Privacy policy

This policy explains which personal data CasaCal processes and what rights you have.

Controller

The controller responsible for data processing is the service provider named in the legal notice.

Which data we process

• Account & profile: your email address (for the sign-in code), your display name and, optionally, a profile picture. If you set up a passkey, we store its public key — never a password. If you sign in with Google or Apple, we receive your email address and your name from them.
• Booking & home data: periods, who a booking is for, blocks, optional notes/contact details, checkout checklists, shared costs including amounts and shares, house info and tips, and the home’s history (who created, changed or deleted what and when).
• Payment data: Payments are processed by our payment service provider Stripe. Card details never reach us; we store only the Stripe customer and subscription references and the payment status of your holiday home. Stripe collects your billing address when you take out the subscription; we evaluate the country to check whether you are resident in the sales area (EU/Switzerland, Terms § 1).
• Notifications: If you enable push notifications, we store your browser’s device address (push endpoint) that is needed for them — you can switch them off in the app at any time.
• Invitations: If an owner invites you to a home by email, they have entered your email address with us. We store it solely to deliver the invitation to you and to match it to you when you join — until the invitation is redeemed or expires. No further email and no advertising will follow.
• Waitlist, cancellation & withdrawal: If you sign up for the waitlist, we store your email address. If you use the cancellation form, we process the data you enter there (name, email and, where applicable, holiday home and reason) to process the cancellation and to be able to prove it. If you use the withdrawal form, we process the data you enter there (name, email and contract reference) to process the withdrawal and to be able to prove it. For all three forms, your IP address (and, for the email address, only a hash of it) is also hashed/stored for no more than 24 hours to prevent abuse, Art. 6(1)(f) of the General Data Protection Regulation (GDPR).
• Technical data: a technically necessary session cookie keeps you signed in. A further technically necessary cookie named “locale” remembers, for one year, the language CasaCal is shown to you in. It’s set when you switch languages or follow a link that specifies one (e.g. from our homepage or from an invitation). Server-side access logs are generated when the service is operated.

There is no tracking, no advertising and no analysis of your behaviour.

Purposes & legal bases

The processing serves to operate the app (sign-in, occupancy planning, cost sharing, reminders, billing of the subscription). The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR), for the waitlist and push notifications your consent (Art. 6(1)(a) GDPR, which you can withdraw at any time), and our legitimate interest in a secure, functioning service (Art. 6(1)(f) GDPR). The delivery of invitations to an email address entered by an owner is also based on this legitimate interest (Art. 6(1)(f) GDPR).

Processors & recipients

To operate the service, we use service providers under data processing agreements:

• Supabase — database, processing in the EU (Frankfurt region).
• Vercel — hosting of the application and storage of profile pictures, processing in the EU.
• Resend — sending the sign-in, invitation and reminder emails. Processing may take place in the USA, safeguarded by EU standard contractual clauses or the EU-US Data Privacy Framework.
• Stripe — payment processing. Here too, processing may take place in the USA, safeguarded by EU standard contractual clauses or the EU-US Data Privacy Framework.

Push notifications are delivered technically via the push service of your browser’s provider (e.g. Google, Apple or Mozilla) — only if you have enabled them. If you add your personal calendar feed (iCal) to a calendar app, you retrieve the occupancy data yourself through that app; protect the feed link accordingly — you can generate a new one in the app at any time.

Retention period

Your data remains stored for as long as your account exists or the bookings are needed for planning. Booking deletions remain recorded in the history log for traceability and are finally removed together with the home. You can delete your account yourself in the app at any time (Account → Delete account); your contributions to shared homes are then assigned to a neutral placeholder so that the other members’ planning is preserved. We keep cancellation notices as evidence with regard to the statutory time limits.

No sale of your data

We do not sell your personal data and do not pass it on for advertising purposes — neither to data brokers nor to advertising networks. CasaCal does not embed any trackers or analytics services. An automated opt-out signal from your browser (Global Privacy Control, GPC) therefore requires no separate response: there is neither a sale nor any disclosure for advertising purposes that you would need to object to.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can exercise the rights of access and data portability yourself at any time: under Account → “Export data” you download your data as a machine-readable JSON file, free of charge and without waiting. For anything else, please use the contact details given in the legal notice. You also have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, https://www.lda.bayern.de.

Last updated: 24 September 2026