Privacy policy

Chalupario is operated by Solushnis, s.r.o., company ID 24993786, Příčná 1892/4, 110 00 Prague 1 ("we"). For user accounts, prospective customers and website visitors we are the data controller.

Guest data (bookings, online check-in, communication) is processed by us as a processor for the individual hosts, who are its controllers. The processing terms are part of the terms of use.

Hosts and their employees (user accounts), the hosts’ guests (bookings and statutory registers), prospective customers (the access request form) and visitors of the public pages.

For an account we keep the name, email, sign-in method (a password hash, or a Google or GitHub account), and for security the IP address and browser of each session and the last sign-in time.

Hosts also fill in billing details (company name, ID, VAT ID, address, bank details) and can write to support. Changes in the account are recorded in an audit log (who, when, from where and what changed) used for security and dispute resolution.

At booking: the guest’s name, email, phone and any notes. At online check-in, which serves the host’s statutory duties: date of birth, identity document type and number, permanent address, citizenship, and for foreign guests the purpose of stay and visa number.

Hosts need this for the house book under s. 101 of Act No. 326/1999 Coll. (kept 6 years) and the register under s. 3g of Act No. 565/1990 Coll. (kept 6 years). The system also keeps copies of emails sent to guests and incoming bank payment notices (counterparty name and account) for payment matching.

The access request form stores your name, email, phone (optional), property count, note and IP address (form abuse protection). We use it solely to get back to you; no marketing, no selling on.

Performance of a contract (Art. 6(1)(b) GDPR): running the account, bookings, payments and guest communication.

Legal obligations (point (c)): accounting and tax documents (s. 31 of Act No. 563/1991 Coll.; tax documents 10 years under s. 35 of Act No. 235/2004 Coll.) and the hosts’ register duties above.

Legitimate interest (point (f)): service security, the audit log, abuse prevention and debt recovery.

Consent (point (a)): analytics cookies, see the cookie policy.

The in-app assistant and document drafting run on the Solushnis AI platform of the same operator. Using the chat sends the conversation and the content of the currently open application page (which can include guest data visible on screen); drafting a document sends the document text and the host’s identification details. Nothing is sent until you use the feature.

The language models are provided by the platform’s contracted sub-processors (Anthropic, OpenAI); their processing may take place outside the EU/EEA under their standard contractual clauses. No action proposed by the assistant is performed without your explicit approval in the application.

Postmark (sending guest emails and receiving bank payment notices), Railway (application, database and storage hosting), Sentry (server error records; request contents are not sent), Solushnis AI and its model providers (only when AI features are used), Cloudflare (DNS and routing of the info@ and gdpr@ mailboxes).

Public pages load OpenStreetMap tiles and any embedded videos (YouTube in no-cookie mode, Vimeo) from your browser, which passes your IP address to those services. When filling in billing details, your browser queries the public ARES registry. We hand data to public authorities only where the law requires it.

Account data is kept for the life of the account. Sessions expire on their own. Unmatched bank notices are deleted after 90 days. Documents under statutory periods (accounting, tax, guest registers) are kept as the law requires, see sections 4 and 6.

For the remaining operational records we are introducing a retention schedule; until it is complete we delete them on request at [email protected].

You have the right of access, rectification, erasure (unless a legal duty prevents it), restriction, portability and objection, and the right to withdraw consent. We handle requests at [email protected] without undue delay, within one month at the latest.

Guests may also contact their host directly as the controller; we will gladly help the host comply. The supervisory authority is the Czech Office for Personal Data Protection (uoou.gov.cz), where you can lodge a complaint.

Transfers are encrypted, sign-in sessions use secure httpOnly cookies, passwords are stored only as cryptographic hashes and account changes are written to a tamper-protected audit log.

Data is processed primarily in the European Union. Transfers outside the EU/EEA can occur with the language model providers, error telemetry and the traffic analytics including session recording, always under the given provider’s standard contractual clauses and only to the extent described above.

The use of cookies and similar technologies is described in the separate cookie policy, where the choice can be changed at any time.

This policy is effective from 2 September 2026. We announce material changes in the application or by email; earlier versions on request.