Privacy policy
Last updated 14 October 2026
This policy explains what personal data Bookalizer collects, why, who sees it and what control you have. It covers guests, hosts and their team members, and visitors to our websites, including hosts' own booking sites that run on Bookalizer.
Who is responsible for your data
[Operator company name] (company number [company number], [registered office address]) is the controller of the personal data described here, registered with the UK Information Commissioner's Office under number [ICO registration number]. Contact us about privacy at privacy@bookalizer.com.
The host you book with also receives your booking details and is a separate controller of them, responsible for how they use them.
What we collect
- Account details: name, email, password (stored only as a secure hash), phone, country, preferred language and currency, and two-step login settings.
- Bookings: homes, dates, number of guests, prices, special requests, and for business trips any company or VAT details you add to an invoice.
- Payments: Stripe processes card payments. We receive the payment status, card brand and last four digits, never your full card number.
- Messages and reviews between guests and hosts, and support conversations with us.
- Hosts and team members: company details, role, the homes you manage, payout status from Stripe, and the tax details we must report (name, address, date of birth or company number, tax reference, earnings).
- Technical data: IP address, device and browser, pages visited, and an audit trail of important actions for security and fraud prevention. See our cookie policy.
Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account, taking bookings and payments, passing messages, sending confirmations and arrival details | Performing our contract with you |
| Keeping the original text of a message when we hide phone numbers, emails or web addresses before a booking is paid. Only Bookalizer support staff can read it, every time they open it is recorded, and only to deal with reports of fraud or of moving bookings off the platform | Our legitimate interest in preventing fraud and keeping guests and hosts safe |
| Checking your phone number, address, date of birth and ID when you choose to verify your account (ID checks are done by Stripe; we keep only the result) | Your request, and our legitimate interest in preventing fraud. Some hosts only accept verified guests |
| Keeping accounting and tax records, reporting host earnings to tax authorities (UK platform reporting rules, EU DAC7), answering lawful requests | Legal obligation |
| Preventing fraud and abuse, keeping accounts secure, investigating problems and complaints, checking reviews are genuine | Legitimate interests: keeping the platform safe and trustworthy |
| Understanding how the site is used so we can improve it (statistics only) | Legitimate interests, with a right to object. Non-essential cookies are used only with your consent. |
| Marketing emails about Bookalizer | Your consent, or our legitimate interests for similar services you have booked. You can unsubscribe in one click at any time. |
We do not sell your personal data. We do not make decisions about you based only on automated processing that have legal or similarly significant effects.
International transfers
If you book a home in another country, your booking details go to a host in that country, because that is needed to provide your stay. Where our service providers process data outside the UK or EEA, we use the safeguards the law requires, such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses.
How long we keep it
- Account data: while your account is open. When you close it, we delete or anonymise it, except what we must keep below.
- Bookings, payments and invoices: 6 years after the end of the financial year, for tax and accounting law.
- Messages: 3 years after the stay, in case of disputes.
- Published reviews stay online. If your account is closed, they show without your name.
- Security and audit logs: 2 years.
Your rights
You have the right to:
- access your data and receive a copy in a portable format. Your account's privacy page has a “Download my data” button.
- have inaccurate data corrected.
- have data deleted. You can close your account from the privacy page.
- restrict or object to our use of your data, including for direct marketing (always).
- withdraw consent at any time, for example through the cookie settings link in the footer.
Contact privacy@bookalizer.com about any of these. Please complain to us first and we will try to put it right. You can also complain to the Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live in the EU.
Security
We use encrypted connections, hashed passwords, role-based access for host teams and our staff, two-step login for owners, finance and staff, and audit logs of sensitive actions. No system is perfectly secure. If a breach puts you at high risk, we will tell you.
Children
Accounts are for people aged 18 and over. Children may be included in a booking by an adult guest. We only record the number and, where needed, the ages of children.
Changes and contact
We will update this policy when our practices or the law change, and tell you about important changes. Questions: privacy@bookalizer.com.