Privacy Policy

Version 2026-09-24 · in effect from 24 September 2026

This explains what BookaQuest collects, who it goes to, and what you can do about it. It is short because we collect little — we are a marketplace, and the money and the stay both belong to the host.

What we collect

When you create an account: your email address, the name you give us, and a password (stored hashed by our authentication provider — we never see it).
When you book: your name, email address, phone number, party size, dates, and the amount of the booking.
When you accept our terms: the date and time, which version you accepted, your IP address, and your browser's user-agent string. We keep this because an agreement is only meaningful if it can be shown to have been made.
As you use the site: the ordinary server logs any website keeps, and photo ratings you submit.
We do not collect or store your card number. Card details go directly to Stripe.

Who your information is shared with, and why

The host you book with. They receive your name, email, phone number, dates and party size, because they are the person providing your stay and they need to reach you.
The host's channel manager. If your host uses Hostaway, your booking details are sent to their Hostaway account so the nights are blocked and the property cannot be sold twice for the same dates. Hostaway processes that data under its own terms and the host's account.
Stripe, which processes the payment. The charge is created on the host's own Stripe account — the host is the merchant of record — so Stripe holds your payment details, not us.
Supabase, which hosts our database and handles accounts and sign-in.
Resend, which sends our email.
We do not sell your personal information, and we do not share it with advertisers.

How long we keep it

Account and booking records are kept while your account is open and afterwards for as long as we need them for tax, accounting and legal purposes.
Terms acceptance records are kept for as long as the agreement could matter, which in practice means indefinitely. They are append-only by design and cannot be edited.

Your choices

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account. Email privacy@bookaquest.com.
Deleting your account does not delete a host's own records of a stay you booked, or records we are required to keep — including terms acceptance and booking history needed for tax and legal purposes.
You can turn off marketing email at any time. Transactional email about a booking you made is part of the service.

Security

Credentials hosts give us for their channel manager are encrypted before they are stored, because that key controls a host's entire account and a database leak must not expose it.
No system is perfectly secure. If we discover a breach affecting your personal information, we will tell you.

Children

BookaQuest is for people aged 18 and over. We do not knowingly collect personal information from children.

Changes

If we change this policy materially we will publish the new version and, where it affects how your information is used, ask you to review it.

Questions? Email privacy@bookaquest.com. See also the Guest Terms and Host Terms.