Privacy policy

Here we explain what data we process when you visit guestdefender.com or use Guest Defender: what for, for how long and who else processes it. Last updated: 13 November 2026.

Controller

Luca Puppi (BB1 Studio), NIE Y3875000C, Camino las Higueras, 7, Buzanada, Arona, Tenerife. For any privacy matter: hola@bb1studio.com.

What data we process and why

What for	What data	Legal basis	How long
Checking with Guest Defender a request for money after a stay and keeping it on your private link	Documents, photos and story you upload (only while they are read); of the check: the two countries chosen, the platform, the name and contact of the property, the booking number, the dates, what they ask for and the amounts, the evidence there is and the payment method, without your name, address, email or card number, with your answers to the questions; of the link: only an irreversible fingerprint	The service you ask for (art. 6(1)(b) GDPR)	Files and story: deleted as soon as they are read. Case: 30 days from the check or from when the texts are opened, or until you delete it
Opening the Guest Defender texts you pay for	The payment identifier on Stripe and the case it refers to; never your card details	The contract (art. 6(1)(b) GDPR)	As the case
Keeping the server secure and stable	Technical log of each submission, with your IP and what you sent	Legitimate interest (Art. 6(1)(f) GDPR)	About 15 minutes
Fixing technical faults	Error log, which may include your IP and what you sent	Legitimate interest (Art. 6(1)(f) GDPR)	14 days
Counting visits to the website and the apps	Technical log of each request to the server: your shortened IP address (without its last part), the page, the time, your browser and device, your browser language and the page you came from; no cookies. For the statistics we derive the country from the shortened IP and use a fingerprint that changes every day, without the IP	Legitimate interest in knowing how the website and the apps are used (Art. 6(1)(f) GDPR)	The log 30 days; the statistics, which cannot identify you, for as long as they are useful
Replying to what you write to us, by email or through our contact forms	What you tell us and your contact details; in our contact forms, your name, your email address and, if you give them, your phone number and your business	Your request (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f) GDPR)	As long as needed to help you

If you use Guest Defender

To use Guest Defender we don't ask for your name or email. The documents, photos and story you upload are sent to Anthropic to read them; before that, the app makes the photos smaller and removes location and camera data. Our server keeps neither the files nor the story: it deletes them as soon as the reading is done. We never ask for bank codes, passwords or PINs.

Of the check we keep only what the rules and the letters need: the country of the place and the country where you live, the platform, the name and contact of the property or host, the booking number, the dates of the stay, of the request and of the charges, what they ask for and the amounts, the evidence there is (photos, receipts), the deposit, the payment method and the card network and, if you give them, your answers to the questions. We ask the AI not to copy your name, address, email, phone or card number. The check, with your answers, stays on the private link for 30 days from the check or from the opening of the letters, and you can delete it earlier from the app. Of the link we keep only an irreversible fingerprint (hash). Your phone keeps the links to your checks until you delete them.

The details for the letters (name, address, email, the last 4 digits of your card) are typed on your phone: the app fills in the letter there and makes the PDF. These details never reach our server and the app doesn't keep them. Our server receives only the list of the fields filled in and doesn't keep it.

If you pay, the payment is handled by Link (Sold through Link, LLC, a Stripe company), which is the seller and processes the payment data under its privacy policy. In the app we keep only the payment identifier and the case it refers to; in our Stripe account we also see some payment data, such as the email and the country, and use it only for refunds and to answer your questions. If you use a code, we keep its fingerprint and how many cases it can still open.

Who else processes your data

Only the providers we need to operate, under a data processing agreement:

• WIIT AG (webtropia), in Germany: the server that runs this site and the app.
• Google: the email service we use to write to you.
• Anthropic: the AI that reads the claim for money after a stay and its evidence, which you upload to Guest Defender.
• Link (Sold through Link, LLC, a Stripe company), in the United States: it sells and charges for the Guest Defender letters as reseller ("Merchant of Record") and sends you the receipt and the invoice; the payment goes through Stripe.
• Our accountants and the tax authorities: only for invoicing and when the law requires it.

We don't sell your data or pass it to anyone for their own purposes.

Data outside the European Union

Anthropic is in the United States, and Google may send data there. They do so with the safeguards the GDPR requires: the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses, depending on the provider. Under its commercial terms, Anthropic does not use this data to train its models. Link (Sold through Link, LLC), which sells the Guest Defender letters, is in the United States and processes the payment data under its privacy policy.

Automated decisions

We don't make automated decisions that have legal effects on you. In Guest Defender, the AI reads the documents and a program with fixed rules tells you what you can dispute and what is fair to pay: you decide whether to send the letters, with a lawyer or a consumers' association if you need one.

Your rights

You can ask to access your data, correct it, erase it, object to its use, restrict it or take it with you (portability). You can also withdraw your consent at any time, without affecting what happened before. Write to us at hola@bb1studio.com or from our contact page saying which right you want to exercise: we'll reply within one month at most.

If you're not satisfied, you can complain to the Agencia Española de Protección de Datos, the Spanish data protection authority (aepd.es).

Security

The server is in the European Union, connections are encrypted (HTTPS) and access is restricted. We make daily backups, which are deleted after 14 days.