Last updated: 27 October 2026
Controller
JustStay GmbH is the controller. You can find the address and other ways to reach us in the legal notice. Please send questions about data protection to info@juststay.de.
What we process
- Property, origin (QR code in the property, QR code in the room or link in our email), language and rough device type (smartphone or computer).
- Your ratings (overall and individual areas), your text and your answers to follow-up questions.
- Optional: room, email address and whether you would like a reply or the thank-you voucher.
- Your booking number, only if you come from the link in our email after your stay and send feedback to the team. It is used solely to match your feedback and any complaint to your stay. We do not use it for statistics or on the way to Google. If you send anonymously, we do not transmit it.
- The version of this notice that you saw.
You can send anonymously. Then we store neither your email address nor your booking number. If you come via a room QR code or name a room, the team may still be able to match the feedback to a stay via room and dates.
Purposes and legal bases
- Handling your feedback, fixing issues and improving our service, including the statistics. The legal basis is our legitimate interest in good quality and in handling feedback (Art. 6(1)(f) GDPR).
- A reply by email, a confirmation and the voucher, only if you choose them. The voucher does not depend on how you rate us or on whether or how you review us publicly. The legal basis is Art. 6(1)(b) GDPR (your request or the promised thank-you).
Statistics without cookies
We count how often these pages are opened and which option is chosen. For this we use a random session ID in the page address, no cookies. We store property, origin, language and device type, but no IP address and no booking number. We delete this data after 90 days.
Forwarding to Google
If you choose to write a public review, we forward you to the review form, for example on Google. We only store that this option was chosen, not who chose it. What you write there is processed by the provider under its own responsibility, for Google by Google Ireland Limited.
Automated analysis
An AI assigns your feedback to topics, detects the sentiment and estimates how urgent a note is. It receives your ratings and texts. Before that, we automatically remove email addresses, phone numbers, links and booking numbers. We cannot reliably detect names in free text. Please do not mention any names, neither your own nor those of staff. The provider is Anthropic. Under its contract terms, Anthropic does not use the data to train AI models and, according to its own information, deletes it within 30 days, with few exceptions (for example in case of usage policy violations). The team makes the decisions. There is no automated decision-making within the meaning of Art. 22 GDPR.
Who sees your information
The responsible team at JustStay sees your feedback. These service providers help us with the technology. They process the data only on our behalf and on our instructions (Art. 28 GDPR):
- Supabase: database and servers, stored in Frankfurt am Main.
- Vercel: delivery of these pages.
- Anthropic: automated analysis, without email addresses, phone numbers, links and booking numbers.
- Resend: sending emails such as the confirmation, a reply or the voucher.
Transfers outside the EU
Anthropic, Vercel and Resend are based in the USA. Supabase is also a US provider, but the data is stored in Frankfurt am Main. For transfers to the USA we rely on the EU-US Data Privacy Framework (adequacy decision of the European Commission) or on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). You can request a copy of the safeguards.
How long we keep data
We delete your email address, booking number and the room stated in your feedback after 12 months. We copy public reviews of our properties, for example on Google, into our system to analyse them and reply to them. We remove the reviewer's name there after 24 months. We delete the page view statistics after 90 days and the check values used to prevent abuse after 2 days at the latest. Emails we send you stay complete in our sending log for 30 days. After that, only subject and recipient remain, and after 90 days we delete them entirely. We keep the analysis without these details longer to see developments over time.
No cookies, no analytics services
These pages set no cookies, store nothing in your browser and use no analytics or advertising services. We do not store your IP address. To prevent abuse, we derive a check value (hash) that changes daily from it when you submit. The address cannot be read from this value. We use it to limit the number of submissions. If you enter an email address, we also derive a check value from it so that the form sends no more than three emails per day to one address. We delete these check values after 2 days at the latest. Our hosting provider processes technically necessary connection data to deliver the pages.
Voluntary
All details are voluntary. Without an email address we cannot reply to you or send a voucher.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can lodge a complaint with a data protection supervisory authority (Art. 77), for example in your country or where JustStay GmbH is based. A message to info@juststay.de is enough.
Your right to object
Where we process data on the basis of our legitimate interest, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal message to info@juststay.de is enough.