PRIVACY POLICY
Updated: 08/07/20261. Who We Are (Controller)BudnBed TechnologiesOperated by: Mandeep KumarFanningerstraße 45, 10365 Berlin, Germany
Email: hello@budnbed.comBudnBed Technologies operates this website and the BudnBed platform (the "Platform") and determines how and why personal data is processed. For all privacy matters, contact us at the email above.2. What BudnBed IsBudnBed is a marketplace where verified students sublet residential accommodation to other verified students, from 14 days up to 12 months. We act as an intermediary: we are not a party to any sublease agreement concluded between users.3. What Data We Process, Why, and on What Legal Basis3.1 Account creationEmail address and password (stored hashed, never in plain text) to create and secure your account. Legal basis: Art. 6(1)(b) GDPR. Kept until account deletion.
3.2 Profile and onboardingName, date of birth, gender, university, degree program, languages, lifestyle answers (e.g. sleep rhythm, cleanliness, guests, smoking, dietary and household preferences), profile photo, self-description, to build your profile, enable compatibility-based matching, and operate the optional female-only mode (gender). Legal basis: Art. 6(1)(b) GDPR; for the female-only mode additionally our legitimate interest in user safety, Art. 6(1)(f). Kept until you edit or delete it, or until account deletion.3.3 Religion (optional, special category data)One onboarding question asks whether faith is part of your life. Answering with a specific religion is entirely optional: "Other or prefer not to say" is a full, valid answer, is never shown to anyone, and never disadvantages you or your match results. If you actively select a religion, that answer is shown on your profile to other users and is used to inform match suggestions. It is never used to filter or exclude anyone from the Platform. You can change your answer to "prefer not to say" or remove it at any time in your profile settings, with immediate effect. Legal basis: your explicit consent through active selection, Art. 9(2)(a) GDPR. Deleted immediately upon withdrawal or account deletion.
3.4 Identity and student verificationGovernment-issued ID and proof of student status, to verify that you are who you say you are and that you are a student. You give explicit consent on a dedicated screen before uploading. Documents are reviewed and deleted within 48 hours of the verification decision; we permanently store only the result (verified yes/no, date, document type checked) never the documents themselves and never document numbers. Legal basis: Art. 6(1)(b) and (f) GDPR. This verification is a voluntary trust feature of the Platform, not a statutory KYC obligation; identity verification for payout purposes is performed separately by Stripe as the regulated payment institution under its own legal obligations.
3.5 Listings and videosListing details, photos, and videos of the accommodation, to present the listing to potential guests. Kept until the listing or account is deleted. Your content is never used for BudnBed marketing; any marketing use would require your separate, explicit consent requested for the specific case.
3.6 Bookings and paymentsBooking details (dates, listing, price) and payment status. Payment card and bank data are collected and processed directly by Stripe, we never see or store your full payment details. Hosts pay no fee. Guests pay a one-time service fee of 8% of the first month's rent (minimum €25) at booking. The first month's rent and any service fee are charged in full at booking. Funds are held by our payment partner Stripe and released to the host 48 hours after move-in. Rent for subsequent months is paid directly between guest and host and is not processed by BudnBed. Legal basis: Art. 6(1)(b) GDPR; retention of booking and invoice records: Art. 6(1)(c). Booking and invoice records are retained for 10 years (§ 147 AO, § 257 HGB) in minimized form, even after account deletion. Identity documents are never part of these records.
3.7 Host payout data and tax reportingAt payout setup, hosts provide account holder name, IBAN, address, and their German tax identification number (Steuer-ID). We are legally required under the Plattformen-Steuertransparenzgesetz (PStTG, implementing EU DAC7) to report hosts' identity and earnings on the Platform annually to the Bundeszentralamt für Steuern. Legal basis: Art. 6(1)(c) GDPR. Retained as required for these obligations.
3.8 Communication between usersThe Platform chat opens after a host accepts a guest's booking request. Messages are processed to enable coordination and to investigate reported abuse or fraud. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.9 ReviewsAfter a completed stay, both parties may leave a review, which is shown on the relevant profile. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.10 Support and technical dataMessages you send us (kept up to 2 years after resolution); IP address, device and browser information, and server logs for security and abuse prevention (deleted or anonymized after 30 days). Legal basis: Art. 6(1)(f) GDPR.
