Privacy Policy

This Privacy Policy explains how David Balík (“Upsty”, “we”, “us”) collects, uses, shares and protects personal data when you use the Upsty website and services (the “Service”). We are committed to processing personal data in line with the EU General Data Protection Regulation (GDPR) and applicable local law.

1. Who we are

The data controller for personal data processed through the Service is David Balík, Naardenská 691/2b, 162 00 Praha 6 – Liboc, Czech Republic, Business ID (IČO) 07075731 (Czech Republic). For any privacy question or to exercise your rights, contact us at david@getupsty.com.

2. The people this policy covers

• Hosts — people who create an Upsty account to offer upsells to their guests.
• Guests — people who receive and may purchase an upsell offer for a stay.
• Visitors — people who browse our website.

Note on guest data. Much of the guest information we process (name, contact details, stay dates) originates from a Host’s connected calendar or booking platform. For that data the Host generally acts as the data controller and Upsty acts as a data processor on the Host’s behalf, processing it only to provide the Service.

3. What data we collect

Host account data

• Name, email address and (optionally) phone number and profile photo.
• Property details you enter (name, address, settings, calendar/iCal links, custom offers).
• Your payout account identifier from our payment provider (we never store full card or bank details).

Guest & reservation data

• Guest name and contact details and stay dates, imported from your connected calendar or booking source, or entered manually.
• Which offers were sent, viewed, accepted, declined or refunded.

Payment data

• Payments are processed by Stripe. Card details are entered directly with Stripe and are never received or stored by us. We keep transaction metadata (amounts, currency, commission, Stripe payment reference, status).

Technical & usage data

• Log data such as IP address, browser type and pages visited, and essential cookies needed to keep you signed in.

4. How and why we use data (legal bases)

• To provide the Service — create accounts, sync reservations, generate and deliver upsell offers, process payments and payouts. Legal basis: performance of a contract.
• To send transactional notifications — e.g. telling a Host or their cleaner that an offer was purchased. Legal basis: contract / legitimate interests.
• To operate, secure and improve the Service — troubleshooting, fraud prevention, analytics on aggregate usage. Legal basis: legitimate interests.
• To comply with the law — accounting, tax and responding to lawful requests. Legal basis: legal obligation.

5. Who we share data with

We do not sell personal data. We share it only with service providers who help us run the Service, under appropriate data-processing terms:

• Stripe — payment processing and payouts.
• Supabase — database, authentication and storage.
• Vercel — application hosting and privacy-friendly, cookieless traffic analytics (aggregate page views, no tracking cookies).
• Resend — sending transactional emails.
• Calendar / booking sources you connect (e.g. Airbnb, Booking.com) from which reservation data is imported.

We may also share data where required by law, or in connection with a merger, acquisition or sale of assets.

6. International transfers

Some providers may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep data

We keep personal data for as long as your account is active and as needed to provide the Service. After an account is closed we retain data only as long as necessary for legitimate business or legal purposes (for example, transaction records kept for accounting and tax obligations), then delete or anonymise it.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. To exercise these rights, email david@getupsty.com.

If you are a Guest and want your data corrected or deleted, please also contact the Host who invited you, as they may be the controller of that data. You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

9. Cookies

We use only essential cookies required to keep you securely signed in and to operate the Service. We do not use advertising cookies. Because these cookies are strictly necessary, they do not require consent.

10. Security

We use technical and organisational measures to protect personal data, including encryption in transit, access controls and reputable infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the authorities of a breach where legally required.

11. Children

The Service is intended for business users and is not directed at children. We do not knowingly collect data from anyone under 16.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the “Last updated” date. Material changes may be communicated by email.

13. Contact

Questions about this policy or your data? Email david@getupsty.com or write to us at David Balík, Naardenská 691/2b, 162 00 Praha 6 – Liboc, Czech Republic.