Privacy Policy

1. Who Controls Your Data

For guest identity data collected during ESTI self-registration, your host (the Airbnb or property host who invited you) is the data controller — they decide why and how your data is registered, as required by Bulgarian tourist-registration law. Smarthoster-bg processes that data only on the host's behalf and instructions, acting as their data processor.

For data about hosts themselves — your account, contact email, and admin login — Smarthoster-bg (MAT-DZHI EOOD) is the data controller.

2. What Data We Collect

Guest identity data: name, date of birth, gender, nationality, document type and number, and (for Bulgarian citizens) the EGN/personal number — the minimum set required by the ESTI registration form. We do not collect payment details, contact information, or travel history from guests.

Host account data: your name or business name, contact email, and a hashed admin login key. If you connect Gmail booking sync, your Gmail app password is stored encrypted so we can read booking-confirmation emails on your behalf.

Gmail access, specifically: we connect to your mailbox over standard IMAP/SMTP using the app password you generate and can revoke at any time from your Google Account — we do not use the Gmail API or OAuth for this. We only ever read the booking-confirmation emails needed to detect new reservations, and only send the cohost notification emails you've enabled; we never read, use, or share any other mail in your inbox, and this mailbox access is never used for advertising or to train AI/ML models. If we later move this integration to Google's own Gmail API, our use and transfer of any information received through it will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Property content: photos, videos, and descriptions you upload for your property's guest guide and personal site.

Technical data: IP addresses recorded in security logs (failed login attempts, rate limiting) and in the audit log of guest-data exports.

3. How Documents Are Scanned

When a guest scans their ID or passport, the photo is processed entirely on the guest's own device, in their browser — the image itself is never uploaded to our servers or to any third-party OCR service. Only the extracted text fields (name, date of birth, and so on), which the guest reviews and can correct before submitting, are sent to us to complete the registration.

4. Legal Basis for Processing

Guest identity data is processed to comply with a legal obligation (Art. 6(1)(c) GDPR) — Bulgaria's mandatory tourist registration law.

Host account data is processed to perform our contract with you (Art. 6(1)(b) GDPR).

Security logs and audit records are processed on the basis of our legitimate interest in keeping the Service secure (Art. 6(1)(f) GDPR).

5. How Long We Keep Data

Our purpose is to help complete ESTI registration and get you a ready-to-upload export — once your host has downloaded that export, our job for that guest is done, so we cap how long we keep guest identity data on our own servers. A host can enable automatic deletion between 1 and 30 days after export (a short buffer in case they need to re-download a lost file), and we delete it automatically at that point. Where a host hasn't enabled automatic deletion, you can request removal directly from them, or contact us for assistance.

The underlying booking record (dates, room, price) is not personal data and may be kept by the host for their own records after guest identity data is deleted.

Host account data is kept for as long as your account is active, plus any period required by law afterward. Security and audit logs are kept only as long as needed for security and legal-compliance purposes.

6. Who We Share Data With

Nobody, automatically. The Service does not connect to or submit data to the ESTI portal itself — it only prepares a ready-to-upload export file. Your host reviews that file and uploads it to esti.tourism.government.bg themselves; the Bulgarian Ministry of Tourism receives your data directly from your host, not from us.

Our infrastructure providers, who host the Service and store property media: Oracle Cloud Infrastructure, which hosts our application server and database (located in the EU), and Cloudflare, whose EU-region object storage holds property photos and videos.

We do not sell data, use it for advertising, or share it with any other third party, except where required by law.

7. International Transfers

Our infrastructure is located within the EU. Guest identity data does not leave the EU/EEA as part of the Service.

8. Your Rights

If you're a guest: contact your host first — they are the data controller for your registration data, and can request access, correction, or deletion on your behalf, or forward your request to us. Under GDPR you have the right to access, rectify, erase (subject to the legal registration obligation), restrict, or object to the processing of your data, and the right to data portability where applicable.

If you're a host: you can access, export, or delete your account data at any time through the admin dashboard, or by contacting us at support@smarthoster-bg.com.

Everyone has the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) — www.cpdp.bg — or the supervisory authority in their own EU country of residence.

9. Cookies and Local Storage

We use one strictly necessary, httpOnly login cookie to keep hosts signed in to the admin dashboard, and store your language preference in your browser's local storage. We do not use analytics, advertising, or tracking cookies.

10. Security Measures

Guest identity fields are encrypted at rest (AES-256-GCM, with a fresh random nonce per value); admin login keys are stored as one-way hashes, never in plain text; all traffic runs over HTTPS; and every export of guest data is recorded in an audit log.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Service or the law. We will publish the updated version here with a new "last updated" date.

12. Contact

MAT-DZHI EOOD

Company registration number (EIK): 203449792

Registered address: Sofia, Suhata Reka bl.110 ent.A fl.1 ap.1

Email: support@smarthoster-bg.com

Supervisory authority: Commission for Personal Data Protection (CPDP), www.cpdp.bg