Privacy Policy
Last updated: 4 October 2026
Who we are
We are the data controller for personal data you provide when booking luggage storage. Contact: contact.stowbees@gmail.com.
What we collect
Your name, email, phone (optional), booking details and payment status. For bookings made at our counter we record your name and email (to send your confirmation) and, only if you choose, a phone number. Card details are handled directly by Stripe — we never see or store your full card number. We also keep an internal record of the actions our staff take on your booking (such as check-in, changes and refunds) and of any cash payments. When you drop off, we photograph your bags (only the luggage). You can see that photo on your own booking page, which opens only through your private booking link; each photo link expires after 10 minutes. If you leave a review, we keep your stars, your text, the name you choose to show (or none) and your private note if you write one.
Why we use it (lawful basis)
To provide and manage your booking (performance of a contract), to send your confirmation and service messages, to meet legal and accounting obligations, and to keep our service secure (legitimate interests). After your pick-up we send one email asking about your stay (legitimate interest); you will not get a second one, and you can object by replying to it. Published reviews show your stars, text, chosen name and month of stay on our website.
Who we share it with
Trusted providers that process data on our behalf: Stripe (payments), Supabase (secure database hosting), Resend (email delivery), Vercel (website hosting), and Vercel Analytics (privacy-friendly, cookieless traffic statistics — no personal profiles). Each acts under a data-processing agreement. We also count anonymous booking-form step totals in our own database — no cookies, no identifiers and no IP addresses — only to see where the booking form can be made easier.
How long we keep it
We keep booking records, including the staff action log, for up to 18 months after your stay (longer only where legal or accounting rules require), then delete or anonymise the personal data. Photos of bags taken at drop-off (including one group photo of all your bags) are deleted 90 days after collection. Bookings that were started but never paid are anonymised after 30 days. Published reviews stay online until you ask us to remove them; when your booking is anonymised, the private note is deleted. Reviews not yet published are deleted after 90 days.
Your rights
Under the GDPR you may request access, correction, deletion, restriction, or portability of your data, and object to certain processing. Email us and we will respond within the legal time limit. You may also complain to the Portuguese data protection authority (CNPD).
Cookies
We use only essential cookies needed for the site and secure admin access to function. We do not use advertising, analytics or third-party tracking cookies.