Privacy Policy
This policy explains how Easy Host Oy ("we") processes personal data of visitors to easy-host.fi and of people who call our service number. We are the data controller.
Controller: Easy Host Oy, Business ID 3288005-7, Sörnäistenkatu 19 B 21, 00580 Helsinki. Contact: info@easy-host.fi.
What we collect
- Contact form: your name, email or phone, message, chosen topic, language, plus technical metadata (IP address, browser/user-agent, timestamp).
- Analytics: how the site is used (pages viewed, device type, approximate location) via PostHog in the EU. Without your consent this is counted without cookies or any storage on your device; with your consent PostHog also uses a cookie, so repeat visits can be recognised.
- Cookies and similar technologies, managed through our consent tool (see the Cookie Policy).
Why, and on what legal basis
- To answer your enquiry and take steps toward a possible booking — legitimate interest and pre-contractual steps (GDPR Art. 6(1)(b) and (f)).
- Analytics without cookies: our legitimate interest in knowing how the site is used (GDPR Art. 6(1)(f)). Analytics cookies: your consent (Art. 6(1)(a)), which you can withdraw any time via the cookie settings.
Phone calls to our service number
When you call +358 45 490 2569, the call is put through to whoever on our team is on duty. We process your phone number, the time and length of the call, who answered it and, if your number matches a booking, that booking.
- Recording: answered calls are recorded, and you hear a short notice about it before the phone starts ringing. Each side of the call is transcribed into text separately, so the transcript shows who said what, and a short summary of the call is written into your message thread with us, so whoever picks up your matter next knows what was agreed. Voicemail messages you leave are handled the same way. The transcript and summary are internal notes: they are not sent to you or to any booking channel.
- Why: to handle your matter, to keep our service consistent, and to have a record of what was agreed on the phone. Legal basis: our legitimate interest (GDPR Art. 6(1)(f)).
- If you would rather not be recorded, send a text message to the same number or email us instead; we help just the same. You can also ask us to delete the transcript and summary of your call.
- Who handles it: Twilio connects the call and holds the recording until it is transcribed; OpenAI turns the recording into text; Anthropic writes the summary. Their details are in the list below.
- How long: the audio is deleted as soon as it has been transcribed. If transcription fails, it is kept for at most 7 days so it can be tried again, then deleted. The transcript and summary are kept in your message thread with us for up to 24 months after the last contact, then deleted.
Who processes data for us
We use vetted processors under data processing agreements:
- Resend — transactional email (delivers contact-form notifications). USA, under Standard Contractual Clauses.
- PostHog — product analytics, EU region (data kept in the EU).
- Railway — website hosting and database, EU region.
- Hostaway (Hostaway Opco Oy, Finland) — our booking management system: holds reservations and our messages with guests. Hostaway states that an appropriate transfer mechanism is in place whenever data leaves the EU/EEA.
- Stripe — card payments for direct bookings. Card numbers are held by Stripe, never by us. Stripe, LLC (USA) under the EU–US Data Privacy Framework, with Standard Contractual Clauses as a fallback.
- Twilio — connects calls and text messages to our service number and holds call and voicemail recordings until they are transcribed, Ireland (EU) region. US company, under the EU–US Data Privacy Framework and Standard Contractual Clauses.
- OpenAI — turns call and voicemail recordings into text. USA, under Standard Contractual Clauses. Used for transcription only, not for training its models; OpenAI keeps the audio for up to 30 days for abuse monitoring.
- Anthropic — writes the summary of a recorded call from its transcript. USA, under Standard Contractual Clauses. Not used for training its models.
How long we keep it
Every period below is enforced automatically: a daily job deletes or anonymises the data when its time is up. Deleted data disappears from our backups within 30 days.
| Data | How long | What happens then |
|---|---|---|
| Booking and stay detailsDates, apartment, price, booking channel, number of guests, your name. | 6 years after the end of the year of your stay (accounting law) | Anonymised: your name and the booking platform’s copy of the booking are removed; the amounts stay in our accounts. |
| Contact detailsEmail, phone, address, other guests you added, billing contact, the last digits of your card, a car registration for parking, our notes about your stay, and for a long-stay application your personal identity code and address. | 24 months after your stay | Deleted. |
| Guest profileWhat lets us recognise you when you stay again: your name, the phone, email or booking-platform account your bookings came with, your stays with us and our notes. If you ask for our offers on your guest page, the email or phone you gave us for them and your consent. | 24 months after your last stay. While you get our offers: 3 years after your last stay or your consent, whichever is later | Deleted. Booking-platform details are used only to recognise you and serve your stay, never for offers. You can unsubscribe on your guest page at any time. |
| MessagesOur copy of your messages with us: through Airbnb, Booking.com or another platform, our website, SMS, a messaging app or email. | 24 months after your stay or after the last message, whichever is later | Deleted. |
| Phone callsCall recordings and voicemail, their transcripts and summaries, and the record of the call (number, time). | Audio until it is transcribed, at most 7 days. Transcripts, summaries and call records: 24 months after the last contact | Deleted. |
| Traveller declarationName, date of birth, nationality, travel document number, as the law requires. | 1 year after your departure (required by law) | Deleted. |
| Door codes and lock eventsThe code for your stay and when the door was opened with it. | 24 months after your stay | Deleted. |
| Payment recordsAmounts, dates and payment references. Card numbers are held by our payment provider, never by us. | 6 years after the end of the year of your stay (accounting law) | References and notes are removed; the amounts stay in our accounts. |
| Invoices and receiptsThe invoice for your stay: its number, dates, amounts and VAT, and the name, address and email it was made out to. | 6 years after the end of the year of the invoice (accounting law) | Your name, address and email are removed from it; the invoice itself stays in our accounts. |
| Lost and foundYour name, contact details and shipping address for an item you left behind. | 12 months after the item is returned, shipped, donated or disposed of | Deleted. |
| Contact form and enquiriesWhat you send us through our website forms. | 24 months after you contacted us | Deleted. |
| ReviewsA review you leave for an apartment on a booking platform or on our website, with your name. | While we offer the apartment | When the listing ends, your name and the review text are removed; the star ratings stay. |
| Website analyticsHow the site is used, through PostHog in the EU. | As set in our PostHog configuration | Deleted by PostHog. |
Bookings made through Airbnb, Booking.com or another platform, and the messages you send there, are also held by that platform as its own data controller, under its own privacy policy. The periods above apply only to our copy.
