Privacy Policy

BubbleStays.eu operates the platform at bubblestays.eu — a peer-to-peer housing marketplace exclusively for verified EU institution and NATO trainees in Brussels. We are the data controller for the personal data processed through this platform.

Contact: contact@bubblestays.eu

We collect and process the following categories of personal data:

• Account data: name, email address, age, country of origin.
• Contact preferences: WhatsApp number (optional), preferred contact method.
• Stay preferences: preferred stay duration, languages spoken.
• Verification data: verification method (community code or document upload); if you upload a document, that document (e.g. selection letter, end-of-contract) is stored securely.
• Listing data: property address, photos, price, availability dates, description.
• Application data: messages sent when applying to listings.
• Payment data: transaction records for Priority Boost purchases. Card details are processed and stored exclusively by Stripe — we never see or store your card number.
• Usage data: pages visited, events triggered (e.g. listing viewed, application sent), collected via PostHog analytics.

We process your data on the following legal bases:

• Contract performance (Art. 6(1)(b)): to provide the platform service, including account management, listings, and applications.
• Legitimate interests (Art. 6(1)(f)): for fraud prevention, platform integrity (verification), and analytics to improve the service.
• Legal obligation (Art. 6(1)(c)): to comply with applicable laws, including financial record-keeping requirements related to payments.

• To create and manage your account.
• To verify your EU/NATO trainee status and display your verification badge to other users.
• To display your profile information to hosts when you apply to a listing.
• To enable communication between applicants and hosts.
• To process Priority Boost payments.
• To send transactional emails (verification status, application updates).
• To analyse platform usage and improve the service.

We share data with the following trusted sub-processors, each bound by appropriate data processing agreements:

• Supabase (EU-hosted) — database and authentication. Your account and listing data is stored here.
• Cloudinary — cloud storage for listing photos and verification documents.
• Stripe — payment processing for Priority Boost. Stripe is PCI-DSS compliant.
• PostHog (EU region) — product analytics. Data is anonymised where possible.
• Vercel — hosting and edge network. Logs may include IP addresses for security purposes.

We do not sell your personal data to any third party.

We retain your personal data for as long as your account is active. If you delete your account, your profile, listings, and application data are permanently deleted. Verification documents are deleted within 30 days of account deletion. Payment records may be retained for up to 7 years to comply with legal financial obligations.

As a data subject under GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten"). You can also delete your account directly from your profile settings.
• Restriction — ask us to restrict processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email contact@bubblestays.eu. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

We use a session cookie to keep you signed in. We use PostHog for product analytics, which may set cookies to track usage across sessions. PostHog is configured in EU mode and we do not use the data for advertising purposes.

You can disable cookies in your browser settings, though this may affect platform functionality.

We implement industry-standard security measures including encrypted connections (HTTPS/TLS), row-level security on our database, and access controls that limit who can view personal data. Verification documents are stored in a private, access-controlled Cloudinary folder and are not publicly accessible.

No method of transmission or storage is 100% secure. If you become aware of any security issue, please contact us immediately.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will update the "Last updated" date at the top of this page when changes are made. Significant changes will be communicated via email or an in-app notice.

For any privacy-related questions or requests, please contact us at contact@bubblestays.eu.