Privacy notice

Who is responsible

The host of Tia Studio Apartment decides what is held and why — in data-protection law, the controller. Write to them with anything on this page.

• The host has not published contact details here yet — reach them through the platform you booked on, and they will answer.

What is held, and why

Your name

To find your reservation and to greet you on your own page.

Your email address, when the booking carries one

To tell reservations apart and to reach you about your stay.

Your phone number, when the booking carries one or you enter it yourself

So the host can message you about arrival, usually on WhatsApp.

Your stay dates, unit and booking reference

To show the right arrival details and to plan cleaning.

The secret address of your page and its short booking code

So only you can open the page, and so you can reopen it from the homepage.

Notes the host or the booking platform attached to the reservation

Requests that affect your stay, such as a late arrival.

When your page was first opened, and when you confirm you have left

So the host knows the details reached you, and when the apartment is free for cleaning.

Counts of page opens, help-center searches and failed code lookups

To see which help articles are missing. These carry no name, no reservation and no address — only the words typed into the search box, the language and the day.

Where it comes from

Almost all of it arrives with the booking itself, from the platform you booked on — usually Booking.com — or is typed in by the host. The only things you add are your phone number, if you choose to give it, and your departure confirmation.

The legal grounds

• Your stay information is held to give you what the booking promises: GDPR Article 6(1)(b), performance of a contract.
• The aggregate counts, and the request limits that stop someone guessing booking codes, rest on the host’s legitimate interest in a portal that works and is safe: Article 6(1)(f). Neither identifies you.
• Messaging you about your own stay is part of the same service. You can ask the host to use email or the booking platform instead.

Who else sees it

No advertising network, no analytics company, no data broker. Nothing is sold.

• The server is rented from Hetzner, inside the European Union, and the data stays on it.
• If the host messages you on WhatsApp, that message travels through WhatsApp (Meta) like any other chat. Nothing else is sent there.
• The booking platform already holds your reservation — it is the source, and receives nothing new from this portal.

How long it is kept

• Your stay information stays until the host deletes it. There is no automatic clean-up yet, so if you want it gone, ask.
• Your personal link stops working about a month after checkout. After that the page cannot be opened even if the link leaks.
• The aggregate counts, including the words typed into the help-center search, are deleted after 90 days.
• Daily database backups are kept on a rotation of roughly three months, so a deletion also leaves the backups within that window.

Your rights

You can ask for a copy of everything held about you, have it corrected, have it deleted, object to how it is used, or ask for it as a portable file — the host can produce one in seconds.

Write to the contact above. You should have an answer within one month. If you are not satisfied, you can complain to the data-protection authority where you live; in Albania that is the Information and Data Protection Commissioner.

Cookies and what stays on your device

There is no tracking cookie and no advertising cookie. Two small things are saved in your own browser and never sent anywhere: the language you chose, and a list of the last stay pages you opened, so you can find them again. Clearing your browser data removes both. The host signs in with a session cookie — that one is the host’s, not yours.

Keeping it safe

• The site is served over HTTPS only.
• Your page is never indexed by search engines: it is excluded in robots.txt, in a response header and in the page itself, and it is never stored in a shared cache.
• The address of your page is a 43-character random string — it cannot be guessed — and both it and the short booking code are rate-limited against someone trying many at once.
• If a link leaks, the host can revoke it and issue a fresh one; your booking code changes with it.

Children

The portal is meant for the adult who made the booking. It is not aimed at children and asks nothing of them.

Changes to this notice

If what is held changes, this page changes with it, and the date above changes too.