Privacy Policy

Last updated: 25 August 2026

Who is responsible

The data controller is Enrico Antonacci, reachable at dev@2devstudio.com. This policy explains what we do with personal data on stayn1.com, under the GDPR (Regulation (EU) 2016/679).

What we collect, and why

What you publish yourself. For an individual profile: first name, last name, link, optional description and photograph. For a company profile: company name, website, optional description and logo or image. This information is public by design: the whole point of the Service is to display it on a leaderboard that anyone can read. Legal basis: performance of the contract you enter into when you join the board (Art. 6(1)(b)).

Secure access key. We set a strictly necessary stayn1_owner HttpOnly cookie containing a random key for up to 365 days. Only its SHA-256 hash is stored on our server. It links this browser to all its listings and cannot be read by site scripts. Legal basis: performance of the contract.

Outbound clicks. We count how many times each link is opened. We store a counter only — not who clicked, when, from where, or from which device. Legal basis: our legitimate interest in showing listings a fair measure of the exposure they receive (Art. 6(1)(f)).

Optional DataFast analytics. Only after you consent, DataFast receives the page URL, referrer, viewport, language, timezone, screen size, advertising click identifiers when present, IP address as part of the network request, and visitor/session identifiers stored in analytics cookies. We use it to understand aggregate visits and acquisition. The visitor identifier is also sent to Dodo Payments in the checkout metadata; after a successful payment, Dodo Payments sends the payment data to DataFast so it can attribute the revenue to its source. Legal basis: your consent (Art. 6(1)(a) GDPR and applicable ePrivacy rules). You can refuse or withdraw consent at any time from Cookie settings.

Server logs. Our web server records the usual request data, including IP address, for security and troubleshooting. These logs rotate and are not used to profile anyone. Legal basis: legitimate interest in keeping the service secure (Art. 6(1)(f)).

Payment data. We never see, receive or store your card details. Payment is handled entirely by Dodo Payments — the trading name of Dodo Payments Inc, Dodope Payments Limited and Sarvapanchhi Technologies Private Limited, which acts as Merchant of Record and as an independent data controller for the payment. We receive from Dodo Payments only the amount paid and an order identifier. The Dodo Payments group companies are established outside the European Union (United States, United Kingdom and India), so paying involves a transfer of your payment data outside the EU under their own safeguards, including standard contractual clauses — see the Dodo Payments Privacy Policy. Nothing you enter on this site is sent to them by us beyond what the payment requires. Dodo Payments also emails you about the payment — confirmation, invoice, any refund — at the address you give at checkout, as an independent controller. Those emails are automatic and are not sent or read by us.

Checkout email and recovery. Dodo Payments sends us the customer email after payment. We retain only its keyed HMAC-SHA-256 digest to associate purchases and recover access. The plain address is used only to send a transactional recovery link through Resend; the one-time token expires after one hour. Legal basis: performance of the contract.

What we do not do

We do not run advertising trackers, build advertising audiences, or sell personal data. DataFast analytics is disabled until you consent. There is no account, password, or newsletter.

Who else can see the data

• Everyone, for the parts you publish: that is what a public board means.
• Dodo Payments, for payments and invoicing.
• DataFast, only if you accept analytics — see its Privacy Policy.
• Resend, which sends transactional access-recovery emails — see its Privacy Policy.
• Our hosting provider, which stores the site and its database on a server in the European Union.

How long we keep it

Your listing stays published for as long as the board exists, because a paid position is permanent by design. You can ask us to remove it at any time — see below. Payment records are kept as long as tax and accounting law requires. Server logs are kept for a short rotation period.

Your rights

You can ask for access, correction, erasure, restriction, portability, and you can object to processing based on legitimate interest. Write to dev@2devstudio.com and we will reply within 30 days. To remove a listing, include the listing link so we can identify it.

Removing your listing does not refund the amount paid — see the Terms. Deleting the row deletes the personal data in it; the payment record kept for accounting does not contain what you published.

If you think we are handling your data wrongly, you can complain to your national data protection authority. In Italy this is the Garante per la protezione dei dati personali.

Children

The Service is for people aged 18 and over. We do not knowingly publish data about minors. If you believe a listing concerns a minor, tell us and we will remove it.

Cookies

See the Cookie Policy. Analytics cookies are set only after consent; refusing them does not affect the Service.