Privacy Policy

1. Who we are

GuestLink (“we”, “us”) provides a link-in-bio and private guest-information service for short-term rental hosts, at gstl.ink. We are the data controller for the account data described below. For property and guest content, the host is the controller and GuestLink acts as a processor on their behalf.

2. What we collect

• •Account data. Your email address, and an optional name. We use magic-link sign-in, so we do not store passwords.
• •Property content you enter. This includes public details (name, description, links) and private guest details (door codes, WiFi credentials, check-in instructions, recommendations, contacts). This content is entered and controlled by you, the host.
• •Guest visits. When a guest opens a page, we record an anonymous count. We store a one-way hash of (IP + browser + a secret) to distinguish unique visitors — this cannot be reversed to identify a person. We do not use cookies and we do not store guest IP addresses or personal data in clear text.
• •Availability requests. If a guest sends an availability request from a public page, the details they enter — dates, number of guests, an optional message and their contact — are emailed to the host so they can reply. We do not store these requests in our database.

3. How we use it

To operate the service: to authenticate you, to serve your public and private pages, to show you basic visit and click counts, and to keep the service secure and reliable. We do not sell your data and we do not use it for advertising.

4. Legal basis (GDPR)

We process account data to perform our contract with you (Art. 6(1)(b)) and for our legitimate interest in operating and securing the service (Art. 6(1)(f)). Property and guest content is processed on the host’s instructions as a processor.

5. Retention

We keep your account and property data while your account is active. When you delete a property, we remove it and all its dependent records — private link, visit counts and click counts — from our database. Backups are retained on a rolling basis and age out over time.

6. Sub-processors

We rely on a small number of providers to run the service:

• •Fly.io — application hosting.
• •Cloudflare R2 — encrypted database backups.
• •Resend — sending sign-in and notification emails.

7. Your rights

Under the GDPR you may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. You can delete any property yourself from its workspace, which erases its data. To exercise any other right, contact us at privacy@gstl.ink. You also have the right to lodge a complaint with your local data protection authority.

8. Security

We use encryption in transit (HTTPS), passwordless sign-in, rate limiting and other safeguards. The private guest link is a secret URL that you can rotate at any time, which immediately invalidates the old link.

9. Contact

Questions about this policy or your data: privacy@gstl.ink.