AlojaConmigo is an app for hosts of vacation rentals who want direct bookings with no commissions, plus a website where their guests see the properties and send booking requests. This policy explains what data we keep, why, and what you can do about it. We wrote it in plain language on purpose.
Who is responsible
AlojaConmigo is a product of Kaeli (“we”), from Costa Rica.
- Responsible party: Dinia Susana Campos Vargas (trading as Kaeli), an individual
- Location: San Ramón, Alajuela, Costa Rica
- Email for privacy matters: soporte@kaeliapps.com
There are two different roles:
- Host account data (the person using the app): Kaeli decides how it is processed and is responsible for it.
- Guest data (people who book): it is received and used by the host to manage the booking. AlojaConmigo only stores and processes it on the host’s behalf, as a tool. If you are a guest and have a question about your booking, the quickest way is to write to your host; you can also write to us.
What data we keep
From hosts (app account)
- Name, email and password (stored encrypted), or sign-in with Google or Apple if you choose it.
- Business and property data: name, description, photos, rules, prices, calendar, guest guide, exact address (optional) and business WhatsApp (optional).
- Instructions for receiving payments that you enter (for example, SINPE Móvil number, bank, IBAN and account holder). AlojaConmigo does not accept cards or process payments.
- Your subscription status (plan and expiry date) and an internal identifier for your account and your business.
From guests (booking website)
- Name, email, phone, country, number of guests, dates and the message they write when requesting a booking or using the contact form.
- If the host asks for it in the bookings she creates, an identity document (Costa Rican ID, DIMEX, passport or other), which the guest enters on their “My booking” link. Only the host and her admin team can see it; it never appears on the public website, and it is deleted with the account like everything else.
- Images of the payment receipts they upload to “My booking”.
- The language they chose, so we can write to them in that language.
From any website visitor
- Technical data every web server receives (IP address, browser, requested page), which our hosting provider uses to deliver the page and protect it from attacks.
- To stop abuse (automated or repeated submissions) we briefly keep an encrypted fingerprint (never the plain IP or email) of whoever submits forms, and we use Cloudflare Turnstile to tell people from bots.
- Your browser stores the theme and language you choose (local storage). We do not use advertising or analytics cookies.
What we do not do: we do not show ads, we do not track your activity across other apps or websites, we do not use analytics or tracking tools, and we do not sell or rent data to anyone. The app does not read your contacts, and it only uses your phone’s location if you tap “Use my current location” to mark your property on the map (it is not stored or shared, and never used in the background).
What we use it for
- To make the app and the website work: show properties, calculate prices, receive and manage requests and bookings, prevent double bookings and send the emails for each booking.
- To manage your account and your subscription.
- To keep the service secure and to stop fraud and spam.
- To answer you when you write to us.
- To comply with legal obligations.
We do not use data for advertising or profiling. The legal basis is performing the service you requested (or that your host requested to manage your booking), our legitimate interest in keeping it secure and, where applicable, compliance with the law.
Who sees what
- The public website only shows what the host publishes: never the exact address (only an approximate area) and never other guests’ data.
- The exact address and arrival guide are only shown to a guest with a confirmed booking, through their private “My booking” link.
- Each host can only see their own business’s data.
- Payment receipts are stored as private files, which are not public: the host of that booking sees them.
Who we work with
We use these providers, which process data on our behalf and only to provide the service (they do not use it for their own purposes):
- Supabase: database, sign-in and files (photos and receipts).
- Cloudflare: hosts the booking website and provides Turnstile, the bot protection for forms.
- Resend: sends booking emails.
- RevenueCat, Apple (App Store) and Google (Google Play): manage and charge the subscription. Apple and Google charge you directly; we never see your payment details.
- Google and Apple: only if you choose to sign in with them.
These providers may store data on servers outside your country (for example, in the United States or the European Union), with security measures and contracts that protect that data.
We may also disclose data if a competent authority requires it under the law.
How long we keep it
- Account, business, property, guest and booking data are kept as long as the account exists. Hosts can delete guests, bookings and photos at any time.
- When the account is deleted, we delete the account, the businesses you own and everything in them (properties, bookings, guests, photos and receipts). See how to delete your account.
- On the plan we use today, our database provider (Supabase) does not keep separate automatic backups. If we turn them on later, they will be deleted on their own within 7 days at most, and we will update this page.
- The encrypted anti-abuse fingerprints are deleted automatically after a few days.
- We only keep something longer if a law requires it, and only for the period that law sets. Subscription purchase history is kept by Apple, Google and RevenueCat under their own policies.
Your rights
You can ask us to see the data we hold about you, correct it, delete it, object to a use or get a copy, according to the law that protects you (for example, Costa Rica’s Law 8968 on the Protection of Individuals regarding the Processing of their Personal Data, or the General Data Protection Regulation if you live in the European Union).
- Hosts: almost everything can be viewed, corrected and deleted from the app, including the whole account.
- Guests: write to your host or to soporte@kaeliapps.com. If the data belongs to a booking, we will let the host know, since they manage it.
We will reply within a reasonable time and at the latest within the period set by law. You can also contact the data protection authority in your country (in Costa Rica, PRODHAB).
Security
Everything travels encrypted (HTTPS). Access to data is separated by business with rules inside the database itself, private files can only be opened with temporary links, and passwords are never stored in plain text. No system is perfect: if an incident affecting your data occurs, we will notify you as the law requires.
Children
AlojaConmigo is not directed at minors. You must be of legal age to create an account or request a booking. If you believe a minor has given us data, write to us and we will delete it.
Changes to this policy
If we change this policy, we will update the date above and, if the change is important, announce it in the app or by email before it applies.
Contact
Write to us at soporte@kaeliapps.com. More help on the support page.