Privacy Policy

Who we are

Galloway Getaways Ltd is the data controller for the information described here. We are registered in Scotland (company number SC899385), and our registered office is 17b King Street, Castle Douglas, DG7 1AA. For anything about your data, email hello@gallowaygetaways.co.uk.

What we collect

• Account details — your name, email address, and a password we never see in readable form.
• Profile information — preferred name, phone number, address and profile photo, where you choose to give them.
• Booking information — the properties you book, dates, guest numbers and the messages you exchange with hosts.
• Payment information — handled entirely by Stripe. We receive confirmation that a payment succeeded and the last four digits of the card. We never see or store your full card number.
• Listing information, if you are a host — including your property address and short-term let licence number, which the law requires us to display.

Why we use it

To run your bookings and take payment, which is necessary to perform our contract with you. To send you booking confirmations, check-in details and messages from your host. To meet legal obligations including tax records and short-term let licensing. And to keep the platform secure and prevent fraud, which is our legitimate interest.

We do not sell your data, and we do not use it for advertising.

Who we share it with

• Your host — your name and booking details, so they can prepare for your stay. Your exact address is not shared with them.
• Us — the two directors of Galloway Getaways can see your real name on our internal admin pages, whatever you have chosen under “Show my full legal name” in Account settings. That setting controls what other guests and hosts see. We still need to know who we are dealing with when we approve a new host, pay one, or sort out a dispute between two people, and we would rather say so plainly than leave it implied.
• Stripe, to process payments and payouts.
• Supabase, which hosts our database, and Vercel, which hosts the site.
• Authorities, where we are legally required to — including licensing authorities in relation to short-term lets.

How long we keep it

Booking and payment records are kept for six years, as UK tax law requires. Account information is kept while your account is open.

You can deactivate your account at any time, which hides your profile and any listings and suspends your sign-in but keeps everything, so we can bring it back if you ask. Or you can delete it permanently. When you delete, we remove your profile and personal details, but we must keep booking and payment records for the six-year period above, along with anything we need to resolve a dispute or meet a legal obligation. Reviews you wrote stay visible, shown as from a deleted user. The messages you sent are removed from your conversations; the replies other people wrote to you stay in their own inbox, so their records are intact.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict processing. You can download everything we hold about you at any time from Account settings under Privacy, and delete your account from the same place.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can put it right.

Cookies

We use only the cookies needed to keep you signed in and to remember whether you are browsing as a guest or a host. We do not use advertising or tracking cookies.

Where your data is held

Our database and files are held within the UK and EU. Some of our suppliers, including Stripe, may process data outside the UK under safeguards approved for international transfers.

Changes

If we change this policy we will update the date at the top, and tell you directly if the change is significant.