Privacy Policy

1. Data Controller

For any questions relating to the processing of your personal data, or to exercise any of your rights under this Policy, please contact us at info@recal.co.

2. What Personal Data We Collect

2.1 Account registration (mandatory)

When you create a Recal account, we collect the following information:

• Email address
• Password (stored in encrypted form via AWS Cognito — we never store passwords in plain text)
• First name
• Last name
• Country
• Account type (standard account or staff account)
• Subscription tier selected (Starter, Host, Manager, or Business)

2.2 Optional profile information

After registration, users may optionally provide additional profile information:

• Username and user tag
• Phone number
• Profile picture and banner image
• Company name and account company name
• Short bio and full bio
• Website URL
• Social media profiles (Instagram, Facebook, LinkedIn)
• Address information (street, city, ZIP code)
• Date of birth
• Preferences (language, timezone, date format, base currency, notification settings, profile visibility settings)

2.3 Property and operational data

When using the platform, users input and manage operational data relating to their properties and business, including property details, booking information, contact lists, task records, notes, documents, and files. This data belongs to the user. Recal processes it solely to provide the platform services.

2.4 Technical and usage data

We automatically collect certain technical data when you use the platform, including:

• IP address and device/browser information for authentication and security purposes;
• Platform usage data (pages visited, features used, session duration, and your account display name) via PostHog analytics, subject to your cookie consent;
• Platform usage analytics via Vercel Analytics, subject to your cookie consent;
• Performance telemetry via Vercel Speed Insights, collected as strictly necessary for platform reliability and performance monitoring;
• Error and crash reports via Sentry, collected as strictly necessary for platform stability. These reports include a pseudonymous account identifier (and, where applicable, your account type and subscription tier) so we can diagnose faults affecting your account; they do not include directly identifying information such as your name, email address, or IP address;
• Payment transaction data processed by Stripe (we do not store card numbers — all payment data is handled directly by Stripe);
• Property location data (latitude/longitude) sent to WeatherAPI for weather forecast display;
• Push notification subscription data, if you choose to enable browser notifications.

2.5 Guest and contact data you manage in Recal

Recal customers store information about third parties — guests, owners, contractors, and other contacts — in order to run their property operations. For that data, you are the data controller and Recal is your processor: we process it only as needed to provide the platform and never for our own purposes. You are responsible for having a lawful basis to record it and for informing the individuals concerned where required. Guest and contact data is never sold, is deleted with your account, and booking documents you upload (which may include identity documents such as ID scans required by local registration rules) are stored in private storage and never shared.

Where booking data arrives through a calendar (iCal) feed you have connected, Recal receives it from the feed provider rather than from the individual concerned (Article 14 GDPR). It is limited to what the feed contains — typically stay dates, a name, and occasionally a contact address — and is visible only inside your account.

3. Purposes and Legal Basis for Processing

We process your personal data for the following purposes, each with its specific legal basis:

3.1 Provision of the platform service

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). We process your registration data and operational data to create and manage your account, authenticate your identity, provide you with access to the platform features included in your subscription tier, and communicate with you about your account and the service.

3.2 Billing and payment processing

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). We use your billing information and subscription data to process subscription payments via Stripe, manage subscription upgrades and cancellations, and issue any applicable invoices or receipts.

3.3 Platform security, stability, and fraud prevention

Legal basis: Legitimate interests (Article 6(1)(f) GDPR). We process technical data to protect the security and integrity of the platform, detect and prevent unauthorised access, fraud, and abuse, and maintain the reliability of the service for all users. This includes error tracking via Sentry and performance monitoring via Vercel Speed Insights, both classified as strictly necessary for service integrity. Sentry error reports are linked to a pseudonymous account identifier so faults can be traced to the affected account, but do not contain directly identifying information such as your name, email address, or IP address; Vercel Speed Insights collects no personally identifiable information.

3.4 Platform analytics and improvement

Legal basis: Consent (Article 6(1)(a) GDPR). Subject to your explicit consent via our cookie banner, we use PostHog and Vercel Analytics to analyse how users interact with the platform in order to identify issues, improve usability, and develop new features. You may withdraw this consent at any time by adjusting your cookie preferences.

This includes session replay, which has its own separate consent toggle: with your specific consent, your interactions with the platform (clicks, scrolling, pages viewed) are recorded to help us fix usability problems. All text on the page and everything you type are masked and never recorded — recordings contain interface structure and interactions only.

Separately from consent-based analytics, we record core subscription lifecycle events (such as a subscription starting or ending, plan changes, and payment failures or recoveries) on the basis of our legitimate interest (Article 6(1)(f) GDPR) in maintaining accurate billing and account records. These are business records, not behavioural tracking, and are limited to the minimum necessary.

