Privacy Policy

Voluntary host verification and Android notifications

Hosts who choose verification provide a profile, identity document, selfie, property-right, business-registration and authority documents. The principal administrator reviews them manually. Verification is not required to publish accommodation. Before submitting a request, guests must acknowledge a warning about unconfirmed identity and possible risks.

Documents and the profile are encrypted and stored outside public files. Images are rebuilt without metadata; PDFs are stored as supplied. Identity documents, selfies and additional documents requested by the reviewer are deleted 30 days after the final decision. Property-right, business-registration and authority documents, and the profile, are kept during the service and for 15 days after it ends.

Account deletion or an explicit termination of host service ends the service; blocking or suspending an account does not. Identity documents are deleted within 30 days after account deletion. Unsubmitted materials are deleted after 30 days without activity, with an in-account notification at least seven days beforehand. A documented preservation requirement pauses deletion until explicitly lifted. Decision history retains an internal account number and is not anonymous.

User-enabled Android notifications use Firebase Cloud Messaging (FCM). We store a token linked to the account and app installation; Google Firebase processes installation identifiers and technical delivery information. The account association is removed on sign-out, disabling notifications or account deletion. Notifications concern the service and are not advertising.

In short

MASPIO is a service for finding places to stay in Georgia. We connect guests and hosts; payment and check-in happen directly between them.

We collect the minimum: only what is needed for the account, the listing, the booking request and the messages. We do not sell data and do not share it with advertising networks.

Data we collect

• Account data: email address, password stored as an irreversible hash, name, phone, interface language, registration date and last sign-in date.
• Listing data, if you publish a place: title, description, photos, price, capacity, amenities, region and settlement, address and map point, contact name and phone for guests.
• Booking data: guest name, contact, dates, number of guests, note, status and the history of status changes, as well as a record that you saw the warning about an unconfirmed host or organiser identity.
• Messages: conversations between guest and host inside a booking and in the pre-booking thread.
• Questions to the Nino assistant and to the host: the text of the question and the answer. If you are signed in, your Nino conversation is linked to your account.
• Reviews: rating, text and photos after a completed stay.
• Service records: a log of sent emails without their contents, in-app notifications, a technical record of each request to the server and a security log (time, type of event, account number and a shortened network address of the device).
• Connected platform calendars, if you list a property: the link to your calendar on another platform, the name of the source and the busy dates received through that link. Such a calendar contains no guest names, amounts or messages.
• Browser notification subscription, if you turned it on: the technical address of your device notification service, the message encryption keys and a short name of the browser and device.
• Support requests: the topic, the text, the reply address, the language of the request, and the booking or property number if the request is about them and they really belong to you.
• Images attached to a support request (no more than five): the server rebuilds them without metadata (EXIF) and keeps them private — only the author and the administration can see them.
• Suggestions to improve the service: topic, text, the decision on the suggestion and the points reward granted for it.
• MASPIO points: ledger records of credits and debits — amount, kind of points (REAL or TEST), reason and time. Points are not money.
• Invitations: your permanent invitation code and, if you signed up through someone else's link, the link to the person who invited you.
• Tours, if you run or book them: the tour description, dates, guest requests and the related messages.
• A MASPIO Sites website, if you create one: texts, photos and the site address.
• Consent to documents: which document, which version and when you accepted it.

Why we need it

• Signing in and keeping the account secure.
• Phone: contact between host and guest about a request and protection against repeated sign-ups. The number is not verified.
• Showing the listing in the catalogue and on the map.
• Delivering a booking request to the host and returning the answer.
• Messaging between guest and host.
• Emails about important events: address confirmation, password recovery, requests and their status, new messages and questions, moderation decisions, support replies. Emails go only to a confirmed address, and their frequency is limited.
• Moderation of listings and protection against abuse.
• Closing dates that are busy on another platform so that a double booking cannot happen.
• Short browser notifications about requests and their status, messages, guest questions and listing review, if you turned them on.
• Answering your support request.
• Keeping track of points and paying for platform services with them.
• Confirming that you accepted the service documents.

