Privacy Policy

Who we are

This Privacy Policy explains how AI Transform Studio Ltd, registered in England and Wales (“we”, “us”) processes personal data when you use Stay180 at stay180.app. We are the controller for that processing.

We trade as Stay180. For anything about your data, write to support@stay180.app. That inbox reaches the person responsible for data protection at the company; we are not required to appoint a statutory data protection officer and we have not appointed one. We keep our postal address off this page, but you can ask support@stay180.app for it and we will give it to you.

Which data protection laws apply

We are established in the United Kingdom, so the UK GDPR and the Data Protection Act 2018 apply. The EU GDPR applies as well when you are in the EU or EEA, because it reaches a controller outside the Union that offers services to people there — which a Schengen travel tool does.

This policy is written to satisfy both. A reference to the ICO, or to a right under the UK GDPR, also means your own national supervisory authority and the equivalent right you have under the EU GDPR. Where the two differ, we apply whichever protects you more.

Scope

Without an account, Stay180 keeps confirmed stays for the calculator and trip planner on your device. This policy covers personal data we process as a controller for the website, payments, Pro accounts, and Google Calendar connection. Calendar import and other Pro tools require a signed-in account. If you create an account and subscribe, we store the stay ledger you sync, isolated to that account. The first time an account goes Pro, the stays saved on that device are imported into the account once, and only if the account is still empty, so upgrading does not lose them.

A plain-language summary of how calendar import works is on the Your data page. If that summary and this policy ever differ, this Privacy Policy applies.

Personal data we collect

Depending on how you use the Service, we may process:

• Stay data on your device — entry and exit dates and related fields you confirm in the calculator or trip planner, stored in your browser unless you create an account, subscribe, and sync.
• Synced stay data — if you create an account and subscribe to Pro, the stay ledger you upload or edit while signed in, stored by Convex and isolated to your user id. This includes the stays imported from your device the first time you go Pro.
• Account data — your email address, and the Google account id if you sign in with Google, so we can recognise the account next time. Google offers us a name and a profile picture as well, and we drop both before anything is saved, because nothing in Stay180 displays them. We also store your plan (free or Pro), a link to your Stripe customer id if you have paid, and operational timestamps such as when the welcome email or the last cap alert was sent.
• Calendar session data — a Google calendar list, the events you load, and a short-lived Google calendar access token, only if you choose Connect Google Calendar, and only in this browser session. Calendar tokens are not saved on our servers. Closing the tab ends the calendar session.
• Calendar events you choose to load in the browser — processed on your device so you can confirm travel. We do not keep a server copy of your calendar. Loading a calendar or a file lasts for the browser session: closing the tab ends it. Review choices you make by hand, such as moving an ignored event into the import list, are remembered in this browser until you disconnect or clear site data.
• Billing data — if you buy Stay180 Pro, payment status and related identifiers from Stripe. Payment card details are handled by Stripe and not stored on our servers.
• Email delivery data — sign-in codes, the one-time welcome email when an account is created, optional post-welcome nurture emails for Free users explaining features and upgrade options, and, while you are on Pro, the automatic 14-day cap alert, all sent through Resend.
• Operator and audit records — if we answer a support request or an administrator acts on an account, a record of that action: the administrator’s email, the action, the account’s email and user id, and any short note. If you delete your account, we strip the account’s email and the note from those records, as explained under Retention.
• Usage and technical data — IP address, device/browser metadata, and request logs created when the site or checkout APIs are used, as needed to operate and secure the Service. Vercel Web Analytics records anonymised page views, and Vercel Speed Insights records Core Web Vitals, without advertising cookies.
• Support content — messages you send to support.

What we do not collect

We do not require a Stay180 account to use the calculator or the trip planner. Calendar import, ICS files, and other Pro tools require a signed-in account. We do not ask to read Gmail. We do not use your calendar to build advertising profiles. We do not sell personal data.

Cookies and browser storage

We do not use advertising cookies and we run no advertising trackers on Stay180.

If you sign in, Convex Auth sets the session cookies that keep you signed in. They are essential to the account and to Pro features, they last up to 30 days or until you sign out, and they are not used for anything else. Setting the account aside, we set no first-party cookies.

