Privacy Policy

1. Who Controls Your Data

For guest identity data collected during ESTI self-registration, your host (the Airbnb or property host who invited you) is the data controller — they decide why and how your data is registered, as required by Bulgarian tourist-registration law. Smarthoster-bg processes that data only on the host's behalf and instructions, acting as their data processor.

The same applies to a reservation request sent from a property's site: the host is the data controller for it and Smarthoster-bg processes it on their behalf.

For data about hosts and their teams — your account, contact email, and the admin logins of you and any co-hosts you invite — Smarthoster-bg (MAT-DZHI EOOD) is the data controller.

2. What Data We Collect

Guest identity data: name, date of birth, gender, nationality, document type and number, and (for Bulgarian citizens) the EGN/personal number — the minimum set required by the ESTI registration form. We do not collect card details or travel history from guests, and no contact information apart from what a guest gives in a reservation request (below).

Reservation requests: when a guest asks to book through a property's site, we store their name, the email address and/or phone number they give, the dates, the number of guests, the price they were shown, and the language they used, so the host can confirm or decline the request and the guest can follow its status on their own reservation page. The host's answer is emailed to the guest from the host's own Gmail, or through our email provider if the host hasn't connected Gmail.

Online payments: if a host takes card payment for a direct booking, the guest enters their card details on the host's own myPOS payment page — card details never reach us. We store the order number, the amount, whether and when it was paid, and the myPOS transaction reference, so the host and the guest can see the stay is paid. If the host refunds a payment, we store the refund's amount, date and method. For a host who is a company or sole trader, each online payment also gets a sale document ("документ за регистриране на продажба", as Bulgarian tax rules require) naming the seller, the stay, the amount and the payment — not the guest. Every step of a direct-booking order (request, confirmation, payment, refund, cancellation) is logged with its time and who took it.

Host account data: your name or business name, contact email, and the date and time you accepted the Terms and Conditions and this Privacy Policy at signup. If you connect Gmail booking sync, your Gmail app password is stored encrypted so we can read booking-confirmation emails on your behalf. Any contact details you enter under "Contacts on your sites" (name, ЕИК, address, email, phone) are published on your property sites for anyone to see, until you remove them.

Admin logins: every person with access to a host's dashboard — the owner and any co-hosts they invite from the Team page — has their own login, made up of their email address, a password stored only as a one-way hash (none at all if they only sign in with Google), the time of their last login, and the role and permissions the owner gave them. To invite a co-host, the owner enters that person's email address, and we email them an invitation.

Sign in with Google: if you choose to sign up or sign in with Google, Google confirms your email address to us and that is all we receive — we request only the "openid email" scope, so we get no access to your Google contacts, files, calendar, or mail.

Telegram contacts: if a host connects people to the Telegram daily summary (for example their cleaning team), we store the name the host gives each person and their Telegram chat ID. The messages contain property names, check-in/check-out dates, and guest counts — never guest names or identity data.

Gmail access, specifically: we connect to your mailbox over standard IMAP/SMTP using the app password you generate and can revoke at any time from your Google Account — we do not use the Gmail API or OAuth for this. We only ever read the booking-confirmation emails needed to detect new reservations, and only send the cohost notification emails you've enabled; we never read, use, or share any other mail in your inbox, and this mailbox access is never used for advertising or to train AI/ML models. If we later move this integration to Google's own Gmail API, our use and transfer of any information received through it will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Property content: photos, videos, and descriptions you upload for your property's guest guide and personal site.

Technical data: IP addresses recorded in security logs (failed login attempts, rate limiting) and in the audit log of guest-data exports, which also records the email address of the team member who made each export; and the history of each direct-booking order, which records the email address of the team member who confirmed, refunded or cancelled it.

3. How Documents Are Scanned

When a guest scans their ID or passport, the photo is processed entirely on the guest's own device, in their browser — the image itself is never uploaded to our servers or to any third-party OCR service. Only the extracted text fields (name, date of birth, and so on), which the guest reviews and can correct before submitting, are sent to us to complete the registration.

4. Legal Basis for Processing

Guest identity data is processed to comply with a legal obligation (Art. 6(1)(c) GDPR) — Bulgaria's mandatory tourist registration law.

Host account data, admin logins (including co-hosts' logins, which the host sets up to run their business with us), and Telegram contacts are processed to perform our contract with the host (Art. 6(1)(b) GDPR).

Reservation requests are processed to take the steps the guest asked for before entering into a booking with the host (Art. 6(1)(b) GDPR).

Online payments are processed to perform the booking the guest made with the host (Art. 6(1)(b) GDPR).

A confirmed direct-booking order (dates, amount, payment, refund, sale document and history) is kept after the stay because Bulgarian tax rules (Наредба Н-18) require the host to keep their sales records — a legal obligation (Art. 6(1)(c) GDPR). The guest's name and contact details are not part of what is kept.

Security logs, audit records, and the record of when the Terms and this Policy were accepted are processed on the basis of our legitimate interest in keeping the Service secure and being able to show what was agreed (Art. 6(1)(f) GDPR).

