Privacy Policy

This Policy applies to all data collected through our website and booking platform, including when you browse listings, create an account, make a booking inquiry, submit a host application, or contact us.

It is designed to align with the principles of Türkiye's Personal Data Protection Law (KVKK) and the European Union's General Data Protection Regulation (GDPR). If you have any questions about how we handle your data, please use the contact form on our website.

We collect information you provide to us directly, including: your name, email address, and phone number when you use our contact form or submit a host application; account information (name, email, and a securely hashed password) when you register; booking details including dates, guest count, and any notes you include; and communications you send us through the Platform.

We also collect certain technical data automatically when you visit our website, such as your IP address, browser type, device information, pages visited, and approximate location derived from your IP address. This data is collected through standard server infrastructure and, where applicable, analytics tools operated by our trusted service providers.

We use the information we collect to: provide and operate the Platform and booking services; respond to your enquiries and support requests; process and manage bookings and reservations (including, where applicable, coordinating with payment service providers); send transactional communications such as booking confirmations, verification codes, and service notifications; review and process host applications; improve and personalise the Platform based on usage patterns; comply with legal obligations; and detect and prevent fraud or misuse.

We do not use your personal data for automated decision-making or profiling in a way that produces legal or similarly significant effects without your explicit consent.

We process your personal data on the following legal bases:

— Performance of a contract: to provide the services you request, including account management, booking processing, and responding to enquiries.

— Legitimate interests: to operate and improve our Platform, prevent fraud, and communicate with users in ways that do not override your rights and freedoms.

— Legal obligation: to comply with applicable laws and regulations.

— Consent: where required, for example for certain marketing communications if introduced in the future.

Our website may use cookies and similar tracking technologies to support essential site functionality, remember your preferences, and — subject to your consent — to understand how visitors use the Platform.

Essential cookies are necessary for the Platform to function correctly and do not require your consent. Non-essential cookies (such as those used for analytics or personalisation) will only be set with your prior consent, where required by law. You can manage or withdraw your cookie preferences at any time through your browser settings or any consent tool provided on the Platform.

We do not sell your personal data. We may share your information in the following circumstances:

— With trusted service providers who process data on our behalf under appropriate data processing agreements. These include hosting and infrastructure providers, our email delivery provider, and, where applicable, payment processing providers. These providers are contractually obligated to protect your data and use it only for the purposes we specify.

— With property hosts, to the extent necessary to facilitate your booking or inquiry — for example, sharing your name, contact details, and booking dates with the relevant host.

— With law enforcement or regulatory authorities where required by applicable law, or to protect the rights and safety of our users and the public.

We require all third parties with whom we share data to comply with applicable data protection laws.

Homesta Stay serves guests and hosts internationally, and some of our service providers may be located in, or process data in, countries outside of Türkiye or the European Economic Area. Where data is transferred internationally, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws — such as standard contractual clauses or other recognised transfer mechanisms.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements.

Account data is retained for the lifetime of your account and for a reasonable period thereafter. Booking records may be retained for longer periods where required for tax, legal, or dispute resolution purposes. Contact form submissions are retained for as long as needed to respond to your enquiry and for a reasonable follow-up period.

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encrypted data transmission, strict access controls, and regular security reviews.

While we take data security seriously, no system is entirely immune to risk. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you directly, in accordance with applicable law.

Depending on your location and applicable law, you may have the following rights regarding your personal data: the right to access a copy of your data; the right to rectification of inaccurate data; the right to erasure ("right to be forgotten"); the right to restrict processing; the right to data portability; the right to object to processing based on legitimate interests; and the right to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us through the contact form on our website. We will respond within the timeframe required by applicable law (typically within 30 days). We may need to verify your identity before processing your request.

If you are located in Türkiye, you may also submit a request to the Personal Data Protection Authority (KVKK). If you are in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority.

Our Platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data without appropriate consent, please contact us through the contact form and we will take steps to delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will update the "last updated" date on this page. For material changes, we will take reasonable steps to inform registered users. We encourage you to review this Policy periodically.

For any privacy-related questions, requests, or concerns, please contact us through the contact form on our website. We take privacy enquiries seriously and will respond as promptly as possible.