Privacy Policy

1. Who we are

GuestLink (“we”, “us”) is operated by Wonder Flamingo Unipessoal Lda, a company incorporated in Portugal (EU), R. António Alves de Azevedo Lote N, 2735-307 Agualva-Cacém, Portugal. GuestLink provides a link-in-bio and private guest-information service for hosts of all kinds of accommodation (holiday rentals, rural stays, guesthouses, hostels, hotels and villas), at gstl.ink. We are the data controller for the account data described below. For property and guest content, the host is the controller and GuestLink acts as a processor on their behalf.

2. What we collect

• •Account data. Your email address and name. You sign in with a magic link sent to your email or with your Google account; we do not store passwords. If you use Google, we receive your name, email address and profile picture from Google.
• •Property content you enter. This includes public details (name, description, links) and private guest details (door codes, WiFi credentials, check-in instructions, recommendations, contacts). This content is entered and controlled by you, the host.
• •Guest visits. When a guest opens a page, we count the visit without cookies. We do not store guest IP addresses or other information that identifies a guest.
• •Arrival time. If a guest tells the host their arrival time from the private page, that time is emailed to the host. We do not store it.
• •Availability requests. If a guest sends an availability request from a public page, the details they enter — dates, number of guests, an optional message and their contact — are emailed to the host so they can reply. We do not store these requests in our database.
• •Translations. To show a guest the page in their language, the text you wrote (descriptions, instructions, recommendations) is sent to our translation provider and the translation is stored with your property. Door codes, WiFi credentials and names are kept as written.

3. Cookies and storage on your device

We use only cookies that are strictly necessary: a session cookie that keeps hosts signed in, and a short-lived security cookie used during Google sign-in. We do not use analytics or advertising cookies. When a guest opens a private page, their browser keeps a copy of that page on their own device so it works offline; it is refreshed when they open the page again.

On our website gstl.ink we count visits with Cloudflare Web Analytics. It does not use cookies or similar storage on your device, and it does not identify you: we only see totals, such as page views, referring sites, countries, device types and page speed. We also count clicks on a few buttons of gstl.ink (such as “Reserve”), as daily totals only, without cookies, IP addresses or anything that links a click to a person. The host dashboard and the guest pages are not measured this way.

4. How we use it

To operate the service: to authenticate you, to serve your public and private pages, to show you basic visit and click counts, and to keep the service secure and reliable. We do not sell your data and we do not use it for advertising.

5. Legal basis (GDPR)

We process account data to perform our contract with you (Art. 6(1)(b)) and for our legitimate interest in operating and securing the service (Art. 6(1)(f)). Property and guest content is processed on the host’s instructions as a processor.

6. Retention

We keep your account and property data while your account is active. When you delete a property, we remove it and all its dependent records — private link, visit counts and click counts — from our database. Backups are retained on a rolling basis and age out over time.

7. Sub-processors

We rely on a small number of providers to run the service:

• •Fly.io — application hosting.
• •Cloudflare R2 — encrypted database backups.
• •Cloudflare — DNS, website delivery and security for gstl.ink, and cookie-free visit statistics for the gstl.ink website.
• •Resend — sending sign-in and notification emails.
• •Google — optional sign-in with your Google account, and our support mailbox.
• •OpenAI — translating the text you write for guests. Only that text is sent, never your account details.
• •Sentry — error monitoring, with data stored in the EU. We send technical error reports only; private links, door codes, WiFi credentials, form contents and IP addresses are removed before anything is sent.

Our application and database are hosted in the EU (Amsterdam). Some providers are based in the United States; where data leaves the European Economic Area, it is protected by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

8. Your rights

Under the GDPR you may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. You can delete any property yourself from its workspace, which erases its data. To exercise any other right, contact us at privacy@gstl.ink. You also have the right to lodge a complaint with your local data protection authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt). We reply within 30 days.

9. Security

We use encryption in transit (HTTPS), passwordless sign-in, rate limiting and other safeguards. The private guest link is a secret URL that you can rotate at any time, which immediately invalidates the old link.

10. Contact

Questions about this policy or your data: privacy@gstl.ink.