5. How Long We Keep Data

Our purpose is to help complete ESTI registration and get you a ready-to-upload export — once your host has downloaded that export, our job for that guest is done, so we cap how long we keep guest identity data on our own servers. A host can enable automatic deletion between 1 and 30 days after export (a short buffer in case they need to re-download a lost file), and we delete it automatically at that point. Where a host hasn't enabled automatic deletion, you can request removal directly from them, or contact us for assistance.

The underlying booking record (dates, room, price) is not personal data and may be kept by the host for their own records after guest identity data is deleted.

A reservation request that never became a booking is deleted automatically 30 days after it was declined or its dates passed. For a confirmed or cancelled reservation, the guest's name and contact details are removed 30 days after check-out, but the order itself (dates, amount, payment, sale document and its history) is kept, as Bulgarian tax rules (Наредба Н-18) require for sales. The guest's reservation page stops working after check-out.

The record of an online payment (order number, amount, date and transaction reference), with any refund and sale document, is kept with the order for the host's accounting and tax obligations.

Host account data is kept for as long as your account is active, plus any period required by law afterward. A co-host's access ends as soon as the owner removes them from the team. Login sessions expire after 30 days, and password-reset and email-verification links expire after a short time. Security and audit logs are kept only as long as needed for security and legal-compliance purposes.

We keep encrypted backups of our database so the Service can be restored after a failure. Each backup is deleted automatically after 30 days, so data deleted from the Service is also gone from every backup within 30 days at most.

6. Who We Share Data With

Nobody, automatically. The Service does not connect to or submit data to the ESTI portal itself — it only prepares a ready-to-upload export file. Your host reviews that file and uploads it to esti.tourism.government.bg themselves; the Bulgarian Ministry of Tourism receives your data directly from your host, not from us.

Our infrastructure providers, who host the Service and store property media: Oracle Cloud Infrastructure, which hosts our application server and database (located in the EU), and Cloudflare, whose EU-region object storage holds property photos and videos and our encrypted database backups.

Brevo (EU-based), our email delivery provider, which sends account emails on our behalf: signup verification codes, co-host invitations, and password-reset links — and, for hosts who haven't connected Gmail, reservation requests and the host's answers to them.

myPOS, the host's own payment provider, only when a guest pays a direct booking online: the guest pays on myPOS's page under myPOS's terms and privacy policy, and we send myPOS the order number, the amount and the guest's email address.

НАП (the Bulgarian National Revenue Agency), only through the host: a host who is a company or sole trader can download a monthly file of their online orders, which they submit to НАП themselves. It holds order numbers, amounts, dates and payment references — no guest names or contact details.

Google, only if you choose to sign in with Google — Google then knows you used your Google account to sign in to the Service.

Telegram, only if a host connects people to the Telegram daily summary — those messages are delivered through Telegram's servers.

We do not sell data, use it for advertising, or share it with any other third party, except where required by law.

7. International Transfers

Our infrastructure is located within the EU. Guest identity data does not leave the EU/EEA as part of the Service.

Google and Telegram are used only if a host chooses them and may process data outside the EU/EEA under their own terms and privacy policies. What reaches them is limited: Google confirms a sign-in email address, and Telegram messages carry property names, dates, and guest counts — never guest identity data.

8. Your Rights

If you're a guest: contact your host first — they are the data controller for your registration data, and can request access, correction, or deletion on your behalf, or forward your request to us. Under GDPR you have the right to access, rectify, erase (subject to the legal registration obligation), restrict, or object to the processing of your data, and the right to data portability where applicable.

If you're a host: you can access, export, or delete your account data at any time through the admin dashboard, or by contacting us at support@smarthoster-bg.com. If you're a co-host, you can ask the host who invited you to remove your access, or contact us directly.

Everyone has the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) — www.cpdp.bg — or the supervisory authority in their own EU country of residence.

9. Cookies and Local Storage

We use one strictly necessary, httpOnly login cookie to keep you signed in to the admin dashboard (for up to 30 days), plus two short-lived, strictly necessary cookies while you sign in or sign up with Google, which protect that step against forgery. Your language and light/dark theme preferences are stored in your browser's local storage. We do not use analytics, advertising, or tracking cookies, and all of the above is strictly necessary or set by your own choice, so we do not show a cookie banner.

Guest pages for a property may offer a map of the nearest public transport station, provided by Google Maps. It is not loaded until you click "Show map"; once loaded, Google may set its own cookies under Google's privacy policy. Check-in videos are stored and served by us and set no cookies.

10. Security Measures

Guest identity fields, and the name and contact details in reservation requests, are encrypted at rest (AES-256-GCM, with a fresh random nonce per value); reservation pages are reachable only through an unguessable link; passwords are stored only as one-way scrypt hashes, and login-session tokens and password-reset links only as one-way hashes, never in plain text; every team member signs in with their own login and sees only what the owner has permitted; all traffic runs over HTTPS; and every export of guest data is recorded in an audit log, together with who made it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Service or the law. We will publish the updated version here with a new "last updated" date.

12. Contact

MAT-DZHI EOOD

Company registration number (EIK): 203449792

Registered address: Sofia, Suhata Reka bl.110 ent.A fl.1 ap.1

Email: support@smarthoster-bg.com

Supervisory authority: Commission for Personal Data Protection (CPDP), www.cpdp.bg