4. Who Receives Your Datai) Google Ireland Ltd. (Firebase / Google Cloud) - hosting, authentication, database, file storage (including verification documents during the 48-hour review window), and server functions.
ii) Cloudinary Ltd. - storage, processing, and delivery of listing photos and videos.
iii) Stripe Payments Europe Ltd. - payment processing and payouts, including its own identity verification of payout recipients.
iv) Brevo (Brevo SAS, France) - sending transactional and service emails (e.g. booking confirmations, verification results, payment reminders).
v) Zoho Corporation - business email infrastructure for our support and contact mailboxes; when you email us, your message is processed there.
vi) Appsmith, Inc. - internal administration panel used by our team to operate the Platform (e.g. reviewing verifications and bookings); user data is displayed and processed through this tool for administrative purposes only.
vii) OpenStreetMap Foundation (map tiles) and Nominatim (geocoding) - when you view maps or create a listing, your IP address and, for hosts, the listing address are transmitted to display maps and convert addresses into coordinates.
viii) Content delivery networks - when pages load certain externally hosted images, your IP address is technically transmitted to the delivering server.
ix) Other users - your profile information and listing content are visible to other users as described above; once a booking is confirmed, the details necessary to complete the stay are shared between the parties. Your identity documents and payout details are never shown to other users.x) Authorities - only where legally required.We have concluded data processing agreements (Art. 28 GDPR) with our processors. We do not sell personal data and do not show third-party advertising.5. International TransfersOur infrastructure is operated within the EU where available. Where a provider transfers data to the United States or other third countries, this occurs under the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses (Art. 46 GDPR).6. How Long We Keep Data (Summary)Verification documents: deleted within 48 hours of the decision. Religion answer: deleted on withdrawal or account deletion. Profile data: until account deletion. Booking/invoice records: 10 years (legal obligation), minimized. Host payout and tax-reporting data: as required by law. Server logs: 30 days. Everything else: only as long as needed for its stated purpose.7. Your RightsYou have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), receive a copy of (Art. 20), and object to (Art. 21) the processing of your data, and to withdraw any consent at any time with future effect (Art. 7(3)) without affecting your use of the Platform where the data was optional. To exercise any right, email hello@budnbed.com; we respond within one month. You also have the right to lodge a complaint with a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
8. Automated Decision-MakingMatch suggestions are based on the preferences and answers you provide. We do not make fully automated decisions with legal or similarly significant effects on you (Art. 22 GDPR). Verification decisions are made by humans.
9. Data SecurityWe use encryption in transit (TLS), hashed passwords, access controls, and the security infrastructure of Google Cloud and Stripe. Verification documents are access-restricted and deleted as described in Section 3.4.
10. MinorsBudnBed is only available to persons aged 18 or over. Accounts found to belong to minors are deleted.11. CookiesWe use only technically necessary cookies and local storage required to operate the Platform (e.g. keeping you logged in). These require no consent under § 25(2) TDDDG. We do not use analytics, tracking, or marketing cookies. If this ever changes, we will update this policy and request your consent first.
12. Changes to This PolicyWe will update this policy as the Platform evolves and inform you of material changes via email or in-app notice.
Supported by
© 2025 Budnbed Technologies, all rights reserved.
PRIVACY POLICY
Updated: 08/07/20261. Who We Are (Controller)BudnBed TechnologiesOperated by: Mandeep KumarFanningerstraße 45, 10365 Berlin, Germany
Email: hello@budnbed.comBudnBed Technologies operates this website and the BudnBed platform (the "Platform") and determines how and why personal data is processed. For all privacy matters, contact us at the email above.2. What BudnBed IsBudnBed is a marketplace where verified students sublet residential accommodation to other verified students, from 14 days up to 12 months. We act as an intermediary: we are not a party to any sublease agreement concluded between users.3. What Data We Process, Why, and on What Legal Basis3.1 Account creationEmail address and password (stored hashed, never in plain text) to create and secure your account. Legal basis: Art. 6(1)(b) GDPR. Kept until account deletion.
