Privacy and cookies
Last updated: October 21, 2026
This notice covers the website staydeck.app, the forms on it, and StayDeck demo accounts: what we collect, why, who handles it, and the cookies we use. Using StayDeck with your own properties and guests is covered by a separate data processing agreement.
Who is responsible
StayDeck (staydeck.app), Istanbul, Türkiye, is the data controller. You can reach us at [email protected].
What we collect
- What you type into a form: your name, work email, company, how many units you manage, the PMS you use if you tell us, and your answer to the follow-up question.
- Where the request came from: the page you used, campaign tags in the link you followed (UTM parameters), the site that referred you, and the date.
- Your account, if we open one: your email, name and company, your password (stored only as a one-way hash), sign-in codes (also hashed, valid for ten minutes), and records of your sign-ins: when, and the browser and device type it reported. What you do inside the demo workspace runs in your browser and is not saved by us.
- Abuse protection: a one-way hash of your IP address, used only to limit repeated form submissions. We do not store the IP address itself.
- Usage statistics, only if you accept analytics cookies: pages viewed on the website, and the screens and buttons used in the demo workspace; how you arrived, approximate location (country and city) and device type. Collected by Google Analytics, without your name or email.
Why, and on what basis
- To answer your request and run your demo account: creating the account, sending your sign-in details and codes, and replying to you. Basis: taking steps at your request before a possible contract.
- To keep accounts and the site secure: two-step sign-in, sign-in records, limits on repeated attempts. Basis: our legitimate interest in preventing misuse.
- To email you about StayDeck, and to learn which parts of StayDeck people want most. Basis: our legitimate interest in following up a request you made. Every email can be answered with "stop" and we will not write again.
- To count visits and see which parts of the site and the demo are used, with Google Analytics. Basis: your consent, which you can withdraw at any time with "Cookie settings" at the bottom of every page.
We do not sell your data, share it for advertising, or make automated decisions about you.
Who else handles it
Only the providers we need to run StayDeck, under contracts that limit them to doing so:
- Amazon Web Services: hosts the website and its database.
- Cloudflare: sits in front of the website to deliver it quickly and block attacks. It sees the IP address and request details of every visit.
- Mailgun: sends our emails, such as sign-in details, sign-in codes and request notifications.
- Google: provides Google Analytics, only if you accept analytics cookies.
Some of these providers process data in the United States. Where they do, the transfer is covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, and the UK equivalents.
Cookies
Browsing the public pages of this site sets no cookies of ours until you accept analytics. Cookies appear only when you sign in, or when they are needed to keep the site secure:
| Name | Set by | What it does | How long |
|---|---|---|---|
| PHPSESSID | StayDeck | Keeps the sign-in steps and form protection working on the sign-in and account pages. | Until you close the browser |
| sd_app | StayDeck | Keeps you signed in to your account. | Up to 30 days, removed when you sign out |
| sd_dev | StayDeck | Remembers a browser you chose to trust, so it does not ask for a sign-in code. | 30 days |
| __cf_bm, cf_clearance | Cloudflare | Tells people from bots to protect the site. Only set when Cloudflare needs to check a visit. | Up to 30 minutes, or as set by Cloudflare |
| _ga, _ga_* | Google Analytics | Counts visits and screen views, on the website and in the demo workspace, and tells new visitors from returning ones. Only after you accept. | Up to 2 years |
These cookies are needed for the site to work and do not require consent, except Google Analytics. Your analytics choice itself is kept in your browser's storage, not in a cookie, and you can change it with "Cookie settings" at the bottom of any page.
How long we keep it
- Requests and the details you sent: up to 24 months after our last contact, or until you ask us to delete them.
- Accounts: up to 12 months after access ends, then deleted. Sign-in records: 12 months.
- Sign-in codes: ten minutes. Password reset links: one hour, used once.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. Write to [email protected] from the address we know you by, and we will answer within one month. If you are in the EU or the UK, you can also complain to your data protection authority.
Changes
When this notice changes, the date at the top changes with it. If a change matters for your account, we will tell you by email.