The tools also keep three things in your browser, on your device, and none of it is sent to us: the stays you confirm without an account, a calendar you load plus the import decisions you make by hand, and two non-identifying markers that stop the same visit being counted twice. Storage that is essential to give you something you asked for needs no consent, so the only processing here that is not essential is the anonymous usage counting described below — and that is switched off by Do Not Track or Global Privacy Control. Clearing this site’s data removes all of it.

Google Calendar

When you connect Google Calendar, you must be signed in on Pro. Calendar sign-in happens in your browser with Google Identity Services. Stay180 asks Google for two read-only permissions: the list of calendars you are subscribed to, so you can choose which one to read, and the events on those calendars, so it can suggest hotels, flights, and tagged trips for you to confirm. Everything else is ignored unless you confirm it as a stay.

Google offers no narrower permission for either call: the calendar list is what lets you pick a travel calendar, and the events are what let Stay180 find stays in an event title, description, or location. Both permissions are read-only and never include calendar settings, sharing rules, or write access. You can instead drop a calendar file while signed in on Pro; that file never leaves this device.

Signing in to a Stay180 account with Google is a different flow: we keep your Google email address and account id on the server so the account can sign you in again, and we discard the name and profile picture Google returns before saving anything. We never send your full calendar contents to Stay180 servers. Only stays you confirm may be saved to your Pro account. Google’s own terms and privacy policy apply to your Google account.

Calendar files

If you drop a calendar file while signed in on Pro, it is parsed on this device. It is not uploaded to our servers.

Payments

If you buy Stay180 Pro, you must already have a Stay180 account. Stripe processes the payment. We receive confirmation that a payment succeeded so we can unlock Pro on that account. We do not store your card number.

Stripe is not only our processor. For payment processing, fraud prevention, and its own legal and accounting obligations, Stripe decides how it uses payment data and acts as an independent controller. Where that is the case, Stripe’s own privacy policy applies to what it does, and we cannot answer for it. We keep only the payment status and the customer identifier that links the payment to your account.

Anonymous usage counts

We count how many people visit Stay180 and how many use the free calculator and the free trip planner. This is first-party and aggregate. The only thing recorded for each event is which of those three things happened, together with the UTC day, which our server works out when the event arrives. We do not record IP addresses, device or browser details, cookies, account details, or anything you type — never your stay dates, labels, or country values.

A non-identifying marker in your browser’s local and session storage records only that a visit has already been counted for this browser and this session, so the same visit is not counted twice. It is never sent to us and is never linked to a Stay180 account. We do not use advertising trackers, and we do not sell or share these counts. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded.

The counts are stored in our database (Convex), keyed only by which tool was used and the UTC day, so they cannot be traced back to a person. We use them only to judge whether the free tools are useful and to plan capacity. They are separate from Vercel Web Analytics, which records anonymised page views, and Vercel Speed Insights, which records Core Web Vitals; both come from our host Vercel and neither uses advertising cookies.

Partner links

Some pages, including the calculator and trip planner results, may show links to other companies’ services, such as travel insurance, mobile data, flights, accommodation, or visa and relocation help. They are labelled as partner links. If you buy through one, we may earn a commission. It does not change what the calculator shows you, and we choose which categories to show from your days-left result in your browser, without sending your stays to anyone.

When you click a partner link, we count the click in the same first-party, aggregate way as the usage counts above: the only thing recorded is which partner slot was clicked and the UTC day. The same event, carrying only the partner slot, is also recorded in Vercel Web Analytics. If your browser sends Do Not Track or Global Privacy Control, neither is recorded. We never send the partner your stays, your account details, or anything you typed.

Once you are on a partner’s site, that company’s own terms and privacy policy apply, including any cookies or tracking it uses to attribute the referral. We do not control them.

Purposes and legal bases

We process personal data to provide the Service and the account you asked for (performance of a contract); to take payment and keep billing records (contract and legitimate interests); to send the account emails you need — a sign-in code, a welcome email, and, while you are on Pro, the automatic 14-day cap alert (contract and legitimate interests); to send optional post-welcome nurture emails to Free users explaining features and upgrade options, which you can unsubscribe from at any time (legitimate interests); to secure, debug, and operate the website and to record what administrators do to an account (legitimate interests); to count anonymous product usage so we know whether the free tools help (legitimate interests, switched off by Do Not Track or Global Privacy Control); and to comply with law.

