Privacy Policy

1. Who we are and scope of this policy

Merca Stays ("we", "us", "our") operates the booking platform available at our website (the "Platform"), through which guests discover, reserve and pay for stays at curated holiday properties. This Privacy Policy describes how we collect, use, share, retain and protect your personal data when you visit the Platform, create an account, sign in with Google, or complete a booking.

We act as the data controller for the personal data described below. If you have questions, you can reach us at ceomerca@gmail.com.

2. What data we collect and why (purposes and legal basis)

• Account data (name, email, password hash, Google profile): collected to create and secure your account and to authenticate you. Legal basis: performance of a contract and your consent when you choose Google Sign-In.
• Booking data (property, dates, guest count, room, travel purpose, arrival time): collected to process your reservation, calculate the correct price, and coordinate your stay with the property owner. Legal basis: performance of a contract.
• Identity verification data (date of birth, ID document type and number, front and back images of your ID): collected because short-term rental regulations require hosts to register guest identity. Legal basis: compliance with a legal obligation.
• Payment data (amount, booking reference, Stripe identifiers): collected to charge you and issue refunds. Card numbers are handled exclusively by Stripe and never reach our servers. Legal basis: performance of a contract.
• Communication data (email notifications, host messages): used to send booking confirmations, reminders and service information about your stay.
• Usage and analytics data (pages viewed, device, approximate region, referral source): collected in aggregated or pseudonymized form via Google Analytics to understand how the Platform is used and improve it. Legal basis: our legitimate interest in operating and improving the Platform. You may opt out through your browser or analytics settings.

3. Google Sign-In

If you choose "Continue with Google", Google shares your basic profile information (name, email address and profile picture) with us to create and sign you into your account. We use this data only for authentication. Your Google password is never visible to us, and you can revoke Merca Stays’s access at any time from your Google account security settings.

4. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and maintain your language preference, and analytics cookies (via Google Analytics) to measure traffic. Your browser lets you block or delete cookies at any time; the Platform will continue to work, though some convenience features may be lost.

5. How your data is shared

We never sell your personal data, and we do not share it for advertising purposes.

• Property owners: for a booking you make, the owner of that property receives your name, stay details and (as required by rental regulations) access to your identity documents through a secured owner portal. Access is limited to the owner of the property you booked.
• Payment processor (Stripe): processes your payment under its own privacy policy, available at stripe.com.
• Infrastructure providers: our hosting, database, email delivery and calendar providers process data on our behalf under data-processing agreements, strictly to deliver the service.
• Legal authorities: guest registration data may be disclosed to competent authorities where required by local short-term rental regulations.

6. Data retention

Booking and identity verification records are retained for the period required by applicable rental-registration laws (typically up to 5 years after the stay) and then deleted. Account data is retained while your account is active; you may request deletion at any time. Analytics data is retained in pseudonymized form for a maximum of 14 months.

7. Security

Identity documents are uploaded to private, access-controlled storage and are only ever served through short-lived signed links — they are never publicly accessible. Access is restricted to you, the Merca Stays founder, and the owner of the property you booked. Connections to the Platform are encrypted with TLS, and we apply least-privilege access controls throughout our systems.

8. International data transfers

Our providers may process data in countries outside your own. Where this happens, transfers are safeguarded by the provider’s standard contractual clauses or equivalent mechanisms.

9. Children

The Platform is intended for users aged 18 and over, and listings specify a minimum guest age. We do not knowingly collect data from children.

10. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, request correction or deletion, object to or restrict certain processing, and receive a copy of your data in a portable format. To exercise any of these rights, email ceomerca@gmail.com. Google Sign-In users can additionally revoke platform access from their Google account. You may also lodge a complaint with your local data protection authority.

11. Changes to this policy

We may update this Privacy Policy from time to time; the "last updated" date above always reflects the current version, and material changes will be highlighted on the Platform.

12. Contact

Questions, requests or concerns about privacy can be sent to ceomerca@gmail.com.