Privacy policy

Last updated: 2026-01-06

1. Who is the data controller?

No Data Protection Officer (DPO) has been appointed for this service.

Related documents: /aviso-legal.php · /cookies.php · /condiciones-suscripcion.php

2. What data we process

Depending on how you use the platform, we may process the following categories of data:

• Account data: name, email, password (stored encrypted/hashed), role, access data and settings.
• Contact data: phone number and messages sent/received through the platform’s forms or tools.
• Subscription and billing data: billing details you provide (e.g. name/company name, tax ID, address), subscription status, dates and receipts.
• Payment identifiers: Stripe technical identifiers (e.g. session id / payment intent id) and payment status. Rebed does not store the full card number.
• Accommodation data and content: information published by the owner (text, photos, prices, rules, availability), which may include personal data if the owner adds it.
• Requests/Bookings (if you use the platform flow): data entered by a guest to get in touch or request a booking (name, email, phone, dates, messages).
• Technical data: IP address, security logs, browser/device, usage events and metrics needed to run and protect the platform.

3. Purposes and legal bases

Purpose	Account and access management (sign-up, authentication, roles, password recovery, dashboard administration). Legal basis: performance of a contract / pre-contractual measures.
Purpose	Provision of the service (SaaS) (publishing accommodation, managing availability, contact channel, requests). Legal basis: performance of a contract.
Purpose	Subscription, payment and invoicing (annual payment, status control, issuing invoices). Legal basis: performance of a contract and compliance with applicable tax/accounting legal obligations.
Purpose	Support and customer service (solving incidents, answering queries). Legal basis: performance of a contract and/or legitimate interest in handling requests and improving the service.
Purpose	Security, fraud and abuse prevention (logs, detection of unusual access, protection of the platform). Legal basis: legitimate interest in ensuring the security of the service and its users.
Purpose	Service communications (service notices, relevant changes, incidents). Legal basis: performance of a contract / legitimate interest in keeping the platform running.
Purpose	Marketing communications (if sent by email or equivalent means). Legal basis: consent where required and, where applicable, what is permitted by the applicable law. You can object or withdraw your consent at any time.
Purpose	Cookies and similar technologies (according to your cookie settings). Legal basis: consent for non-essential cookies. See /cookies.php.

4. Recipients and data processors

We do not sell your data. We may disclose or give access to personal data to:

• Service providers (processors) needed to run the platform (hosting, transactional email, backups, technical tools).
• Stripe as payment provider for the annual subscription (it processes the payment and manages payment methods). Rebed receives identifiers and payment status.
• Owners: when a guest sends a request/contact for an accommodation, the data is made available to the owner to handle the request and, where applicable, the booking.
• Public authorities: where there is a legal obligation.

Where required, we sign data processing agreements and apply contractual and technical measures to protect the data.

5. International transfers

Some technology providers may process data outside the European Economic Area. In that case, appropriate safeguards under the GDPR will apply (for example, adequacy decisions or standard contractual clauses, where applicable).

6. Retention periods

• Account: while it remains active and for as long as needed to handle liabilities arising from the service.
• Subscription and invoicing: for the periods required by applicable tax/accounting law.
• Support and communications: for as long as needed to handle the query and, where applicable, to evidence the actions taken.
• Security logs: for a reasonable period to detect and analyse incidents and protect the service.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction, portability and not to be subject to automated decisions, where applicable.

Practical information on exercising your rights and filing complaints is available from the AEPD.

8. Minors

The platform is not specifically aimed at minors. If processing were based on consent and the user were under 14 years old, consent would have to be given by the person holding parental authority or guardianship.

9. Security measures

We apply reasonable technical and organisational measures to protect data (for example, access control, encryption/hashing of credentials, monitoring and measures against unauthorised access), taking into account the state of the art and the risks.

10. Changes to this policy

We may update this policy to reflect legal changes or service improvements. The version in force is the one published here and shows the date of last update.

11. Contact

For privacy matters:
Email: inforebed@gmail.com
Phone: 687 801 885