Privacy Policy

The controller of your data is SecondBook SLU (tax ID B27662352), registered at Avda. Junta de Compensación 17, 41300 San José de la Rinconada, Sevilla, España.

For any privacy question, or to exercise your rights, write to us at soporte@secondbookapp.com.

This policy explains what data we process when you use secondbookapp.com, what for, who we share it with and how long we keep it.

When you create an account we process:

• Your name, email address and phone number (with its country). Only our team sees your phone number, never other users; we use it to contact you about your sales and purchases
• Your language, currency, time zone, notification preferences and display preferences (seasonal decorations and your calendar's country)
• Your password, which we store transformed with a one-way algorithm (opens in a new tab): nobody, not even our team, can read it
• If you use passkeys (opens in a new tab), only their public key and the name you give them; your biometric data never leaves your device
• If you turn on two-step verification (opens in a new tab), your authenticator app secret (encrypted), your backup codes (stored irreversibly) and the codes we email you, which expire after 5 minutes
• If you sign in with Google or Apple, your account identifier with that service, your email address, your name and, for Google, your profile photo

Each time you sign in we record the session: IP address (opens in a new tab), browser and device, the approximate location derived from the IP (city and country) and the sign-in method. We also record sign-in attempts. We use this to show you your open sessions, alert you about sign-ins and protect your account.

When you sign in, we also store in your browser a cookie (opens in a new tab) with a random identifier for that browser (sb_device), which is not derived from any data on your device. We record it with each session in order to identify which browser the session was opened from, to replace the previous session if you sign in again in the same browser, and to alert you when someone signs in to your account from a new device. It is a strictly necessary security cookie: it lasts 400 days (about 13 months), is not deleted when you sign out and is not used for measurement or recommendations.

Profile photo: you can upload your own. When you upload a profile photo, we remove its metadata (such as the location or the device it was taken with). If you do not have one, we use your Google photo when you sign in with Google, or our servers look up your email address with an avatar service that finds public profile photos linked to an email address (never if you already have a photo, and at most once every 30 days). If it finds one, we store a copy on our servers and show it as your photo. You can remove or change it at any time from your account; if you remove it, we will not look it up again. You may object to the automatic profile-photo lookup at any time by turning off "Find my profile photo automatically" on Your data; we will then not look for one again, and any photo you already have is kept unless you remove it.

To list a booking we process:

• The booking details: accommodation, dates, room type, board, number of guests and rooms, the platform you booked on, original price and sale price
• The name of the booking holder and the confirmation code
• The proof documents you upload (PDFs, images or Word documents) and a thumbnail we generate of each
• If you sell without an account, your email address and phone number
• To pay you, your bank account details: account holder, IBAN (opens in a new tab), SWIFT (opens in a new tab), tax document (DNI, NIE, NIF or passport) and tax address

The public listing only shows the accommodation details, dates, room, prices, the platform it was booked on and an internal seller identifier. The holder's name, the confirmation code, your contact details and your proof documents are never published: only you and our team see them, and our team uses them to verify the booking and handle the change of name.

Proof documents are kept in private storage. Those you upload without publishing the listing are deleted after 24 hours.

Your bank details are stored encrypted (AES-256 (opens in a new tab)). You see your IBAN masked and can only see the full details after confirming your identity again. Our payments team accesses them to make your transfer, also after confirming their identity, and every access is logged.

Business sellers: if you publish as a business or professional, we process your name or company name, address, phone, email, identification document or number, the register you are entered in and the date of your self-certification, to comply with the legal obligation of trader traceability (art. 30 of Regulation (EU) 2022/2065; legal basis: art. 6(1)(c) GDPR). They are stored encrypted. We show buyers your name, address, phone, email and registration, never your identification number, and may disclose them to authorities that request them under the law. We keep them while you have listings with us and for six months after each listing ends; they are then deleted automatically. If a business sold a buyer an illegal product or service, we will use the buyer's email to inform them (art. 32 of the same Regulation; legal obligation). If you have sold as a business before, we use the details from your latest listing to pre-fill the form for your next one; you can change them.

When you buy, we process your name and email address, the details of the booking you buy (amounts, status and dates) and, for the change of name, the new guest's name, email address and phone number.

Payments are processed by Stripe. You enter your card details directly in Stripe's form and they do not pass through our servers: we never see or store the full card number. We store the payment identifiers, amount, status and the information Stripe sends us about the payment, which may include the card brand and its last four digits. We send Stripe the booking number, the accommodation and your email address.

If you are owed a refund, it is also made through Stripe.

We store the messages you exchange with other users on SecondBook. The other person only sees your name; our team can read conversations to moderate them and resolve issues.

