Privacy Policy
Updated 2 November 2026
On this page
1. Who is responsible
Easy Host is operated by NIKOLA GARABANDIĆ PR PROGRAMERSKE I RAČUNARSKE USLUGE HARPOON GAMES NOVI SAD, Serbia. Tax identification number (PIB): 112843766. Registration number: 66391566. Registered address: Sentandrejski put 75, 21000 Novi Sad, Serbia. Contact nikola@garabandic.com for privacy questions or requests. This policy covers our website, web and mobile applications and support. We act as controller for account administration, billing records, support and service security. Accommodation operators are controllers for the guest and staff data they manage through Easy Host; we process that data on their instructions to provide the service.
2. Information we receive
Account data includes your name, email, authentication identifiers, organization and role, and information supplied by a sign-in provider. Operational data includes property details, unit inventory, rates, availability, guest names and contact details, reservation dates and amounts, and messages. We receive this information from you, authorized team members and connected channels. Support correspondence may contain information you choose to send. Please provide only what is needed and do not send passwords, API keys or full card details.
3. Payments and technical records
We process subscription status, product and transaction identifiers, purchase-verification records and relevant billing events. Paddle, Apple or Google handles payment details under its own privacy notice; Easy Host does not store full payment-card numbers or card security codes. Servers and infrastructure providers process technical information such as IP addresses, request times, device/browser details and error records to deliver and secure the service. Error reports are filtered to reduce personal information; our current app configuration does not enable session replay.
4. Purposes and legal bases
We use account and subscription data to enter into and perform our agreement, authenticate users and provide purchased features. We handle necessary financial and legal records to meet legal obligations. Our legitimate interests support proportionate security monitoring, fraud prevention, troubleshooting and responding to business support requests, subject to the rights of affected people. Where an activity requires consent, we will request it separately and allow withdrawal. Guest data is processed to carry out the accommodation operator’s documented instructions; the operator determines its lawful basis.
5. Guest information and connected channels
A connected channel may supply guest contact information, reservation updates and messages. We send only the operational information needed for the enabled connection and user instructions. Channex currently provides channel connectivity; channel services also have their own privacy terms. A guest seeking changes to a reservation or deletion of the operator’s records should contact the accommodation operator first. We assist with requests involving our processing and do not use guest records for unrelated advertising.
6. Who receives information
Authorized members of your organization can access information according to their roles. Providers supporting the service include Supabase for database/authentication, Railway and Vercel for hosting, Resend for transactional email, Sentry for error monitoring and Channex for channel integration. Paddle, Apple and Google receive the information needed for purchases made through them. We may disclose information where legally required or necessary to establish or defend legal claims. We do not sell guest or account personal data. Contact us for details of the providers relevant to your organization and any required processing agreement.
7. International processing
Our providers may process information outside Serbia or your country of residence. The applicable locations depend on the service and configuration; we do not represent that all data stays in Serbia or the EU. Transfers requiring protection under Serbian law or, where applicable, the GDPR must have an appropriate legal basis and safeguards, such as an adequacy decision or applicable contractual safeguards. Contact us for information about safeguards relevant to your data.
8. Retention and deletion
We keep operational data while it is needed for the account and authorized services. After closure or a valid deletion request, we delete or anonymize data no longer needed, subject to applicable obligations and technical backup cycles. Transaction, security and dispute records may need to be retained separately for legally required periods or while a claim is unresolved. Retention is determined by the purpose, legal requirements and the need to resolve incidents; it is not unlimited by default. Copies held independently by booking channels or payment providers remain subject to their policies. Ask us for an export before closing your account.
9. Cookies, device storage and communication
The website uses cookies and similar storage for sign-in and language preferences; mobile apps store the session information needed to keep you signed in. You can clear browser or app storage, which may sign you out or reset preferences. Payment and sign-in providers may use their own necessary technologies during their flows. Optional tracking requiring consent must not run before that consent. Service and security messages are separate from promotional messages; where promotional communication requires consent, it must be obtained separately.
10. Your rights and complaints
Depending on the applicable law, you may request access, a copy, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. Email nikola@garabandic.com. We may verify your identity and authority using proportionate information and will respond within the applicable legal deadline. In Serbia this is generally 30 days, subject to lawful extensions with notice. You may complain to Serbia’s Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) or another competent supervisory authority, including in the EEA where applicable.
11. Security, age and automated decisions
We use access controls, authentication and technical measures intended to protect information, but no system is risk-free. Protect your credentials and notify us of suspected misuse. Easy Host accounts are intended for adults managing accommodation. Guest records may include information about families supplied by the operator; this does not make Easy Host a service directed at children. We do not use guest data to make solely automated decisions producing legal or similarly significant effects about guests.
12. Changes and contact
We update this policy as the service or its processing changes. The date above identifies the latest version. We will communicate material changes through the service or account email where appropriate, and obtain a new consent where the law requires it; simply continuing to use the service does not replace required consent. Privacy contact: nikola@garabandic.com.