Amplistay
Log inGet started

Privacy Policy

Amplistay · RENTATOP TECH, S.L.

I. PRIVACY AND DATA PROTECTION POLICY

In compliance with current legislation, Amplistay (hereinafter, the "Website" or "Platform") undertakes to adopt the necessary technical and organizational measures according to the level of security appropriate to the risk of the data collected.

Laws incorporated into this Privacy Policy This privacy policy is adapted to the current Spanish and European regulations regarding the protection of personal data. Specifically, it complies with:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
  • Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPD-GDD).
  • Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).

Identity of the Data Controller

  • Company Name: RENTATOP TECH, S.L.
  • NIF (Tax ID): B26742510
  • Address: Calle Jose Antonio Coderch, 50, 28055, Madrid, Spain.
  • Contact Email: [email protected]

Controller and processor: who decides about each piece of data

  • Data of Hosts and website owners (account, business, subscription): Amplistay is the controller.
  • Guests' data (booking, signed contract, traveller registration): the controller is the accommodation's Host, who collects it to manage the stay and meet their legal obligations. Amplistay processes it as a processor, on the Host's behalf and following their instructions, never for its own purposes. To exercise your rights over this data, contact the Host; if you write to us, we will pass your request on to them.
  • Data visitors send through the website of an Amplistay customer (for example the contact form: name, email, phone and message): the controller is the owner of that website, whether an accommodation or a business, who receives it and replies. Amplistay processes it as a processor: it delivers it to the owner by email and uses it for nothing else. To exercise your rights over it, contact the website owner.

Legal Basis for Data Processing

  • Consent: For inquiries, account registration, and acceptance of terms.
  • Performance of a Contract: For managing payment infrastructures, website hosting, and the provision of the SaaS platform services between Hosts and Amplistay, and, on the Host's behalf, for managing the Guest's booking and stay.
  • The Host's legal obligation: For traveller registration and, in Spain, its submission to the Ministry of the Interior (SES Hospedajes).

Purposes of Data Processing

  • To provide technological infrastructure for processing payments between Guests and Hosts.
  • To host and publish Hosts' websites, including connecting custom domains.
  • SaaS operational functionality: property management, website photos and content, calendar synchronization and booking records.
  • Stay management on the Host's behalf: each booking's "Your stay" page, signing the contract online and traveller registration.
  • Sending operational notifications by email and WhatsApp (new bookings, extensions, and confirmations).
  • Administrative management, subscription billing via Stripe, invoicing, and technical support.
  • Legal compliance: recording IP addresses and timestamps for the "Self-Declaration of Legality" and as evidence of contract signatures.

Contract and traveller registration data

  • To sign the contract, the main guest is asked for their details (name, ID document, address, email and phone) and their signature; these are stored together with the IP address and time of signing, and kept with the booking.
  • Traveller registration asks for the details each country's rules require (in Spain, those of SES Hospedajes: ID document, date of birth, nationality, address, and relationship in the case of minors). Document numbers are stored encrypted.
  • The Host receives a PDF copy of the traveller registration. The personal data in that registration is deleted from the Platform 30 days after that copy is sent (or, if it is never sent, 60 days after check-out); only the number of travellers and, where applicable, the SES Hospedajes receipt are kept.
  • Amplistay never reports travellers to the authorities on its own: only when the Host triggers it from their dashboard.

Recipients of Personal Data Communication between Platform Users: The data a Guest provides when booking, signing the contract or registering is made available to the Host of that accommodation.

Authorities: In Spain, the Ministry of the Interior (SES Hospedajes), when the Host submits the traveller registration.

Third-Party Service Providers (Processors and sub-processors): Amplistay uses necessary third-party services that comply with GDPR standards:

  • Stripe, Inc.: Payment processing, KYC verification, fund distribution via Stripe Connect, and subscription billing.
  • Railway Corporation: Hosting of the Platform, its database and the websites published by Hosts.
  • Cloudflare, Inc.: Secure storage of photographs and spam protection of the contact form (Turnstile).
  • Twilio Inc.: Sending WhatsApp notifications when a booking or extension is received.
  • Brevo SAS: Sending transactional emails (confirmations, receipts, the "Your stay" page, and account notifications) and delivering the messages of a website's contact form to its owner.
  • Google LLC: Address autocomplete (Google Maps) and, with your consent, web analytics (see the Cookie Policy).
  • Holded Technologies, S.L.: Issuing subscription invoices to Hosts.

When a payment is processed through the gateway of the Host's bank (Redsys), the payment data is handled by that bank under its own responsibility.

Data Retention Periods Personal data will be retained for the duration of the commercial relationship or until the User requests its deletion, except traveller registration data, which is deleted within the periods stated above. Upon account deletion, data will be kept blocked for the legally required periods (typically 6 years) to address potential legal liabilities.

Rights Derived from Personal Data Processing Users may exercise the rights of Access, Rectification, Erasure, Restriction, Objection, and Portability by sending a written communication to [email protected] attaching a copy of their ID. For a stay's data, the Guest may also contact the Host directly. If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

II. ACCEPTANCE AND CHANGES TO THIS PRIVACY POLICY The use of the Website implies acceptance of this Privacy Policy. Amplistay reserves the right to modify it to adapt to legislative changes or new software features.

Last updated: September 29, 2026.