Your data and your account

YStay processes your data to run the platform — your account, your reservations, your exchanges with support — and documents that processing in two public pages, reachable without signing in.

Where to read our policies

• Privacy policy — what YStay processes, for what purpose, for how long, and who to contact to exercise your rights.
• Legal notice — the publisher's identity, hosting, and the site's legal information.

Our terms and your acceptance

Four documents govern the use of YStay. They are public, readable without an account, and each carries a version number and an effective date.

• Terms and Conditions — your contract with YStay, as a host.
• Data Processing Agreement — annex 1 to the terms: what YStay processes on your behalf, as a processor.
• Terms of Sale — the ones a guest accepts when booking.
• Individual Terms of Use — the ones accepted by every person you invite onto your account.

When you sign up, a single checkbox has you accept the Terms and Conditions and the Data Processing Agreement: both links sit inside the sentence, and the Create my account button stays inactive until the box is ticked.

When a new version is published, you receive an email 30 days before its effective date, with a link to the text. During that period a reminder appears in the dashboard — "New contractual documents will apply from …" — with Read and accept them, and Hide this reminder if you would rather come back to it later.

From the effective date, the Documents to accept page opens on sign-in and replaces the dashboard until you answer. Each document carries its "Version … — effective date: …" line, a Read the document link and an "I have read and accept: …" checkbox. The Accept button confirms them all.

Re-reading what you accepted: the My account page carries an Accepted documents card, which lists your acceptances with their "Version … — accepted on …" line and a Download this version link. What downloads is the version you accepted, not the one in force today.

What YStay keeps, and for how long

Nothing is kept forever: each category of data has a maximum retention period; the corresponding deletion and anonymisation mechanisms are being rolled out with our deployments.

• Your account (identity, contact details, company information) — kept for 3 years after the relationship ends: cancellation if you cancel, or 24 months without any activity if you don't.
• Your invoices — kept for 10 years, separately from the rest of your account: this is an accounting obligation, which survives the deletion of your account.
• The proof that you accepted our terms — the version accepted, the date, your name, your email address, plus the IP address and the browser used at the moment of acceptance. It is kept for 5 years after the contract ends, 10 years if you contracted as a consumer, and it survives the deletion of your account. The IP address and the browser appear on no screen, neither yours nor your team's: they serve only to establish that the acceptance did take place.
• Your reservations — made anonymous 3 years after the stay ends: the guest's name, email and phone number disappear, occupancy and revenue figures remain.
• StayProof evidence (check-in and check-out inspections) — kept for 24 months after the stay by default; the account owner can extend this up to 60 months from Account › StayProof evidence retention. 30 days before deletion, you receive an email and an in-app notification, and the stay's Download the full case (ZIP) button hands you the photos, answers, PDF and fingerprint.
• Audit logs (who did what, and when, on sensitive platform actions) — kept for 36 months.
• Your support requests — kept for 24 months after they are resolved.
• Requests submitted without signing in (public form) — kept for 30 days after the last message.
• After your subscription ends, your guests' data (anonymised reservations, inspections, exchanges, applications) is deleted 90 days after the contract ends; your account itself, 3 years after.

Full detail, processing activity by processing activity, is in the privacy policy.

Requesting the deletion of your account

1. From your host account (web)

   Account page › Delete my account card › Request deletion button. A Request the deletion of your account window opens, with an optional field to add details. The Send the request button submits it: the message "Request sent. Reference: …" confirms the submission, with your request's reference.

2. From your guest space (web)

   The same section exists in your guest space, under the title Delete my guest account, with the same Request deletion button.

3. From the Host Ops app

   This screen's interface is in French: Compte tab › "Supprimer mon compte" (Delete my account) button › confirm with "Envoyer la demande" (Send the request).

4. From the guest app (mobile)

   Profile tab › Delete my account button › confirm with Send the request.

5. Without signing in

   The account deletion page offers an email form, reachable without signing in — to request the deletion of an account you no longer have access to.

What happens next

A deletion request does not erase anything instantly: it is reviewed, then executed, by the YStay team, starting from your request — never an automatic mechanism. If you click the same button twice, the message "A deletion request is already in progress for this account." saves you from opening a second request for nothing.

For a request submitted without signing in, execution waits for one more step: we only execute it after a message sent from the link received by email, confirming that the request does come from the account owner.

As with the rest of support, YStay does not promise any stated deadline. The only deadline that applies is the legal framework: Article 12 of the GDPR requires a reply within one month.

What is erased: your identity, your contact details, the secrets and devices tied to your account (sessions, connected devices, access credentials), and your profile.

What remains after a deletion: your invoices, kept for ten years; your past reservations, made anonymous three years after the stay rather than deleted; the proof that you accepted our terms — see the previous section, it carries your name and your email address as they stood at the moment of acceptance, is kept for five years after the contract ends, ten years if you contracted as a consumer, is displayed nowhere, and serves only to establish that you accepted that very version of our terms; your reviews, where the displayed name becomes "Guest" while the text, rating and reply stay visible; and your civil identity, kept for 5 years apart, in a separate space no one ever displays, under French law n° 2004-575 of 21 June 2004 on confidence in the digital economy.

Next up

• Contact support — the assistance channel, for any other request.
• Set up your account and integrations — the rest of the My account page.
• Team & account — the other guides in this section.