3.2 Profile and onboardingName, date of birth, gender, university, degree program, languages, lifestyle answers (e.g. sleep rhythm, cleanliness, guests, smoking, dietary and household preferences), profile photo, self-description, to build your profile, enable compatibility-based matching, and operate the optional female-only mode (gender). Legal basis: Art. 6(1)(b) GDPR; for the female-only mode additionally our legitimate interest in user safety, Art. 6(1)(f). Kept until you edit or delete it, or until account deletion.3.3 Religion (optional, special category data)One onboarding question asks whether faith is part of your life. Answering with a specific religion is entirely optional: "Other or prefer not to say" is a full, valid answer, is never shown to anyone, and never disadvantages you or your match results. If you actively select a religion, that answer is shown on your profile to other users and is used to inform match suggestions. It is never used to filter or exclude anyone from the Platform. You can change your answer to "prefer not to say" or remove it at any time in your profile settings, with immediate effect. Legal basis: your explicit consent through active selection, Art. 9(2)(a) GDPR. Deleted immediately upon withdrawal or account deletion.
3.4 Identity and student verificationGovernment-issued ID and proof of student status, to verify that you are who you say you are and that you are a student. You give explicit consent on a dedicated screen before uploading. Documents are reviewed and deleted within 48 hours of the verification decision; we permanently store only the result (verified yes/no, date, document type checked) never the documents themselves and never document numbers. Legal basis: Art. 6(1)(b) and (f) GDPR. This verification is a voluntary trust feature of the Platform, not a statutory KYC obligation; identity verification for payout purposes is performed separately by Stripe as the regulated payment institution under its own legal obligations.
3.5 Listings and videosListing details, photos, and videos of the accommodation, to present the listing to potential guests. Kept until the listing or account is deleted. Your content is never used for BudnBed marketing; any marketing use would require your separate, explicit consent requested for the specific case.
3.6 Bookings and paymentsBooking details (dates, listing, price) and payment status. Payment card and bank data are collected and processed directly by Stripe, we never see or store your full payment details. Hosts pay no fee. Guests pay a one-time service fee of 8% of the first month's rent (minimum €25) at booking. The first month's rent and any service fee are charged in full at booking. Funds are held by our payment partner Stripe and released to the host 48 hours after move-in. Rent for subsequent months is paid directly between guest and host and is not processed by BudnBed. Legal basis: Art. 6(1)(b) GDPR; retention of booking and invoice records: Art. 6(1)(c). Booking and invoice records are retained for 10 years (§ 147 AO, § 257 HGB) in minimized form, even after account deletion. Identity documents are never part of these records.
3.7 Host payout data and tax reportingAt payout setup, hosts provide account holder name, IBAN, address, and their German tax identification number (Steuer-ID). We are legally required under the Plattformen-Steuertransparenzgesetz (PStTG, implementing EU DAC7) to report hosts' identity and earnings on the Platform annually to the Bundeszentralamt für Steuern. Legal basis: Art. 6(1)(c) GDPR. Retained as required for these obligations.
3.8 Communication between usersThe Platform chat opens after a host accepts a guest's booking request. Messages are processed to enable coordination and to investigate reported abuse or fraud. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.9 ReviewsAfter a completed stay, both parties may leave a review, which is shown on the relevant profile. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.10 Support and technical dataMessages you send us (kept up to 2 years after resolution); IP address, device and browser information, and server logs for security and abuse prevention (deleted or anonymized after 30 days). Legal basis: Art. 6(1)(f) GDPR.
4. Who Receives Your Datai) Google Ireland Ltd. (Firebase / Google Cloud) - hosting, authentication, database, file storage (including verification documents during the 48-hour review window), and server functions.
ii) Cloudinary Ltd. - storage, processing, and delivery of listing photos and videos.
iii) Stripe Payments Europe Ltd. - payment processing and payouts, including its own identity verification of payout recipients.
iv) Brevo (Brevo SAS, France) - sending transactional and service emails (e.g. booking confirmations, verification results, payment reminders).
v) Zoho Corporation - business email infrastructure for our support and contact mailboxes; when you email us, your message is processed there.
vi) Appsmith, Inc. - internal administration panel used by our team to operate the Platform (e.g. reviewing verifications and bookings); user data is displayed and processed through this tool for administrative purposes only.
vii) OpenStreetMap Foundation (map tiles) and Nominatim (geocoding) - when you view maps or create a listing, your IP address and, for hosts, the listing address are transmitted to display maps and convert addresses into coordinates.
viii) Content delivery networks - when pages load certain externally hosted images, your IP address is technically transmitted to the delivering server.