What other people see

A listing, including photos, address, map point and the host name, is visible to every visitor: that is the point of publishing it. The host's phone is not shown in the listing: the guest sees it after the booking is confirmed.

The host sees the guest name, contact, email address and request text as soon as the request is sent. If the guest leaves no contact, the phone or email of their account is passed on.

If a guest sends the host a question from the Nino window, the host sees the question text without the guest's name or email. The host's answer may become a shared Nino answer about this property for all visitors.

A review is public: rating, text, photos and the author name are shown.

Service administrators can access account, booking and message data to the extent needed for support and moderation.

Where data is stored

Data is stored in a database on a server rented by the service operator, together with uploaded photo files on the same server.

Passwords are stored only as an irreversible cryptographic hash. Session keys are also stored as a hash, never as plain text.

Who we share data with

We do not use advertising networks, analytics counters or tracking pixels.

• The email provider that delivers our messages: recipient address and message text.
• The language model provider: your question to the Nino assistant, the earlier messages of that conversation and listing facts; the text of a smart search query; listing or website texts when the host starts a translation, a description improvement or website text preparation. Names, emails, phones and photos are not sent.
• The map provider: your browser contacts the OpenFreeMap map servers directly, so they can see your network address. Fonts are served from our own server.
• The platform whose calendar you connected: our server follows your link to read the list of busy dates. We send only the request itself, without any guest data.
• The notification service of your browser (for example Google, Apple or Mozilla): the short notification text and the technical address of the subscription. The notification contains only the type of event, without names or amounts.
• The video services YouTube and Vimeo: if a listing has a video, your browser loads their player, and they can see your network address.
• The hosting provider Vercel: visitors open MASPIO Sites websites through the Vercel gateway, which sees the network address of the device and the requested page.
• If you write to us on WhatsApp, the conversation is processed by WhatsApp under its own rules.

Cookies

The service uses three technical cookies; page scripts cannot read them:

your session key, so that you stay signed in between pages — valid for 30 days;

the key of your conversation with the Nino assistant, so that the conversation is not lost between pages — without your name or email, valid for 90 days;

an invitation code, if you came through an invitation link — valid for 30 days and removed after sign-up.

There are no analytics or advertising cookies. The interface language is carried in the page address and is not stored in a cookie.

Browser storage keeps only cabinet interface settings, such as the calendar zoom and the website wizard step.

How long we keep data

Account data is kept while the account exists. Bookings, messages and reviews are kept while they are useful to the parties and until the account is deleted.

A session key expires after 30 days, or immediately on sign-out and password change. One-time confirmation and recovery codes are valid for 30 minutes.

Busy dates received from another platform calendar are refreshed at every sync and are removed together with the source when you disconnect it. A notification subscription is removed when you turn notifications off in the cabinet or when the browser reports that the subscription is no longer valid. Support requests are kept until the account is deleted; no separate retention period is set for them yet.

A Nino conversation is deleted automatically after 90 days without activity.

Records of consent to documents and the points ledger are kept after account deletion as proof of consent and as the points history. They contain no name, email or phone, but they do contain the account number, so they are not anonymised data. If immutable records of your bookings remain — a booking number or a price confirmation — the account row also remains, but only with this number: no email, name, phone or password.

Daily backups of the database and files are kept on the server for 14 days. Backups made before a service update are removed manually. Deleted data disappears from backups when their period ends.

Your rights

• View and change your data in the cabinet.
• Hide or delete your listing.
• Delete the account together with your personal data — see the Data deletion page.
• Contact us with any question about personal data.

Children

The service is not intended for independent use by children. An account is created by an adult.

Changes

We may update this document. The effective date is shown at the top of the page. When the document changes, the service shows the new version and asks you to accept it. If you do not agree with the new version, write to support.