Privacy Policy

This notice explains how StayScore handles personal information. See Data controller and contact for our identity and how to reach us.

1. Information and sources

You provide your listing URL, email, account information, choices and support messages. ScrapingBee retrieves publicly accessible listing text and photos. We generate reports and checklist/PDF content. Paddle supplies payment updates and Resend supplies service-email delivery events.

Records include account and guest identifiers, listing evidence and report files, payment references/status, access and security records such as IP addresses or keyed identifiers, and provider usage. We record the exact statement/policy version accepted, its fingerprint, server-recorded acceptance time and associated account, report or transaction references; a guest-session digest may link a listing-authority confirmation. Earlier acceptance records are preserved; accepting one version does not accept a future version.

We do not need your Airbnb password or store your full card number. Avoid sensitive or unnecessary information about others. Authority to manage a listing does not mean everyone mentioned or shown has consented.

2. Purposes and legal grounds

Account, contact and report data enable the service you request and access to purchases: where applicable, processing is necessary to establish or perform our agreement with you. Security and abuse-prevention records support our legitimate interest in protecting the service, subject to your rights. Support, acceptance and transaction evidence help resolve requests and establish or protect legal rights. Specific legally required records are processed to meet those duties.

Third-party listing information is not automatically covered by our agreement with you. We limit its use to relevant listing assessment and assess the applicable basis, including legitimate interests where available and not overridden by the person’s rights. Public availability is not blanket permission to reuse information.

Terms acceptance is not privacy consent. Optional analytics asks for your separate consent in Cookie settings. Without information necessary for account access or report delivery, we may be unable to provide that part of the service.

3. Providers and international processing

ScrapingBee retrieves listing evidence; OpenAI assesses text and photos; Supabase provides accounts, database and private-file services; Vercel hosts the application; Resend delivers service emails; Paddle handles checkout and separately processes data for its merchant-of-record activities under its Privacy Notice. Each receives information relevant to its role; some also process account or security records for their own purposes.

Processing involves providers outside Türkiye, with subprocessors in other countries. A hosting region does not mean every copy stays there. Contact us for information about arrangements applicable to your data.

Our application requests that generated API responses are not stored as application history. This does not remove the provider’s separate security and abuse-monitoring records.

Information may also be disclosed as necessary to respond lawfully to an authority or establish or protect legal rights, limited to that purpose.

4. Storage, retention and deletion

Purchased report content supports complimentary saved-report access while that feature operates, unless you request deletion or a lawful retention requirement applies. This is not a promise of permanent online availability. Account information supports access. Closure, feature discontinuation and deletion requests require a review of remaining purposes.

Automatic cleanup is currently disabled. Prepared rules cover unclaimed free previews after 30 days, expired sign-in secrets after 24 hours, and routine sign-in, email and security content after 90 days. These rules are not yet running and do not set the period for every payment, acceptance, provider or backup record.

Transaction, acceptance, dispute and security evidence may need to remain for a specific record-keeping duty or a documented continuing purpose. Support records are reviewed when a request is resolved and when their remaining purpose ends. A justified legal hold may delay deletion of relevant records.

Report deletion removes eligible content and files; it is not automatically full account or personal-data erasure. Account, transaction, provider and backup records require separate review. We explain necessary exceptions and do not confirm full erasure while identifiable records remain. Provider or backup copies may remain after report cleanup; verified deletion instructions must be reapplied before restored data returns to use.

5. Cookies, choices and security

Essential storage supports your private preview, sign-in, saved progress and cookie choice. Rejecting optional analytics does not change those functions. The guest-access cookie (stayscore-guest or __Host-stayscore-guest) lasts up to 30 days. Supabase sign-in cookies (sb-…-auth-token, including split parts) can have a browser lifetime of up to 400 days and may be refreshed during use; that lifetime does not guarantee a valid login. Sign-out removes the session cookies. The stayscore-request session-storage entry helps avoid duplicate analysis submissions and lasts for the tab’s session.

We save your versioned cookie choice and its dates in stayscore-cookie-preference local storage. The choice expires after 180 days; expired entries are removed when the site next checks them. A stayscore-analytics-denied cookie can also remember rejection for 180 days, including when saving the main preference fails. Expired or outdated choices require a new choice. If storage is unavailable, optional analytics stays off.

We use optional Google Analytics to understand visits to public pages. It loads only after you choose Accept analytics and only while analytics is enabled for the site. This optional processing relies on your consent. Google receives fixed public-page labels, analytics cookie identifiers and technical connection/browser information; this involves processing outside Türkiye. Our page-view events exclude query strings, URL fragments, referrers, names, email addresses, account identifiers and listing/report content. Account, sign-in, checkout and report routes are excluded. We do not enable advertising tracking, remarketing, Google Signals or enhanced measurement. See Google’s Privacy Policy.

When enabled and accepted, the _ga and _ga_… first-party cookies distinguish browsers and sessions, with a configured lifetime of up to 180 days and no page-view renewal. These browser-cookie limits do not describe every Google-held record. No Google Analytics requests are made before acceptance or while analytics is disabled.

Use the permanent Cookie settings control to Accept analytics or Reject optional. You can withdraw consent by choosing Reject optional; this stops future analytics, removes accessible analytics cookies and reloads the page to unload tracking. It does not delete essential access cookies or erase data already sent to Google. Requests about earlier data can use the contact route below. Your choice applies to this browser; clearing storage or using another browser may require a new choice.

We use access controls and other protective measures. No online service can promise absolute security. Contact support if you believe your information or access has been compromised.

6. Your rights

Under applicable law, you may ask whether we process your data, learn about its use and recipients, correct errors, request deletion when conditions are met and request notification of relevant corrections or deletion to recipients. You may object to an adverse result based solely on automated processing and seek compensation for unlawful processing where available. Other applicable rights, including a copy, portability, restriction or objection, remain available.

Send requests using the email or correspondence address below, preferably from your account email. We use proportionate verification and explain necessary additional steps. Turkish-law requests are answered as soon as possible and within 30 days; other mandatory deadlines apply where relevant.

You may complain to Türkiye’s Personal Data Protection Authority following its request/complaint procedure, or another competent authority where permitted. Where consent is used, you may withdraw it without affecting earlier lawful processing.

7. Changes

Published notices identify their version and effective date. Material new purposes are explained before they begin; an update does not replace consent where required.

Related policies: Terms of Service and Refund Policy.

Data controller and contact

StayScore is operated by Nuri Semih Boytorun, a sole proprietor based in Türkiye. The operator is the data controller for StayScore’s own personal-data processing. Correspondence address: Zergerdan Sokak No:42, 34467 Sarıyer/İstanbul, Türkiye. Contact: support@stayscore.ai.