ix) Other users - your profile information and listing content are visible to other users as described above; once a booking is confirmed, the details necessary to complete the stay are shared between the parties. Your identity documents and payout details are never shown to other users.x) Authorities - only where legally required.We have concluded data processing agreements (Art. 28 GDPR) with our processors. We do not sell personal data and do not show third-party advertising.5. International TransfersOur infrastructure is operated within the EU where available. Where a provider transfers data to the United States or other third countries, this occurs under the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses (Art. 46 GDPR).6. How Long We Keep Data (Summary)Verification documents: deleted within 48 hours of the decision. Religion answer: deleted on withdrawal or account deletion. Profile data: until account deletion. Booking/invoice records: 10 years (legal obligation), minimized. Host payout and tax-reporting data: as required by law. Server logs: 30 days. Everything else: only as long as needed for its stated purpose.7. Your RightsYou have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), receive a copy of (Art. 20), and object to (Art. 21) the processing of your data, and to withdraw any consent at any time with future effect (Art. 7(3)) without affecting your use of the Platform where the data was optional. To exercise any right, email hello@budnbed.com; we respond within one month. You also have the right to lodge a complaint with a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
8. Automated Decision-MakingMatch suggestions are based on the preferences and answers you provide. We do not make fully automated decisions with legal or similarly significant effects on you (Art. 22 GDPR). Verification decisions are made by humans.
9. Data SecurityWe use encryption in transit (TLS), hashed passwords, access controls, and the security infrastructure of Google Cloud and Stripe. Verification documents are access-restricted and deleted as described in Section 3.4.
10. MinorsBudnBed is only available to persons aged 18 or over. Accounts found to belong to minors are deleted.11. CookiesWe use only technically necessary cookies and local storage required to operate the Platform (e.g. keeping you logged in). These require no consent under § 25(2) TDDDG. We do not use analytics, tracking, or marketing cookies. If this ever changes, we will update this policy and request your consent first.
12. Changes to This PolicyWe will update this policy as the Platform evolves and inform you of material changes via email or in-app notice.
Supported by
© 2025 Budnbed Technologies, all rights reserved.
PRIVACY POLICY
Updated: 08/07/20261. Who We Are (Controller)BudnBed TechnologiesOperated by: Mandeep KumarFanningerstraße 45, 10365 Berlin, Germany
Email: hello@budnbed.comBudnBed Technologies operates this website and the BudnBed platform (the "Platform") and determines how and why personal data is processed. For all privacy matters, contact us at the email above.2. What BudnBed IsBudnBed is a marketplace where verified students sublet residential accommodation to other verified students, from 14 days up to 12 months. We act as an intermediary: we are not a party to any sublease agreement concluded between users.3. What Data We Process, Why, and on What Legal Basis3.1 Account creationEmail address and password (stored hashed, never in plain text) to create and secure your account. Legal basis: Art. 6(1)(b) GDPR. Kept until account deletion.
3.2 Profile and onboardingName, date of birth, gender, university, degree program, languages, lifestyle answers (e.g. sleep rhythm, cleanliness, guests, smoking, dietary and household preferences), profile photo, self-description, to build your profile, enable compatibility-based matching, and operate the optional female-only mode (gender). Legal basis: Art. 6(1)(b) GDPR; for the female-only mode additionally our legitimate interest in user safety, Art. 6(1)(f). Kept until you edit or delete it, or until account deletion.3.3 Religion (optional, special category data)One onboarding question asks whether faith is part of your life. Answering with a specific religion is entirely optional: "Other or prefer not to say" is a full, valid answer, is never shown to anyone, and never disadvantages you or your match results. If you actively select a religion, that answer is shown on your profile to other users and is used to inform match suggestions. It is never used to filter or exclude anyone from the Platform. You can change your answer to "prefer not to say" or remove it at any time in your profile settings, with immediate effect. Legal basis: your explicit consent through active selection, Art. 9(2)(a) GDPR. Deleted immediately upon withdrawal or account deletion.
3.4 Identity and student verificationGovernment-issued ID and proof of student status, to verify that you are who you say you are and that you are a student. You give explicit consent on a dedicated screen before uploading. Documents are reviewed and deleted within 48 hours of the verification decision; we permanently store only the result (verified yes/no, date, document type checked) never the documents themselves and never document numbers. Legal basis: Art. 6(1)(b) and (f) GDPR. This verification is a voluntary trust feature of the Platform, not a statutory KYC obligation; identity verification for payout purposes is performed separately by Stripe as the regulated payment institution under its own legal obligations.
3.5 Listings and videosListing details, photos, and videos of the accommodation, to present the listing to potential guests. Kept until the listing or account is deleted. Your content is never used for BudnBed marketing; any marketing use would require your separate, explicit consent requested for the specific case.
3.6 Bookings and paymentsBooking details (dates, listing, price) and payment status. Payment card and bank data are collected and processed directly by Stripe, we never see or store your full payment details. Hosts pay no fee. Guests pay a one-time service fee of 8% of the first month's rent (minimum €25) at booking. The first month's rent and any service fee are charged in full at booking. Funds are held by our payment partner Stripe and released to the host 48 hours after move-in. Rent for subsequent months is paid directly between guest and host and is not processed by BudnBed. Legal basis: Art. 6(1)(b) GDPR; retention of booking and invoice records: Art. 6(1)(c). Booking and invoice records are retained for 10 years (§ 147 AO, § 257 HGB) in minimized form, even after account deletion. Identity documents are never part of these records.
3.7 Host payout data and tax reportingAt payout setup, hosts provide account holder name, IBAN, address, and their German tax identification number (Steuer-ID). We are legally required under the Plattformen-Steuertransparenzgesetz (PStTG, implementing EU DAC7) to report hosts' identity and earnings on the Platform annually to the Bundeszentralamt für Steuern. Legal basis: Art. 6(1)(c) GDPR. Retained as required for these obligations.
3.8 Communication between usersThe Platform chat opens after a host accepts a guest's booking request. Messages are processed to enable coordination and to investigate reported abuse or fraud. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.9 ReviewsAfter a completed stay, both parties may leave a review, which is shown on the relevant profile. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.10 Support and technical dataMessages you send us (kept up to 2 years after resolution); IP address, device and browser information, and server logs for security and abuse prevention (deleted or anonymized after 30 days). Legal basis: Art. 6(1)(f) GDPR.
4. Who Receives Your Datai) Google Ireland Ltd. (Firebase / Google Cloud) - hosting, authentication, database, file storage (including verification documents during the 48-hour review window), and server functions.
ii) Cloudinary Ltd. - storage, processing, and delivery of listing photos and videos.
iii) Stripe Payments Europe Ltd. - payment processing and payouts, including its own identity verification of payout recipients.
iv) Brevo (Brevo SAS, France) - sending transactional and service emails (e.g. booking confirmations, verification results, payment reminders).
v) Zoho Corporation - business email infrastructure for our support and contact mailboxes; when you email us, your message is processed there.
vi) Appsmith, Inc. - internal administration panel used by our team to operate the Platform (e.g. reviewing verifications and bookings); user data is displayed and processed through this tool for administrative purposes only.
vii) OpenStreetMap Foundation (map tiles) and Nominatim (geocoding) - when you view maps or create a listing, your IP address and, for hosts, the listing address are transmitted to display maps and convert addresses into coordinates.
viii) Content delivery networks - when pages load certain externally hosted images, your IP address is technically transmitted to the delivering server.
ix) Other users - your profile information and listing content are visible to other users as described above; once a booking is confirmed, the details necessary to complete the stay are shared between the parties. Your identity documents and payout details are never shown to other users.x) Authorities - only where legally required.We have concluded data processing agreements (Art. 28 GDPR) with our processors. We do not sell personal data and do not show third-party advertising.5. International TransfersOur infrastructure is operated within the EU where available. Where a provider transfers data to the United States or other third countries, this occurs under the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses (Art. 46 GDPR).6. How Long We Keep Data (Summary)Verification documents: deleted within 48 hours of the decision. Religion answer: deleted on withdrawal or account deletion. Profile data: until account deletion. Booking/invoice records: 10 years (legal obligation), minimized. Host payout and tax-reporting data: as required by law. Server logs: 30 days. Everything else: only as long as needed for its stated purpose.7. Your RightsYou have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), receive a copy of (Art. 20), and object to (Art. 21) the processing of your data, and to withdraw any consent at any time with future effect (Art. 7(3)) without affecting your use of the Platform where the data was optional. To exercise any right, email hello@budnbed.com; we respond within one month. You also have the right to lodge a complaint with a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
8. Automated Decision-MakingMatch suggestions are based on the preferences and answers you provide. We do not make fully automated decisions with legal or similarly significant effects on you (Art. 22 GDPR). Verification decisions are made by humans.
9. Data SecurityWe use encryption in transit (TLS), hashed passwords, access controls, and the security infrastructure of Google Cloud and Stripe. Verification documents are access-restricted and deleted as described in Section 3.4.
10. MinorsBudnBed is only available to persons aged 18 or over. Accounts found to belong to minors are deleted.11. CookiesWe use only technically necessary cookies and local storage required to operate the Platform (e.g. keeping you logged in). These require no consent under § 25(2) TDDDG. We do not use analytics, tracking, or marketing cookies. If this ever changes, we will update this policy and request your consent first.
12. Changes to This PolicyWe will update this policy as the Platform evolves and inform you of material changes via email or in-app notice.
Supported by
© 2025 Budnbed Technologies, all rights reserved.
PRIVACY POLICY
Updated: 08/07/20261. Who We Are (Controller)BudnBed TechnologiesOperated by: Mandeep KumarFanningerstraße 45, 10365 Berlin, Germany
Email: hello@budnbed.comBudnBed Technologies operates this website and the BudnBed platform (the "Platform") and determines how and why personal data is processed. For all privacy matters, contact us at the email above.2. What BudnBed IsBudnBed is a marketplace where verified students sublet residential accommodation to other verified students, from 14 days up to 12 months. We act as an intermediary: we are not a party to any sublease agreement concluded between users.3. What Data We Process, Why, and on What Legal Basis3.1 Account creationEmail address and password (stored hashed, never in plain text) to create and secure your account. Legal basis: Art. 6(1)(b) GDPR. Kept until account deletion.
3.2 Profile and onboardingName, date of birth, gender, university, degree program, languages, lifestyle answers (e.g. sleep rhythm, cleanliness, guests, smoking, dietary and household preferences), profile photo, self-description, to build your profile, enable compatibility-based matching, and operate the optional female-only mode (gender). Legal basis: Art. 6(1)(b) GDPR; for the female-only mode additionally our legitimate interest in user safety, Art. 6(1)(f). Kept until you edit or delete it, or until account deletion.3.3 Religion (optional, special category data)One onboarding question asks whether faith is part of your life. Answering with a specific religion is entirely optional: "Other or prefer not to say" is a full, valid answer, is never shown to anyone, and never disadvantages you or your match results. If you actively select a religion, that answer is shown on your profile to other users and is used to inform match suggestions. It is never used to filter or exclude anyone from the Platform. You can change your answer to "prefer not to say" or remove it at any time in your profile settings, with immediate effect. Legal basis: your explicit consent through active selection, Art. 9(2)(a) GDPR. Deleted immediately upon withdrawal or account deletion.
3.4 Identity and student verificationGovernment-issued ID and proof of student status, to verify that you are who you say you are and that you are a student. You give explicit consent on a dedicated screen before uploading. Documents are reviewed and deleted within 48 hours of the verification decision; we permanently store only the result (verified yes/no, date, document type checked) never the documents themselves and never document numbers. Legal basis: Art. 6(1)(b) and (f) GDPR. This verification is a voluntary trust feature of the Platform, not a statutory KYC obligation; identity verification for payout purposes is performed separately by Stripe as the regulated payment institution under its own legal obligations.
3.5 Listings and videosListing details, photos, and videos of the accommodation, to present the listing to potential guests. Kept until the listing or account is deleted. Your content is never used for BudnBed marketing; any marketing use would require your separate, explicit consent requested for the specific case.
3.6 Bookings and paymentsBooking details (dates, listing, price) and payment status. Payment card and bank data are collected and processed directly by Stripe, we never see or store your full payment details. Hosts pay no fee. Guests pay a one-time service fee of 8% of the first month's rent (minimum €25) at booking. The first month's rent and any service fee are charged in full at booking. Funds are held by our payment partner Stripe and released to the host 48 hours after move-in. Rent for subsequent months is paid directly between guest and host and is not processed by BudnBed. Legal basis: Art. 6(1)(b) GDPR; retention of booking and invoice records: Art. 6(1)(c). Booking and invoice records are retained for 10 years (§ 147 AO, § 257 HGB) in minimized form, even after account deletion. Identity documents are never part of these records.
