Privacy Policy
1. Who processes your data
The controller of personal data is Katarína Karolčíková, place of business Javorová 569/17, 919 30 Jaslovské Bohunice, Slovakia, Company ID (IČO): 53 803 230. Contact for all data protection matters: kontakt@piumly.com.
2. What data we process
For an account: name, email, phone and password (stored encrypted). For a booking: name, email, phone, an optional note and the companion details you provide. For a host profile: the data that gets published — photo, bio, certifications, social links and offerings. In addition: messages from the contact form, the payment status of card payments (never card details) and basic technical data needed for the site to work and stay secure.
3. Why, and on what legal basis
We process data to create and manage your account, facilitate bookings and the related communication — confirmations, reminders, waitlist offers (performance of a contract, Art. 6(1)(b) GDPR); to protect the platform from spam and abuse (legitimate interest, point (f)); and to comply with legal obligations, such as accounting (point (c)). If a host consents to promotion — the use of their name and profile photo in Piumly's communications — we process that data on the basis of consent (point (a)); consent can be withdrawn at any time in the settings, without affecting the lawfulness of processing carried out before the withdrawal. We do not use your data for advertising or profiling, and we do not carry out automated individual decision-making.
4. Who we share data with
We pass the host of a session the data needed to hold it (name, contact, note, companions) — for this data the host is an independent controller. The platform is run with the help of processors: Supabase (database and sign-in), Vercel (hosting), Resend (email delivery) and Cloudflare (spam protection for forms). Card payments for bookings are processed by Stripe, which acts as an independent controller for them. For the hosts' paid Pro subscription, payment and invoicing are handled by Paddle as the seller (Merchant of Record), which acts as an independent controller for them. We never sell personal data. If you sign in with Google, the sign-in is provided by Google as an independent controller under its own policy.
5. Transfers outside the EU
Some of our providers are based in the USA. Transfers are safeguarded by the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or by standard contractual clauses.
6. How long we keep data
Account data is kept while the account is active. After you delete your account, it is deactivated immediately and personal data is permanently anonymised within 30 days. Guest booking data and contact form messages are kept only as long as needed for their purpose; records required for accounting are kept for the period set by law.
7. Health data
The platform does not collect or store health data. If a host requires a health questionnaire or a written waiver for a session, they handle it with you directly outside the platform and act as an independent controller of that data.
8. Your rights
You have the right to access your data, have it corrected or erased, restrict its processing, data portability and the right to object. Send your request to kontakt@piumly.com — we will reply within one month at the latest. If you are not satisfied, you can lodge a complaint with the Slovak Data Protection Office (dataprotection.gov.sk).
9. Cookies
We only use essential technical cookies — for signing in, remembering your language and core functionality. We do not use analytics or marketing cookies. See the separate Cookie Policy (linked in the footer) for details.
10. Anonymous traffic statistics
To improve the site we keep anonymous, aggregated traffic statistics — only a daily total of visits by page type, visit source (e.g. Instagram, Google, direct) and device type (mobile/desktop). We do not record IP addresses, full page URLs or any data tied to a specific person, and we use no tracking cookies for this — so it is not personal data.
11. Social media
Piumly has profiles on Instagram and Facebook, operated by Meta Platforms Ireland Ltd. The links to them in the site footer are ordinary links — until you click them, our site loads nothing from Meta and sends it no data about you. When you visit or interact with our profile, Meta processes your data under its own privacy policy. As the operator of the pages, we are a joint controller with Meta only for the anonymous, aggregated page statistics (Insights), which we cannot link to a specific person. We do not embed any Meta content or trackers on piumly.com.
12. Changes to this policy
We may update this policy, for example when platform features or providers change. The current version is always published on this page.