Privacy Policy

1. Who we are

CatStay (cat-stay.com, “CatStay”, “we”) is an online platform where cat owners find people who look after cats. CatStay is the controller of the personal data described in this policy.

For any privacy question or request, write to privacy@cat-stay.com.

2. Data we collect

• Account: email address, first and last name, role (owner, sitter or both). Passwords are stored only as a salted hash.
• Google sign-in: if you sign in with Google, we receive your Google account ID, email address, whether Google has verified it, and your name. We never receive your Google password.
• Profile: photo, about-me text, languages and other details you choose to add.
• Address and location: street address, postal code, city, country and the map coordinates derived from them.
• Pets: names, photos, health, behaviour, feeding and care notes.
• Sitter services: services offered, prices, availability and experience.
• Activity: bookings, messages, photo reports, reviews, favourites and ratings, and feedback you send us through the feedback form (with your name and email if you give them).
• Technical data: IP address, browser user agent, request logs and security events.

3. How your location is shown

Other users never see your exact address on the map. Search results and public profiles show a point 100–500 m away from it. The full address is shown only to the other party of a confirmed booking.

4. Why we use your data

• To provide the service — account, search, public sitter profiles, bookings, chat and photo reports (performance of a contract, Art. 6(1)(b) GDPR).
• To keep the service secure, prevent abuse, fix errors and make backups (legitimate interests, Art. 6(1)(f) GDPR).
• To comply with legal obligations (Art. 6(1)(c) GDPR).

We do not sell personal data, do not build advertising profiles and do not take decisions with legal effect based solely on automated processing.

5. Who receives your data

• Other users — what you publish in your profile, listings, messages and reviews, as described above.
• Amazon Web Services — hosting (servers in the EU, Spain region), backups and content delivery (CloudFront).
• Google — Google Analytics (see section 7) and, if you use it, Google sign-in.
• OpenStreetMap Foundation (Nominatim) — the address text you enter, to turn it into map coordinates. No name or email is sent.
• Public authorities — only when the law requires it.

6. Transfers outside the EU

Your data is stored in the EU. CloudFront delivers pages from servers around the world, and AWS and Google may process data outside the EU. Such transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses.

7. Cookies, local storage and analytics

Cookies the service needs to work (no consent required):

• access_token — keeps you signed in (15 minutes).
• refresh_token — renews your session (7 days).
• google_oauth — protects Google sign-in against forgery (10 minutes).
• NEXT_LOCALE — remembers the language you chose.

The site also keeps display preferences, such as turning animations off, in your browser’s local storage.

Google Analytics runs without cookies by default and stores no identifier on your device. Only if you click “Accept” in the cookie banner does it also set the analytics cookies _ga and _ga_* (up to 2 years) to recognise repeat visits; your choice is kept in local storage and can be changed at any time with “Cookie settings” at the bottom of every page. Google receives the page address, the referring page, the browser and device type and an approximate location derived from the IP address; Google Analytics does not store IP addresses. Legal basis: your consent for the cookies (Art. 6(1)(a) GDPR), otherwise our legitimate interest (Art. 6(1)(f) GDPR). We do not use advertising cookies.

Our own visit log: our server records the pages you open, your searches, your IP address and browser and, if you are signed in, your account. If you allow the browser to share your location on the map, those coordinates are recorded too. We use the log to understand and improve the service and to detect abuse (legitimate interest, Art. 6(1)(f) GDPR) and delete entries after 90 days.

8. How long we keep data

We keep your data while your account exists. After you delete your account we delete or anonymise your data within 30 days, except data we must keep by law. Messages and reviews that belong to another user’s booking history are anonymised rather than deleted. Server logs are kept for a limited time, and backups are overwritten on a rolling basis.

9. Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, to data portability, and to withdraw consent at any time.

Most details can be edited in your profile. To get a copy of your data or to delete your account, write to privacy@cat-stay.com from the email address of your account. We reply within one month.

You may also complain to a data protection authority — in Spain the Agencia Española de Protección de Datos (aepd.es) — or to the authority where you live.

10. Security

Passwords are hashed, sessions use httpOnly cookies, all traffic is encrypted with HTTPS and access to the servers is restricted. No system is completely secure; if a breach affects your data, we will inform you and the authority as the law requires.

11. Age

CatStay is for adults (18+). We do not knowingly collect data of children.

12. Changes

We may update this policy. The date at the top shows the current version. We will inform registered users on the site or by email before significant changes take effect.