Skip to content
spaceforcare

We keep it simple

Here is what spaceforcare knows about you and why, who helps us look after it, how long we keep it, and what you can ask of us at any time.

Last updated October 7, 2026

spaceforcare is run by Tibor Szabó, a private individual, who is the controller of your personal data. Write to support@spaceforcare.com with any question or request about it.

  • Your account: your email address, your name, and your password, which is stored only as a one-way hash. If you sign in with Google, also the name, email address and profile picture Google shares with us. We need these to create your account and sign you in. Legal basis: performing our agreement with you (GDPR Article 6(1)(b)).
  • Your space: if you rent out rooms, each location’s name and address, its time zone and currency, and its rooms with their opening hours and prices, rooms you have deleted included. We need these to run your space for you. Legal basis: performing our agreement with you.
  • Record of changes: who changed a location or a room, what they changed and when, such as a room’s new price. A location’s name, and its address apart from the country, are recorded only as changed, never with their old or new values. Legal basis: our legitimate interest in a reliable record of the business (Article 6(1)(f)).
  • Your language: the language you pick, so the site and our emails reach you in it. Legal basis: performing our agreement with you.
  • Emails we send you: confirming your address, resetting your password, and telling you about changes to your account, such as a new password or email address. Legal basis: performing our agreement with you.
  • Error reports: when something breaks, a report of what failed, in which browser, and your account ID if you were signed in. We use them only to find and fix faults. Legal basis: our legitimate interest in a service that works (Article 6(1)(f)).
  • Bot check: forms that create an account or send an email run a short automated check in your browser, to keep automated abuse out. Legal basis: our legitimate interest in a secure service.
  • Attempt counts: how many times your email address or account was used in the last hour to log in, ask for an email, or change the account, so nobody can guess a password or flood an inbox. We keep a scrambled code made from the address or account, never the address itself. Legal basis: our legitimate interest in a secure service.

We use no tracking, analytics or advertising, and error reports carry no IP address or location.

We only keep what the site needs to work, so we don’t ask for consent:

  • Sign-in session: keeps you signed in, until you sign out.
  • Language: remembers the language you picked, for a year.
  • Password reset: marks a reset in progress, for a few minutes.
  • Sign-in hint: your email address, for a few minutes after we signed you out, so the sign-in form can fill it in.
  • Session ended: a note, with nothing about you in it, that we signed you out because your session ended, so the sign-in form can say why. Until you log in again, at most 30 days.
  • Appearance: light, dark or the same as your device, if you picked one. Kept in this browser’s local storage rather than a cookie, until you pick again, and never sent to us.

These services process your data on our behalf, under a data processing agreement with each:

  • Vercel: hosting and running the site; Dublin, Ireland
  • Supabase: your account and our database; Ireland
  • Resend: sending our emails; Ireland
  • Sentry: error reports; Frankfurt, Germany
  • Cloudflare: the bot check, and passing on the mail you write to us; Cloudflare’s network, nearest to you
  • Google: sign-in with Google, if you choose it, and the inbox the mail you write to us arrives in; Google processes these under its own privacy policy

Your data is stored and processed in the European Union. Some of these providers are based in the United States; where they may access data from outside the EU, the EU’s Standard Contractual Clauses or the EU–US Data Privacy Framework apply.

  • Your account data, until you delete your account. Deleting it is immediate; the database's daily backups still hold a copy for up to 7 days, then it is gone.
  • Your locations and rooms, until you delete the location, which you do before deleting your account. A room you delete disappears from the site at once, and is kept with its location until then.
  • The record of changes, for as long as the site runs: it is what keeps the business record reliable. Once your account is deleted, the account ID in it no longer leads to anyone.
  • Records of emails we sent you, 30 days, at Resend.
  • Error reports, 30 days, and the related log entries, 7 days, at Sentry.
  • Technical request logs, at most 1 day at Vercel and 7 days at Supabase.
  • Attempt counts, an hour at most; the next attempt anyone makes after that deletes them.

You can ask us at any time to:

  • see and get a copy of your data. Signed in, your account page downloads it for you;
  • correct it. Your name and email address can be changed on your account page;
  • delete it. Once you have deleted your locations, each from its settings, your account page deletes your account and everything we hold about you, except the record of changes;
  • restrict or object to how we use it, or receive it in a portable format.

Write to support@spaceforcare.com; we answer within a month.

You can also complain to the Hungarian data protection authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).

If we change this notice in a way that affects you, such as a new provider, a new purpose, or your data leaving the EU, we will email account holders before it applies. The date at the top shows the current version.

Still wondering about something? We answer every request within a month.

Write to us