Airbnb privacy policy · Booking.com privacy statement
Cleaning customers
When you order cleaning from us, we process your contact details, the address we clean and how we get in, your visit history and payments, and, if you want the household deduction reported for you, your personal identity code. Legal basis: the cleaning contract (GDPR Art. 6(1)(b)) and, for the deduction report and accounting, our legal obligations (Art. 6(1)(c)). Household deduction reports go to the Finnish Tax Administration; card payments are processed by Stripe.
| Data | How long | What happens then |
|---|---|---|
| Contact details and home addressYour name, email, phone, the address we clean and your billing details. | 3 years after your last cleaning visit | Removed; what is left cannot be linked to you. |
| Access instructionsHow we get in: key, code or other instructions for your home. | 3 years after your last cleaning visit | Deleted. |
| Personal identity codeStored encrypted, to report your household deduction (kotitalousvähennys) to the Finnish Tax Administration. If a contract you signed with us also needs it, it is kept with that contract. | Until you stop the deduction reporting or stop being our customer | Deleted. |
| Household deduction reports and paymentsWhat we reported to the Tax Administration, and what each visit cost. | 6 years after the end of the year (accounting law) | Reports are deleted; payments are kept without your details. |
| Feedback on a visitYour rating, comment, name and email when you rate a cleaning. | 3 years after the visit | Your name, email and comment are removed; the rating stays. |
| Sign-in to your customer pageSign-in links and sessions, with the device and network address they were requested from. | 30 days after the link or session expires | Deleted. |
Tenants, owners and other contract parties
When you sign a lease, a management or co-hosting agreement, a furniture-leasing agreement or another contract with us, we process the details in it, your signature and, for a lease, the move-in and move-out inspections. Legal basis: the contract (GDPR Art. 6(1)(b)) and our accounting obligations (Art. 6(1)(c)).
| Data | How long | What happens then |
|---|---|---|
| Your leaseThe signed lease, your signature, the network address you signed from, the move-in and move-out inspections and their photos. | While the tenancy lasts and 3 years after it ends (deposit and damage claims) | Signatures, network addresses, photos and documents are deleted; the rent and dates stay in our accounts. |
| Credit checkThe result of the credit check on a long-stay application. | 24 months after the check | Deleted. |
| Other signed contractsManagement, co-hosting, furniture leasing, cleaning service and rental agreements: your details in them, your signature and the signed document. | 6 years after the end of the year the contract ended (accounting law) | Your details, signature and the document are deleted. |
Business contacts and apartment owners
When we offer accommodation to companies, or management to apartment owners, we process the contact details and notes described below. Where they come from: you, your company's website, a contact form you sent us, or for company details the Finnish Trade Register (YTJ). Legal basis: our legitimate interest in offering our services to businesses and owners (GDPR Art. 6(1)(f)), and once you buy from us, our contract (Art. 6(1)(b)). We email a named person at a company only when the offer concerns their job, or with their consent; an owner who is a private person we email only with their consent. You can object at any time, and we will not contact you again.
| Data | How long | What happens then |
|---|---|---|
| Business contactsYour name, title, employer, work email and phone, and our notes of calls and meetings, when we offer accommodation to your company. | 24 months after our last contact with you or your company | Deleted. |
| Business customersThe same details once your company buys accommodation from us. | 3 years after your last stay, our last deal or the end of our agreement | Deleted; invoices stay in our accounts as the table above says. |
| Apartment owners we are in touch withYour name and contact details, your apartment's details, our estimate of what it could earn, and our notes of calls and meetings. | 24 months after our last contact with you | Deleted. |
| Owners with an agreementThe same details once you sign a management or listing agreement with us. | 3 years after our last agreement with you ends | Deleted; the agreement itself is kept as the contracts table says. |
| If you ask us not to contact youA scrambled (hashed) copy of your email address or phone number, which cannot be read back, so that we never contact you again. | For good, so that your objection always holds | Nothing else about you is kept with it. |
Your rights
You have the right to access, rectify, erase, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time. To exercise these, email us. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
Contact
Questions about your data: joona@easy-host.fi or info@easy-host.fi.