MyBooking.ai Privacy Policy
Version 3.0 — last updated: 6 July 2026
1. Who is the controller of your data
The controller of personal data of MyBooking.ai Users is Abba Villa Host Central Warsaw sp. z o.o., a limited liability company with its registered office in Warsaw, Poland (ul. Wilcza 15/19, 00-538 Warszawa, Polska), entered in the Register of Entrepreneurs of the Polish National Court Register under KRS no. 0001002172, tax ID (NIP) 7011115006, REGON 523690729 (the "Operator"). MyBooking.ai Inc. (Delaware, USA) — the platform's technology provider — processes data solely on the Operator's behalf and instructions, as a processor. Where a business customer uses the Service to manage its own clients, guests or candidates, that customer is the controller of such data and the Operator processes it under a data-processing agreement.
2. Contact for data matters
3. Data we process
- Account and identification data — name, e-mail, phone, company details, language, settings.
- Booking and transaction data — bookings, orders, invoices, amounts, dates, operation history.
- Payment data — handled by licensed payment providers (e.g. Stripe); we do not store full card numbers.
- Content — documents, images, listings, reviews and other materials.
- Communications — correspondence, support requests, complaints.
- Technical data — IP address, approximate location derived from IP, device and browser identifiers, logs, cookies (see the Cookie Policy).
4. Purposes and legal bases
- Conclusion and performance of the contract — Account, bookings, payments, support (Art. 6(1)(b) GDPR).
- Legal obligations — accounting, tax, complaint handling (Art. 6(1)(c) GDPR).
- Security and abuse prevention (Art. 6(1)(f) GDPR — legitimate interest).
- Establishing, pursuing and defending claims (Art. 6(1)(f) GDPR).
- Service development and analytics, including aggregated performance measurement (Art. 6(1)(f) GDPR).
- Communication and own marketing (Art. 6(1)(f) GDPR); commercial e-mail — based on consent (Art. 6(1)(a) GDPR), withdrawable at any time.
5. AI-assisted features
Some features use AI models operated by trusted infrastructure providers to process content you submit (summaries, classifications, pricing proposals). Processing serves solely to deliver the requested functionality, under agreements restricting the providers' use of the data.
6. Recipients of data
- Processors — hosting and cloud storage, payments, e-mail delivery, AI infrastructure, analytics — under data-processing agreements; including MyBooking.ai Inc. as technology provider.
- Providers you contract with — data necessary to fulfil the booking.
- Competent authorities — where required by law.
- Professional advisers and parties to corporate transactions — under confidentiality.
We do not sell personal data.
7. Transfers outside the EEA
Data may be processed in the EEA, the USA and other countries where our providers operate. Transfers outside the EEA rely on adequacy decisions or Standard Contractual Clauses, with supplementary safeguards where feasible. A copy of the safeguards is available on request.
8. Retention
For the duration of the agreement (Account); then until the expiry of limitation periods for claims (as a rule up to 6 years); accounting records — 5 years from the end of the tax year; consent-based data — until withdrawal. Thereafter data is deleted or anonymised.
9. Your rights
Access and copy, rectification, erasure, restriction, portability, objection to processing based on legitimate interest (always effective as regards marketing), and withdrawal of consent at any time. Requests are handled no later than within one month; in complex cases the period may be extended by two months, of which we will inform you.
10. Complaint to a supervisory authority
You may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw) or with the supervisory authority of your place of residence; users in Madagascar may also contact the Commission Malagasy de l'Informatique et des Libertés (CMIL).
11. Voluntariness
Providing data is voluntary but necessary to create an Account, make a booking or use certain features.
12. Automated decisions and profiling
We do not take decisions based solely on automated processing that produce legal or similarly significant effects; automated mechanisms are subject to human oversight for material determinations.
13. Security
Encryption in transit, access control and logging, environment separation, backups and security reviews. No method offers full guarantees, but we continuously improve protection.
14. Children
The Service is not directed to persons under 16; reported children's data will be deleted.
15. Changes to this Policy
The date above indicates the latest version; material changes will be notified in advance.