Privacy notice

Who is responsible

The data controller is By The Venue (email [email protected]) .

What we collect

Hosts

• Email address, first name and mobile number.
• Listing details: description, photos, price, available nights, town, the map pin, and the full address and Eircode. The address, Eircode and exact pin are private: we use them to check listings and work out distances, and never show them publicly (the public map shows an approximate area).
• Photos are re-saved without their hidden metadata, including GPS location.
• Payment records for unlock fees (amount, date, Stripe reference). We never see or store card details.
• If you choose to verify your ID: the result of the check (verified or not). The ID document and selfie are processed by Stripe, not stored by us.

Guests

• First name, email address, country, optional phone number, preferred contact method, dates, party size and your message.

Everyone

• Technical data such as IP address and browser details, used for security, spam prevention and rate limiting.
• Cookies: only essential ones (keeping you signed in, and security protection for forms). We don't use advertising or analytics cookies, so there is no cookie banner.

Why we use it, and our legal basis

• To provide the service (accounts, listings, enquiries, unlocks, emails): performance of a contract with you, or steps you ask us to take before one.
• To share contact details after an unlock: when a host unlocks, we share the guest's name, email, phone and preferred contact method with the host, and the host's first name, email and phone with the guest. You're told this before you send an enquiry or pay. Basis: performance of a contract / steps at your request.
• Security and fraud prevention (bot checks, rate limits, reviewing listings and reports): our legitimate interests in keeping the site safe.
• Accounting records for payments: legal obligation.

We don't sell personal data and don't send marketing emails without your consent.

Who processes data for us

• Railway (hosting) and Neon (database), in the EU where available.
• Cloudflare: photo storage (R2), domain and DNS, email forwarding, and Turnstile, which checks whether a visitor is a human.
• Stripe: unlock payments and optional ID verification. Stripe is an independent controller for some payment data; see stripe.com/privacy.
• Resend: sending our emails.
• OpenStreetMap: map images are loaded from OpenStreetMap's servers, which receive your IP address.

Some of these providers are based in, or may transfer data to, the United States. Where that happens, transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Enquiries and guest details: deleted within 6 months after the event (by 31 March 2028 for the Ryder Cup 2027), unless you ask us to delete them sooner.
• Host accounts and listings: until you delete your account, or within 6 months after the event if inactive.
• Payment records: 6 years, as required by Irish tax law.
• Security logs: up to 30 days.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive a copy in a portable format. Hosts can delete their account from the "Your details" page. For anything else, email [email protected]. We'll reply within one month.

If you're unhappy with how we handle your data, you can complain to the Data Protection Commission (dataprotection.ie).

Changes

We'll update this notice if our practices change; the date at the top shows the latest version.