3.5 Legal compliance

Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR). We may process and retain certain data as required by applicable Spanish and European law, including tax and accounting obligations.

3.6 AI assistant and AI features

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) in providing the AI-assisted functionality you request, assessed in line with EDPB Opinion 28/2024. Recal includes an AI assistant ('Ask Recal', on the Manager and Business tiers) and an AI property-description generator.

When you use these features, the data needed to generate the response is processed by our AI infrastructure providers: your messages and any files you attach (which may contain guest, booking, or contact details you choose to include), and — when the assistant looks up your records to answer you — compact summaries of those records (for example property details and operational contacts, booking dates and guest names, contact names, email addresses and phone numbers, booking notes you have written, and short previews of recent messages). Guest email addresses and phone numbers stored in bookings are not included in what the model receives.

Every AI request is routed under zero-data-retention agreements: our model providers do not store your prompts or the generated output after the request completes, and do not use them to train their models. The assistant only proposes changes — nothing is written or sent until you review and confirm it. Assistant conversations are stored in your account and deleted automatically 12 months after their last activity (individual messages 12 months after they are sent); you can delete any conversation immediately at any time.

3.7 Product updates and marketing communications

Legal basis: Consent (Article 6(1)(a) GDPR). If you opt in — via the unticked checkbox at signup, or later in your settings — we send occasional emails about new Recal features and product updates, delivered via our email provider (Resend). You can withdraw this consent at any time using the unsubscribe link included in every such email. Withdrawal does not affect transactional emails (account verification, invitations, billing notices), which we send because they are necessary to operate the service (Article 6(1)(b) GDPR).

4. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy:

• Account data and operational data (properties, bookings, contacts, files, etc.) are retained for the duration of your active account. Upon account deletion, account and operational data are deleted immediately from our database and authentication provider (AWS Cognito), and the associated stored files (documents, photos, attachments) are removed from storage as part of the same process. Messages you exchanged with other users are retained for the other participant, with your identity shown as a deleted account. AI assistant conversations are deleted with your account and in any case expire automatically 12 months after their last activity.
• If you wish to retain a copy of your data before deleting your account, you may request a data export by contacting info@recal.co.
• Billing and payment records are retained by Stripe in accordance with Spanish fiscal obligations (Ley General Tributaria). Upon account deletion, any active Stripe subscription is cancelled at the end of the current billing period. Transaction history is retained by Stripe per its own data retention policies.
• Analytics data (PostHog) is retained for up to 12 months.
• Error tracking data (Sentry) is retained for up to 90 days and then deleted automatically.

5. Data Sharing and Third-Party Processors

Recal does not sell, rent, or share your personal data with third parties for marketing purposes. We share data only with the following categories of service providers, strictly as necessary to operate the platform. Unless otherwise noted below, all third-party processors are bound by GDPR-compliant Data Processing Agreements (DPAs) — either incorporated automatically into their service terms, or formally accepted by Recal:

All third-party processors have been selected with due regard for their data protection practices. A current list of the sub-processors we use, the purpose of each, the data each receives, and their locations is published on our Sub-processors page.

6. International Data Transfers

Some of our third-party processors (including AWS, Stripe, and Mapbox) may process data outside the European Economic Area (EEA). Where such transfers occur, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries recognised as providing an adequate level of data protection. Details of applicable transfer mechanisms for specific processors are available on request.

7. Your Rights

As a data subject under the GDPR, you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may request correction of inaccurate or incomplete data.
• Right to erasure: you may request deletion of your personal data, subject to legal retention obligations.
• Right to restriction of processing: you may request that we limit how we use your data in certain circumstances.
• Right to data portability: you may request your data in a structured, commonly used, machine-readable format. To request a data export, please contact info@recal.co.
• Right to object: you may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@recal.co. We will respond within 30 days of receiving your request. You also have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Espanola de Proteccion de Datos — www.aepd.es).

8. Data Security

Recal implements appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• All data transmissions are encrypted in transit using TLS/HTTPS;
• User passwords are managed through AWS Cognito and are never stored in plain text;
• Access tokens are stored as HttpOnly cookies, inaccessible to client-side scripts;
• Files, documents, and damage photos are stored in private cloud storage and served only to authenticated, authorised users; property listing photos you choose to publish are the only publicly served images;
• Access to user data within Recal is restricted by role-based permissions.

While we take all reasonable steps to protect your data, no system is entirely immune to security risks. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, as required by the GDPR.

9. Children’s Privacy

The Recal platform is intended for professional use by adults. By creating an account and accepting our Terms of Use, you represent that you are at least 18 years of age. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected data from a minor, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will notify users via email or a prominent notice within the platform, and update the ‘Last updated’ date at the top of this document. Continued use of Recal after any update constitutes acceptance of the revised Policy.

11. Contact

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact: