Your details should have a clear purpose.

What this notice covers

This notice describes the current BidStay website, company console and campaign forms. The property team hosting a campaign also handles the guest information it receives and may have its own privacy notice. A future checkout or marketing service will need additional disclosures before activation.

Information used by BidStay

• Company accounts: work email, authentication information, company profile and membership/access roles.
• Campaigns and bids: guest name and email, bid amount, stay dates, campaign reference, submission time, source category and review status. The form requires consent to share contact details with the property team.
• Connections: a company’s scoped HostPilot API credentials and the approved property and availability data needed for its campaigns. Stored connection credentials are encrypted.
• Technical data: hosting and security services may process request, device and network information to deliver the site, handle failures and prevent abuse.

Why information is used

Information supports company sign-in and access, property connections, campaign management, processing bids, communicating about a submitted offer and protecting the service. Required account details support account administration; guest contact-sharing uses the consent requested on the form. Technical security processing supports operation and abuse prevention.

Submitting a bid does not subscribe you to a marketing newsletter or authorize a card charge. No separate marketing subscription is included in the current bid form.

Who receives information

Your bid and contact details go to the authorized property team named on the campaign. BidStay uses Netlify for hosting, Supabase for accounts and data storage, and Cloudflare Turnstile on bid forms for abuse protection. HostPilot Pro provides the authorized property/availability connection. When email delivery is enabled, an email delivery provider such as Resend may process the recipient address and message.

These providers may process information outside your country. Hosting regions, transfer arrangements and the operator’s full processor record are being confirmed as part of launch preparation.

See Cloudflare’s Turnstile privacy notice for its security-service processing.

Storage and retention

Accounts, company records, campaigns, bids and follow-up records are stored in the service database. Automated record deletion is not currently configured. A documented retention schedule, including backups and any required business records, is being finalized; no fixed deletion period is promised by this notice.

Your choices and requests

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal information, object to certain processing or withdraw consent. Some requests may be limited by booking records, security or legal obligations. Withdrawing contact-sharing consent does not undo processing already completed.

Use the routes on our contact page to request assistance. We may need to verify your identity without requesting your password. If a concern is unresolved, you may contact the relevant data protection authority.

For background on Thai data-subject rights, see the Thai Parliament’s public PDPA guide.

Cookies and changes

Read the cookies notice for sign-in and security services. We will update this notice when service features or confirmed operator details change, and seek additional consent where required.