3.7 Host payout data and tax reportingAt payout setup, hosts provide account holder name, IBAN, address, and their German tax identification number (Steuer-ID). We are legally required under the Plattformen-Steuertransparenzgesetz (PStTG, implementing EU DAC7) to report hosts' identity and earnings on the Platform annually to the Bundeszentralamt für Steuern. Legal basis: Art. 6(1)(c) GDPR. Retained as required for these obligations.
3.8 Communication between usersThe Platform chat opens after a host accepts a guest's booking request. Messages are processed to enable coordination and to investigate reported abuse or fraud. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.9 ReviewsAfter a completed stay, both parties may leave a review, which is shown on the relevant profile. Legal basis: Art. 6(1)(b) and (f) GDPR.
3.10 Support and technical dataMessages you send us (kept up to 2 years after resolution); IP address, device and browser information, and server logs for security and abuse prevention (deleted or anonymized after 30 days). Legal basis: Art. 6(1)(f) GDPR.
4. Who Receives Your Datai) Google Ireland Ltd. (Firebase / Google Cloud) - hosting, authentication, database, file storage (including verification documents during the 48-hour review window), and server functions.
ii) Cloudinary Ltd. - storage, processing, and delivery of listing photos and videos.
iii) Stripe Payments Europe Ltd. - payment processing and payouts, including its own identity verification of payout recipients.
iv) Brevo (Brevo SAS, France) - sending transactional and service emails (e.g. booking confirmations, verification results, payment reminders).
v) Zoho Corporation - business email infrastructure for our support and contact mailboxes; when you email us, your message is processed there.
vi) Appsmith, Inc. - internal administration panel used by our team to operate the Platform (e.g. reviewing verifications and bookings); user data is displayed and processed through this tool for administrative purposes only.
vii) OpenStreetMap Foundation (map tiles) and Nominatim (geocoding) - when you view maps or create a listing, your IP address and, for hosts, the listing address are transmitted to display maps and convert addresses into coordinates.
viii) Content delivery networks - when pages load certain externally hosted images, your IP address is technically transmitted to the delivering server.
ix) Other users - your profile information and listing content are visible to other users as described above; once a booking is confirmed, the details necessary to complete the stay are shared between the parties. Your identity documents and payout details are never shown to other users.x) Authorities - only where legally required.We have concluded data processing agreements (Art. 28 GDPR) with our processors. We do not sell personal data and do not show third-party advertising.5. International TransfersOur infrastructure is operated within the EU where available. Where a provider transfers data to the United States or other third countries, this occurs under the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses (Art. 46 GDPR).6. How Long We Keep Data (Summary)Verification documents: deleted within 48 hours of the decision. Religion answer: deleted on withdrawal or account deletion. Profile data: until account deletion. Booking/invoice records: 10 years (legal obligation), minimized. Host payout and tax-reporting data: as required by law. Server logs: 30 days. Everything else: only as long as needed for its stated purpose.7. Your RightsYou have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), receive a copy of (Art. 20), and object to (Art. 21) the processing of your data, and to withdraw any consent at any time with future effect (Art. 7(3)) without affecting your use of the Platform where the data was optional. To exercise any right, email hello@budnbed.com; we respond within one month. You also have the right to lodge a complaint with a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
8. Automated Decision-MakingMatch suggestions are based on the preferences and answers you provide. We do not make fully automated decisions with legal or similarly significant effects on you (Art. 22 GDPR). Verification decisions are made by humans.
9. Data SecurityWe use encryption in transit (TLS), hashed passwords, access controls, and the security infrastructure of Google Cloud and Stripe. Verification documents are access-restricted and deleted as described in Section 3.4.
10. MinorsBudnBed is only available to persons aged 18 or over. Accounts found to belong to minors are deleted.11. CookiesWe use only technically necessary cookies and local storage required to operate the Platform (e.g. keeping you logged in). These require no consent under § 25(2) TDDDG. We do not use analytics, tracking, or marketing cookies. If this ever changes, we will update this policy and request your consent first.
12. Changes to This PolicyWe will update this policy as the Platform evolves and inform you of material changes via email or in-app notice.
Supported by
© 2025 Budnbed Technologies, all rights reserved.