Privacy Notice

1. Who is responsible for your data

OkDirect is operated by Championship Shot Limited, registered in Hong Kong under number 79331137, with its registered office at Unit B6, 12th Floor, Wing Wah Building, No. 677 King's Road, Quarry Bay, Hong Kong. Our representative in the European Union under Article 27 GDPR is Alexandru Buzaianu, Str. Feleacu nr. 7, bl. 11F, sc. 3, ap. 11, Bucharest, Romania. For anything about your data, write to [email protected].

Hosts' accounts, our own pages and billing: we are the controller.

Guests' booking data, including payment proofs: the host whose site you book on is the controller, and we process that data on the host's behalf, as their processor. Where we use it for our own purposes (keeping the service secure, preventing fraud and abuse, meeting our legal duties) we are a controller for that part.

2. What data we handle

About hosts:

• your email address, name and, if you give it, your phone number;
• the listing links and calendar (iCal) links you give us, and the text and photos we import from your public listing at your request, which may include your name or photo as they appear there;
• the payment details you show guests (account holder, IBAN, bank, payment link) and, if you choose, your Instagram username;
• your subscription: plan, invoices and, from Stripe, only the card brand and its last four digits (we never see the full card number);
• records of what you agreed to: which version of the Terms and when, and whether you asked for our tips and news by email;
• the messages you send us.

About guests:

• your name, phone number and, if you give it, your email address; the dates, the number of guests and any message you send with the booking;
• the payment proof you upload (a PDF or a photo) and the details read from it: names, account, amount, date, reference and status of the transfer;
• if the host asks for it, the confirmation of your phone number or email with a one-time code.

About everyone: technical data our servers receive with each request, such as your IP address, browser type, the page asked for and the time, plus the few things your browser stores for our pages (section 7). Only if you accept statistics cookies: how you use our pages (clicks, scrolling and a replay of the screen, with anything you type and personal details masked) and errors in the page (sections 4 and 7).

We don't ask for sensitive data, such as ID documents or health details, and we ask you not to put it in messages or proofs.

3. Why we use it, and on what legal basis

• To create and run your account and site, import your listing, sync your calendars and send you sign-in codes and booking notices: to perform our contract with you (Article 6(1)(b) GDPR).
• To bill the subscription and keep accounting records: our contract with you and our legal obligations (Article 6(1)(b) and (c)).
• To pass a guest's booking to the host and check payment proofs: on the host's instructions, as their processor. The host relies on taking the steps a guest asks for before and under the stay contract, and on their legitimate interest in not being defrauded.
• To keep the service secure and prevent fraud, spam and abuse, and to defend legal claims: our legitimate interests (Article 6(1)(f)).
• To prepare a draft site from a public listing and show it to that listing's host: our legitimate interest in showing hosts what we can build for them. We use only what the listing shows publicly, the draft is visible only through its link, and it is deleted if it isn't claimed within 30 days of its last visit. You can object at any time.
• To see how our pages are used (for example how many sites are built and go live) and to find errors: your consent (Article 6(1)(a)), given in the cookie card at the bottom of our pages (Accept all, or Analytics in its Settings; Analytics includes screen recordings and heatmaps). You can withdraw it at any time with Cookie settings, at the bottom of every page.
• To send you tips and news by email: your consent (Article 6(1)(a)), only if you ticked the box. You can withdraw it at any time.

The payment-proof check is automatic, but a proof that doesn't pass never rejects a booking on its own: the host decides. We make no other automated decisions about you.

We don't sell personal data, we don't use it for advertising, and we don't build advertising profiles.

4. Who else receives it

The host receives the booking details of guests who book on their site, and guests see what the host publishes, including the payment details needed to pay. Guests and hosts then usually talk on WhatsApp, under WhatsApp's own terms; we only open the chat and don't see it.

