourguide.ie, which enables property hosts to create, manage, and share digital and printed property guidebooks.

Our lead supervisory authority under GDPR is the Irish Data Protection Commission (DPC), located at 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.

For any privacy-related questions or requests, contact us at: support@yourguide.ie.

2. Who This Policy Applies To

This policy applies to two distinct groups of people who interact with YourGuide:

Hosts - property owners or managers who create an account, pay for a subscription or one-time purchase, and use YourGuide to build and publish guidebooks.
Guests - individuals who visit a Host’s PIN-locked guidebook page to access property information. Guests do not create accounts.

3. The Data We Collect

3.1 Host Data

When you create and use a YourGuide account, we collect:

Identity & Contact: Your email address, used exclusively to send you secure Magic Login links and transactional service notifications.
Property Content: Information you explicitly enter into your guidebook - including your property name, address, Wi-Fi credentials, check-in and check-out instructions, house rules, host contact number, and local recommendations.
Billing Data: Your Stripe customer ID and subscription status. We never see or store your full card number, CVV, or bank account details - these are handled entirely by Stripe.
Usage & Technical Data: Your browser type, device, approximate location (country/region level), and pages visited on our website, collected via Google Analytics in anonymised form.
Guest Access PIN: The four-digit PIN you set to restrict access to your hosted guidebook. This is stored in our database and controlled entirely by you.

3.2 Guest Data

Guests do not create accounts and are not required to provide any personal information to view a guidebook. We collect:

Anonymous Usage Data: Page view counts and device/browser type, collected via Google Analytics. This data is anonymised and aggregated; we cannot identify individual guests from it.
Session Cookie: A short-lived, HttpOnly cookie is set after a Guest enters the correct PIN. This cookie stores only a verification token - no personal data - and expires when the browser session ends or the Host changes the PIN.

4. Lawful Basis for Processing

Under GDPR Article 6, we rely on the following lawful bases to process Host personal data:

Processing Activity	Lawful Basis	Details
Sending Magic Login links	Performance of a Contract	Necessary to provide access to the service you have paid for.
Generating and storing your guidebook content	Performance of a Contract	Core to the service you have purchased.
Processing your subscription payment via Stripe	Performance of a Contract	Required to complete your purchase and maintain your subscription.
Rendering your PDF via API2PDF	Performance of a Contract	Necessary to deliver the PDF product you have ordered.
Website analytics (Google Analytics)	Legitimate Interests	We have a legitimate interest in understanding how our platform is used in order to fix bugs and improve the service. Data is anonymised and aggregated.
Retaining transaction records	Legal Obligation	Irish and EU financial regulations require us to retain payment and invoice records for a minimum period.

For Guest data, anonymous analytics are processed on the basis of our Legitimate Interests in understanding platform usage. No personal data is processed for Guests beyond the anonymised analytics described above.

5. Data Sharing and Third-Party Processors

We do not sell, rent, or trade your personal data. We share data only with the trusted sub-processors listed below, each bound by data processing agreements and required to process data only on our instructions.

5.1 Our Sub-Processors

Processor	Purpose	Data Shared	Location
Supabase	Database and authentication	Email address, guidebook content, billing status	EU (AWS Frankfurt)
Stripe	Payment and subscription processing	Email address, purchase amount, subscription status. Card details are processed directly by Stripe - we never receive them.	USA / Ireland (EEA)
Brevo	Transactional email delivery	Email address, one-time Magic Link token	EU (France)
API2PDF	PDF rendering	Your guidebook HTML content, transmitted momentarily during rendering only. No data is retained by API2PDF after the PDF is returned.	USA
Cloudflare	Website hosting and edge security	IP addresses and request metadata, processed ephemerally for routing and DDoS protection	Global edge network
Google Analytics & Search Console	Anonymous web analytics and search performance	Anonymised page views, device type, approximate geographic region (country level). No personally identifiable information.	USA

6. International Data Transfers

Some of our sub-processors - including Stripe, API2PDF, Cloudflare, and Google - operate infrastructure or headquarters outside the European Economic Area (EEA), primarily in the United States.

Where personal data is transferred outside the EEA, we ensure an equivalent level of protection is maintained by relying on one or more of the following safeguards:

Standard Contractual Clauses (SCCs) - the EU Commission-approved model clauses for international data transfers, incorporated into our data processing agreements with each relevant processor.
Adequacy Decisions - where the European Commission has determined that a country ensures an adequate level of data protection.

You may request a copy of the safeguards in place for any specific transfer by emailing us at support@yourguide.ie.

7. Data Retention

We keep your data only for as long as it is necessary for the purposes set out in this policy:

Active Host accounts: All account and guidebook data is retained for the duration of your active subscription or service relationship with YourGuide.
Cancelled or lapsed accounts: Following cancellation or expiry, your guidebook content and account data will be deleted from our active systems within 90 days. Anonymised usage statistics may be retained indefinitely as they cannot be used to identify you.
Billing and transaction records: Financial records associated with your purchases are retained for 7 years to comply with Irish and EU accounting and tax obligations, even after account deletion.
Guest session data: PIN verification cookies expire at the end of the browser session. No persistent Guest data is stored by YourGuide.

8. Your GDPR Rights

As a data subject under GDPR, you have the following rights in relation to your personal data. To exercise any of them, email us at support@yourguide.ie. We will respond within 30 days.

Right of Access (Article 15): You have the right to request a copy of all personal data we hold about you and information about how we process it.
Right to Rectification (Article 16): You can correct any inaccurate or incomplete personal data. Most of your property data can be updated directly from your dashboard.
Right to Erasure / Right to be Forgotten (Article 17): You can ask us to delete your account and all associated personal data. Note that we may be required to retain certain billing records for legal compliance purposes (see Retention, above).
Right to Restriction of Processing (Article 18): You can ask us to temporarily halt processing of your data while a dispute over accuracy or lawful basis is resolved.
Right to Data Portability (Article 20): Where processing is based on your consent or a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
Right to Object (Article 21): You have the right to object to processing based on Legitimate Interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision-Making (Article 22): YourGuide does not carry out any automated decision-making or profiling that produces legal or similarly significant effects.

9. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority. As an Irish-based data controller, our lead supervisory authority is the Irish Data Protection Commission (DPC):

Website: dataprotection.ie
Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
Phone: +353 (0)76 110 4800

We would, however, always appreciate the opportunity to address your concern directly before you contact the DPC. Please reach out to us first at support@yourguide.ie.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing practices. When we make material changes, we will update the “Last Updated” date at the top of this page and, where appropriate, notify active Hosts by email.

Continued use of YourGuide after any update constitutes your acknowledgement of the revised policy.