Privacy Policy
Last updated: 15/07/2026
Protecting your data matters. Below we explain what we collect, why, on what legal basis, who we share it with and what rights you have, under the General Data Protection Regulation (GDPR – EU 2016/679).
1. Controller
MySpaceRent — https://www.myspacerent.com. For data-protection matters, use the contact form.
2. What we collect
You provide
- Account: name, e-mail, password (stored hashed — we never see it), phone (optional), language, role.
- Two-factor authentication: your TOTP secret, if you enable it.
- Listings (Hosts): title, description, address & coordinates, photos, prices, availability, rules.
- Bookings: dates, amounts, status.
- Messages & reviews: the content you write.
- Support: anything you send through the contact form.
Collected automatically
- Technical: IP address, timestamps, basic logs for security and debugging.
- Session cookie (see the Cookie Policy).
- Device push token, if you use the app and allow notifications.
We do not collect card details — Stripe handles those exclusively. We use no advertising or tracking cookies.
3. Why & on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating & managing your account | Account | Contract (Art. 6(1)(b)) |
| Publishing listings & bookings | Listings, bookings | Contract |
| Payments & refunds | Amounts, Stripe identifiers | Contract |
| User messaging & notifications | Messages, e-mail, push | Contract |
| Content moderation (AI) & security | Text, photos, IP | Legitimate interest (Art. 6(1)(f)): a safe platform free of illegal/abusive material |
| Automatic language selection | Browser settings, IP | Legitimate interest: correct user experience |
| Tax & accounting obligations | Transactions | Legal obligation (Art. 6(1)(c)) |
4. Automated content screening (AI)
Text and photos you upload are screened automatically for inappropriate (e.g. pornographic) or abusive content. Depending on configuration this runs locally on our servers or via OpenAI.
Screening may automatically reject content. No decision producing legal effects is made solely by automated means — you can always request human review via the contact form.
5. Who we share with
| Recipient | Purpose | Data |
|---|---|---|
| Stripe | Payments, refunds, payouts | E-mail, amounts, payment details (provided directly to them) |
| OpenAI (if enabled) | Content moderation | Listing/message text & photos |
| Expo | Push notifications | Device token, notification content |
| ip-api.com (if enabled) | Country lookup for language | IP address |
| OpenStreetMap / Nominatim | Maps & geocoding | Listing addresses, IP when a map loads |
| E-mail (SMTP) provider | Sending notifications | E-mail address, message content |
| Hosting provider | Running the servers | All data (storage) |
Between users: the Host sees your name and booking details; the Guest sees the listing's public details. We never sell your data.
6. International transfers
Some recipients (e.g. Stripe, OpenAI, Expo) may process data outside the EEA. Such transfers rely on Standard Contractual Clauses (SCCs) or a European Commission adequacy decision.
7. Retention
- Account: while active; deleted on request.
- Bookings & invoices: up to 5+ years, due to tax law.
- Messages: while the account exists, as evidence in potential disputes.
- Security logs: a limited period.
- Verification/reset tokens: expire after 24 hours / 60 minutes respectively.
8. Your rights
You have the right of access, rectification, erasure (“right to be forgotten”), restriction, portability, objection to processing based on legitimate interest, and withdrawal of consent where applicable.
To exercise them, use the contact form. We respond within one month.
You may also lodge a complaint with the Hellenic Data Protection Authority (dpa.gr) or your local supervisory authority.
9. Security
- Encrypted connections (HTTPS/TLS) across the platform.
- Passwords stored with modern hashing — never in plain text.
- Optional two-factor authentication (2FA).
- CSRF protection, HttpOnly/SameSite cookies, brute-force protection, automatic security updates.
10. Children
The platform is for adults (18+). We do not knowingly collect data from minors.
11. Changes
Changes will be published here with a new update date. You will be notified of material changes.