1. Controller and contact
Pablo Adrian Fernandez Terra, Södra Ligården 12, 425 30 Hisings Kärra, Sweden, is responsible for Verinido's platform processing. Contact support@verinido.com or legal@verinido.com, telephone +46 73 412 29 67. This notice describes account/support use and the services when enabled; publishing it does not activate booking or authority reporting. The host separately determines processing for accommodation and guest registers. Where Verinido only acts on the host's reporting instructions, the host is controller and the processing clause in the host terms applies. Stripe has its own controller responsibilities for relevant payments, fraud prevention and regulatory checks.
2. Information, sources and required fields
We process contact/account information, property and booking details, traveller names and required identity/contact/residence fields, dates of birth and required minor/companion information, signatures, payment references/status, verification results, messages, support evidence, reviews, partner applications/attributions and security/acceptance records. Sources are you, the booking adult or host, Stripe, and relevant official records. Give other travellers this notice before submitting their data; their data is not automatically covered by your contract or consent. Required fields are identified in the relevant flow; missing necessary information can prevent verification, booking or lawful reporting. Do not upload identity scans, sensitive health information or card details into ordinary message fields. Payment/identity documents are collected by the designated Stripe process, not stored as identity-document copies in Verinido's MySQL database.
3. Purposes and legal bases
GDPR Article 6(1)(b): administering the user's requested account, platform contract, booking tools and partner remuneration where necessary for that person's contract. Article 6(1)(c): accounting/tax obligations and applicable platform reports, including Spanish reporting where the operator is obliged. On host-instructed reporting the host determines its lawful basis; the host-processing clause limits our instructions. Article 6(1)(f): proportionate security, fraud prevention, claims handling, genuine-review integrity and administering companion details where necessary and not based on another ground, subject to balancing your interests and objection rights. Article 6(1)(a): optional marketing and non-essential tracking where offered; withdrawal does not affect earlier lawful processing. We do not treat terms acceptance as blanket consent. Special-category data or biometric processing requires an additional applicable Article 9 basis and information in the relevant verification flow; this notice is not biometric consent.
4. Recipients and providers
Only necessary data is shared with the relevant host/guest, authorised operations staff, HostUp (hosting and email in Sweden), Stripe (payment, Connect and identity services; relevant European entities include Stripe Payments Europe, Limited and Stripe Technology Europe, Limited), and competent authorities for applicable SES, VUDA or tax reports. OpenAI Ireland Ltd. supplies AI assistance for enabled text/guide, evidence-assistance or partner-assessment features, not general access to the database. The specific feature determines the selected input. Providers' current notices are at hostup.se, stripe.com/privacy and openai.com/policies. We do not sell traveller data or give partners general access to guest identities. Receiving an authority report does not make the authority our processor.
5. AI and international processing
AI-assisted text and translations require review; an output is not an official finding. Partner assessment uses relevant network access (25), communication (20), language (15), motivation (15), sales/relationships (15) and ethics (10); 70/100 and no disqualifying risk are prerequisites, not a promise of a place. Direct identifiers are removed before scoring, though free text can still identify someone. Ask support to correct data, challenge an outcome or obtain effective human review. No significantly consequential solely automated selection may be activated without its applicable legal basis and safeguards. AI/Stripe processing can involve the USA and other countries outside the EEA. Transfers require an applicable adequacy decision or contractual safeguards such as EU standard contractual clauses with necessary supplementary protection; ask legal@verinido.com for the safeguards for your processing. We do not promise all provider processing stays in Sweden or that an API storage setting eliminates provider security retention.
6. Retention and deletion
Ordinary contact-form content is scheduled for removal after 90 days and sent email bodies after 30 days; necessary dispute/accounting evidence is retained separately for its purpose. Account deletion normally has a 30-day safety delay; open bookings, payments or legal duties can require restricted retention, which we explain. Rejected/withdrawn partner application details expire after six months; the reserve list also expires after six months. Optional guest-offer consent expires after 24 months; on withdrawal/expiry the marketing address is removed within 30 days and limited consent evidence is retained for 36 months. Accounting records are kept through the seventh year after the calendar year in which the financial year ended. Guest-register records use the applicable host duty (where the Spanish three-year register rule applies, three years after the service ends), not a blanket rule for every user. Booking, review, signature and claim evidence lasts for the relevant contract/history purpose or applicable claim period, with restriction during a specific dispute/legal hold and deletion or anonymisation when no longer needed. Backup copies are restricted to recovery and expired data must be removed again after restoration; deletion is not instant erasure of every backup. Stripe may retain data under its independent obligations; Verinido keeps verification status and necessary references rather than identity documents.
7. Rights and complaints
You may request access, correction, erasure, restriction and portability where GDPR provides them, object to legitimate-interest processing and direct marketing, and withdraw consent. Contact support; we use proportionate identity checks. We normally answer within one month; a permitted extension and its reason are communicated within that month. You may complain to IMY (imy.se), AEPD (aepd.es) or your competent supervisory authority, without first completing our complaint process. For host-controlled records we forward your request to the responsible host and assist them. Necessary retention is explained rather than treating account deletion as automatic erasure of legal evidence.