We use these service providers (our sub-processors), each only for its task:

• Hetzner Online GmbH (Germany): the servers and storage where OkDirect runs and your data is kept.
• Cloudflare, Inc.: network, security and delivery of our pages.
• Twilio SendGrid: sending our emails, such as sign-in codes and booking notices.
• Vonage: sending one-time codes by text message or email, to confirm a phone number or an email address.
• Stripe: card payments and the subscription. Stripe is also responsible on its own for some data, for example to prevent fraud and meet its legal duties, under its own privacy policy.
• PostHog, Inc. (data hosted in the EU, eu.posthog.com): usage statistics and error reports, only if you accept Analytics. Then we record how you use our pages, to make them better: the pages you open, clicks and scrolling, a replay of the screen and where people click (screen recordings and heatmaps, which are part of Analytics). Anything you type, and personal details on screen such as names, phone numbers, emails or messages, are masked and never recorded. Errors in the page are reported to us so we can fix them. It all goes with a random identifier; for a signed-in host, one we derive from the account, which doesn't reveal the email. Like any site your browser contacts, it sees your IP address.
• Google (Gemini API, paid service): reading payment proofs we can't read on our own servers, that is photos, scans and PDFs whose details are missing. Under the paid service's terms, Google doesn't use this content to improve its products.

Our pages also load content from other services, which see your IP address when they do:

• Google Fonts, for the font of our pages;
• OpenStreetMap, for the map on a host's site.

If a host turns on push alerts, booking details also go to the alert service the host chose. Booking.com and Airbnb only read the host's calendar from us, which shows busy dates and no guest details. We may also share data when the law requires it, or with a company that takes over the service, which then keeps this notice.

5. Transfers outside the EU

Our servers are in the EU. Stripe, Google, Twilio SendGrid, Vonage and Cloudflare are based in the United States and may process data there. PostHog is also based in the United States: it keeps our usage statistics in the EU, but its staff may access them from there. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise.

Our company is based in Hong Kong, which has no EU adequacy decision. When our team accesses data from outside the EU, we apply the same GDPR protections described here.

6. How long we keep it

• Host accounts and sites: while your account is active. When you close it or ask us to delete your site, we delete them, except what we must keep by law.
• Billing and invoices: as long as accounting and tax law requires, which can be up to 10 years.
• Guest bookings and payment proofs: for as long as the host keeps them on their site, and deleted at the latest when the host's site is deleted, unless they are needed for a dispute or the law requires longer.
• Draft sites nobody claimed: deleted 30 days after their last visit.
• Server logs: only as long as needed for security and fixing problems.
• Usage statistics: only as long as we need them to understand how the service is used and to fix errors.
• Your consent to emails: until you withdraw it, and the record of it as long as we may need to prove it.

7. Cookies and browser storage

We use no advertising cookies. Our pages store only what they need to work: a cookie that keeps you signed in, and in your browser's storage your language choice, the key to a draft you are building, your setup progress, and, for guests, the link to their own booking. Because these are strictly necessary, they don't need your consent. Usage statistics and the screen replay (PostHog, section 4) only start after you accept Analytics in our cookie card. Analytics is one choice and covers the pages you open, clicks and scrolling, and screen recordings and heatmaps (a replay of the screen, with anything you type and personal details masked). Only then do we record how you use the pages and save a random identifier in a cookie and in your browser's storage. Until you accept, nothing is recorded or sent to PostHog, and if you withdraw your consent, the recording stops and that identifier is deleted. Our cookie card is our own: it saves your choice (each category, and when) in your browser's storage, so it doesn't ask again on every page, and asks again after 12 months or if we change what it covers. When you accept, we also note that you did, with the date, the card's version and the categories, in the same statistics, so we can show you agreed; Only necessary is not sent anywhere. Each guest site keeps its own choice. You can change it at any time with Cookie settings at the bottom of every page, or here. If we ever add anything else, we will ask first.

Change your cookie choice

8. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict how it is used, to receive it in a portable format, to object to uses based on legitimate interests, and to withdraw a consent at any time, without affecting what was done before.

Write to [email protected]. We answer within one month and may ask you to confirm who you are. If you are a guest and your request is about a booking, the host decides on it as the controller; you can ask the host directly, or ask us and we pass it on and help.

You can also complain to a data protection authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, dataprotection.ro. You can also complain in the EU country where you live or work.

9. Security

We protect data with encrypted connections, limited access, sign-in by one-time code instead of passwords, and restricted file permissions on our servers. No system is perfectly secure; if a breach puts your data at risk, we tell the authority and, where the law requires, you.

10. Changes to this notice

We update this notice when what we do with data changes; the date at the bottom shows the latest version. We tell hosts about important changes by email before they apply.