Love2BnB Privacy Policy

1. Who we are and what this policy covers

Love2BnB is operated by Robeerst Holding AS, Nygata 8, 7014 Trondheim, Norway. This policy covers the Love2BnB website, accounts, boutique-stay and activity enquiries, host applications, and related services. Contact [email protected] with privacy questions or requests.

2. Information we handle

• Accounts: email address, sign-in identity, and profile details you provide, such as name, country, phone number, language, or profile image.
• Saved stays: favourites and wishlists linked to your account.
• Stay and activity requests: dates, party details, contact details, messages, request status, and information needed to handle a booking or enquiry.
• Host applications and listings: contact and property information, descriptions, and images you submit.
• Messages and subscriptions: information submitted through contact forms or an announcement subscription.
• Technical information: security and service logs, browser/device details, cookie choices, and, if you consent to analytics, website usage information.

Required details are identified in the relevant form. Without them, we may not be able to create an account or process your request. Optional profile, subscription, and analytics choices are not required to browse the site.

3. Why we use information

• To create and secure accounts and provide features such as favourites (performance of our service agreement).
• To respond to enquiries and facilitate stay or activity requests with the relevant host or partner (steps requested before a booking or performance of a booking).
• To review host applications, administer listings, and communicate about them (steps requested by applicants or performance of the host relationship).
• To draft listing descriptions with Google Gemini when a host or administrator chooses that optional feature. The user reviews and decides whether to use the draft.
• To send subscribed updates and run optional analytics only where the relevant consent is given; consent can be withdrawn.
• To protect the service, prevent misuse, and resolve disputes (our legitimate interests in a secure and reliable platform).
• To keep records where applicable law requires them (legal obligation).

4. Google Sign-In and Google User Data

Google Sign-In is optional. If you choose it, Google and our authentication provider, Supabase Auth, process the sign-in. The standard identity permissions are OpenID, email, and basic profile information. This can include your Google account identifier, email address, name, and profile image where available. We use that information to authenticate you and create or manage your Love2BnB account, not to access your Gmail, Drive, or other Google content.

Supabase Auth stores the account and provider identity information needed for sign-in. Love2BnB also creates an application profile with your account ID and email address; additional profile fields are stored if you supply them. This account information is retained while the account is active, subject to the account-deletion and legal-record exceptions below. We share sign-in data with Supabase as our authentication provider and do not use it for targeted advertising or sell it. You can stop using Google Sign-In, revoke Love2BnB's access in your Google account, and request deletion using the methods below.

5. Google Search Console for administrators

An administrator may separately choose to connect a Google account with access to the Love2BnB Search Console property. This asks for thewebmasters.readonlypermission and reads search-performance metrics such as clicks, impressions, search queries, and page URLs. It cannot edit Search Console, publish pages, or request indexing.

The report is requested directly from Google in the administrator's browser. This feature holds its access token and report in browser memory while the page is open; it does not save either in the Love2BnB database. The report is used only to show search performance to that administrator, not for advertising or sale. Google also processes the authorization and API request under its own policies. Clearing the report or deleting a Love2BnB account does not itself revoke the Google authorization; the administrator can revoke it in their Google account. This is separate from ordinary Google Sign-In for guests and hosts.

6. Who receives information

We use Lovable Cloud and its Supabase-based backend to host the site, accounts, database, and uploaded files. Google provides optional sign-in, maps and location services, and—after analytics consent—Google Analytics and Tag Manager. Resend is used to deliver service emails. We share booking or enquiry details with the accommodation host or activity partner involved in your request where needed to respond or provide the service. Information may also be disclosed when required by law.

If a host or administrator chooses the optional description assistant, we send the property details visible in that form, existing description text, and any notes they enter to Google Gemini to create English drafts. We do not send booking or guest details for this feature. The drafts are not added to a listing unless the user explicitly chooses to use them. Please do not enter personal or sensitive information in the notes.

These providers process information to support the stated services. Some may process it outside the EEA; contact us for information about the provider arrangements and transfer safeguards relevant to your data.

7. Cookies and analytics

Essential browser storage supports sign-in, language and cookie preferences, and features you choose to use. Google Analytics and Tag Manager are loaded only after you allow analytics in the cookie preferences. You can change those preferences using the link in the footer. We record your cookie choice, including its version and browser user agent, so that we can respect it. Turning analytics off reloads the page to stop tags that were previously loaded.

8. Retention and account deletion

• Account and Google Sign-In: authentication and profile information is kept while the account is active. After account deletion is successfully completed, the authentication identity and account-linked profile are removed; independent records may remain as described below.
• Saved stays: favourites and wishlists linked to the account are removed after successful account deletion.
• Stay and activity requests: transactional history may remain after account deletion. A stay booking may still contain names, contact details, messages and booking snapshots. Such details require a separate review when you request their removal; we retain only what remains necessary for an open booking, accounting, a dispute or another lawful purpose.
• Contact messages: our approved retention target is to review and remove resolved enquiries within 24 months after confirmed resolution or closure, unless a contract, dispute or legal duty requires longer. Messages still being handled are reviewed for continued need.
• Host applications: our approved targets are 90 days after last activity for unused onboarding drafts that have never been submitted, and 12 months after a final rejection for rejected applications, subject to individual review and justified exceptions. Approved applications and active partner records are kept while the relationship needs them; at its end, we review each item and keep only justified contractual or accounting records for the applicable period.
• Subscriptions and consent: announcement email subscriptions can be removed on request. Browser cookie choices stay until replaced or cleared. Consent records can remain after account deletion to document the choice; no fixed automatic deletion period is currently configured.
• Technical and analytics data: operational logs are held by the hosting providers under their own configured retention. We have not verified a single platform-wide log period. Google Analytics data is processed only after analytics consent; the property-level retention configuration must be checked separately.

These are policy targets for individual review, not a claim that records are automatically deleted on those dates. We have not enabled automatic expiry. Review may be needed to confirm when an enquiry closed, whether a draft was submitted, and whether a contract, dispute or legal duty requires longer retention. Contact us if you want a record reviewed or deleted. Actual accounting documents are kept for the legally applicable period, which may differ from the period for ordinary messages. We do not apply one blanket period to all booking data.

You can delete your account in Account settings or request help at [email protected]. When account deletion succeeds, it removes the Love2BnB authentication identity and account-linked information that the current system is configured to delete. Deletion may fail while your account owns uploaded files; those files are not automatically erased, and we can help review them. Independent booking, enquiry, host, legal, accounting or operational records may also remain. Tell us if you want these records, booking snapshots or uploads reviewed. We will erase or minimise details no longer needed and explain any legal reason to retain the remainder. Retained records are not used for normal account features or marketing. The same contact address can be used to request removal of Google-related account data.

9. Your rights

Under the GDPR/EEA rules, you can ask to access or correct your data, request deletion or restriction, object to processing based on legitimate interests, and receive portable data where applicable. You can withdraw consent for optional analytics or subscriptions without affecting earlier lawful processing. Send requests to [email protected]. You may also complain to Norway's data protection authority, Datatilsynet, or another competent EEA supervisory authority.

10. Security and changes

We use authenticated access, role-based controls, and encrypted connections to help protect personal data. No online service can guarantee absolute security. If we make material changes to this policy or to how Google user data is used, we will update this page and provide additional notice where required.