Our legitimate interests are running and improving a small travel-planning tool, keeping accounts and payments secure, and keeping a record of who has handled an account. We balance those against your rights and your reasonable expectations, and you can object to processing based on legitimate interests at any time by contacting support@stay180.app.

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you. The calculator result and the leave-by date in a cap alert are calculations from the stays you saved, not decisions we take about you.

Where UK or EU GDPR requires consent for a specific optional processing activity, we will ask for it. We do not currently run advertising cookies or advertising trackers.

Sharing

We share personal data with subprocessors that help us run the Service (listed below), with professional advisers if required, and with authorities when law requires. We do not sell personal data.

• Vercel — Web application hosting, edge delivery, Web Analytics, and Speed Insights
• Stripe — Payment processing for Stay180 Pro
• Google — Optional Google account sign-in, and read-only calendar list and event access if you connect Calendar
• Convex — Database and authentication for optional Stay180 Pro accounts and synced stay ledgers
• Resend — Transactional email for sign-in codes, the welcome email, and Pro cap alerts

International transfers

We and several subprocessors operate outside the UK and the EEA. Where we transfer personal data internationally, we rely on the appropriate safeguards for the law that applies: for transfers from the UK, the UK International Data Transfer Agreement, the International Data Transfer Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations; and for transfers from the EU or EEA, the EU Standard Contractual Clauses or an EU adequacy decision, including the EU–US Data Privacy Framework where the recipient is certified under it.

Retention

Without an account, confirmed stays remain in your browser until you delete them or clear this site’s data.

If you have a Pro account, synced stays remain until you delete them, delete your account, or ask us to erase them. Deleting your account removes the server copy of your stays, your profile, and your sign-in records together. Sign-in codes are short-lived.

Operator and audit records are kept separately from your account, because their purpose is to show who handled it. When you delete your account, we immediately strip the identifying parts: your email address is removed from those records and the short note on each action is removed with it. What remains is the administrator who acted, the type of action, the date, and an internal user id that no longer points to anyone, because your user record is gone. A marker on each record shows it was redacted, so a later reader cannot mistake a stripped record for one that never had any detail.

We delete the remaining audit record automatically 30 days after you delete your account, so nothing that can be traced to you is kept long-term. Records about an administrator’s own actions — adding or removing another administrator — are separate, and are kept while that person holds that role.

Hosting and infrastructure logs are created by our providers rather than by us, and each provider keeps them for its own short operational window, which varies by provider and by plan and is not set by us. We use them for security and debugging, not for analysis. Stripe retains billing records as required for its service and for tax and accounting rules. You may ask us about deletion via support@stay180.app; we will delete what we hold within a reasonable period, subject to legal retention needs.

Anonymous usage counts contain no personal data and are not linked to you. The detailed event records are deleted automatically after 30 days; only the aggregate daily counts are kept long-term, so we can see trends, and they are not subject to individual deletion.

Security

Without an account, stay lists stay off our servers. Pro accounts store only your ledger, keyed by your user id, and other customers cannot query it. Google Calendar access is session-only in the browser. Payments go through Stripe. Sign-in codes go through Resend. The website is served over HTTPS. No method of transmission or storage is perfectly secure.

Your rights

You have rights to access, rectify, erase, restrict, object, and data portability, and to withdraw consent where processing is consent-based. You also have the right to object to processing we base on our legitimate interests. Contact support@stay180.app and we will handle your request under the law that applies to you.

You may complain about us to the UK Information Commissioner’s Office (ICO). If you are in the EU or EEA, you may complain instead to the supervisory authority in the country where you live or work, or where you think the problem happened.

For stays stored only on your device, the practical way to erase them is to delete them in Stay180 or clear this site’s data in your browser. For a Pro account, use the Account page to download or delete your account, or email support@stay180.app.

Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact support@stay180.app and we will delete it.

Changes

We may update this policy by posting a new version and changing the “Last updated” date. Material changes will be called out where practicable.