To protect buyers and sellers, we check every message before delivering it:

• First, with automatic rules that detect contact details (email addresses, phone numbers, links, IBANs), offers to pay outside the platform, scams, insults and spam
• If the rules are not enough to decide, we send the message, together with your most recent previous messages, to OpenAI, which classifies it

If a message breaks the rules, it is not sent or stored, and we record a warning (strike) with an excerpt of the message. Warnings expire after 90 days. Section 15 explains what happens if they accumulate.

Listing reports: if you use "Report this listing", we process your name, your email and the content of your report to handle it and inform you of our decision, to comply with a legal obligation (Art. 16 Digital Services Act; Art. 6(1)(c) GDPR); we do not disclose your identity to the seller. We keep your name and email for three years from the decision on the report and then delete them; the report itself is kept as a moderation record.

We keep a record of each moderation decision (what was decided, on what ground, whether automated means were involved) and of complaints, to comply with the Digital Services Act (Art. 6(1)(c) GDPR) and to defend against claims; if you delete your account, the record stays linked to the anonymised account and the email addresses of people without an account are erased. If we suspect a criminal offence threatening someone's life or safety, we may share the necessary data with the competent authorities (Art. 6(1)(c) GDPR).

• Service emails: we write to you about your account, your listings, your purchases and sales, and your account's security. Security, account, booking and payment emails are always sent. The notices that can be switched off, such as news about your listings and selling tips, can be turned off in your account settings or with the unsubscribe link in each of those emails
• Newsletter and deals: only if you subscribe, in the site footer or in your account settings. Every email includes a one-click unsubscribe link. If you unsubscribe, we keep your email address marked as unsubscribed so we respect your choice
• Reminders of what you have viewed: only if you turn them on (section 9). Each one includes an unsubscribe link that switches off only the reminders, not the newsletter
• Destination alerts: if you create one, we store, with your consent, your email address, the destination and the dates you are interested in
• Contact form: we store your name, email address, message, subject and the page you wrote from, and notify our team by email and through our internal alert channel

We keep a log of the emails we send (recipient, subject, template, date and status), without the content of automatic emails; for contact messages and support emails we also keep the text. We send emails through Cloudflare.

• Approximate location: we derive your city and country from your IP address using an IP geolocation provider. We use it in your sessions, in security alerts and to protect the platform against abuse
• Security alerts: our security emails (for example, sign-in alerts) include your partly hidden IP address, the approximate city and country, the browser, the time and a map of the area. We generate the map ourselves from a map provider’s satellite imagery: we only ask it for the images of an area of about 1 km, with no data about you. We look up the town name with a place-name service, sending only the city and country
• Usage limits: we count requests per IP address or per account for a few minutes or hours to stop abuse and attacks
• Sign-in protection: on sign-in and sign-up we use Cloudflare Turnstile to tell people from bots, and we temporarily block sign-in after several failed attempts
• Blocking abuse: our team can block visitors who abuse the platform, using identifiers such as their IP address or browser
• Payouts to sellers: our team reviews every transfer before sending it

How we protect your data:

• Encryption: every connection is encrypted (HTTPS/TLS (opens in a new tab)). Bank details, two-step verification secrets and what you write in your privacy requests are stored encrypted with AES-256
• Backups: encrypted with AES-256 and stored in Backblaze's European region
• Payments: you enter your card details directly in Stripe's form; they never pass through our servers
• Internal access: only the team members who need it, with mandatory two-step verification and a record of their actions

No system is completely secure, but we review these measures continuously.

If we suffer a security breach affecting your personal data, we will notify the Spanish Data Protection Agency (AEPD) (opens in a new tab) within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to you.

If the breach is likely to pose a high risk to your rights, we will also tell you without undue delay, by email. We will explain what happened, which data was affected, what we have done about it and what you can do to protect yourself.

We keep an internal record of every breach, including those that do not need to be notified.

Technical cookies keep the platform working (signing in, language, security) and are always on. Display preferences (seasonal decorations and the country whose calendar they follow) are your own choice, unrelated to the optional uses below: they're stored in your account or, if you're not signed in, linked to this browser.

We also use your data for four optional purposes. Each one has its own switch on the Your data page, where you can turn it on or off at any time; the change applies immediately. If you are not signed in, your choice applies to that browser. While your account is paused (restriction of processing), we carry out none of them.

• Personalised recommendations: we suggest hotels and destinations based on what you look at on the site (destinations, hotels and listings). Legal basis: legitimate interest. They are on by default and you can object by switching them off
• Anonymous visit measurement: we count visits and what is viewed most, without knowing who you are (what we measure is explained below). Legal basis: the audience-measurement exemption recognised by the AEPD (opens in a new tab) and the CNIL (opens in a new tab). It is on by default; if you switch it off, we measure nothing of what you do, not even anonymously (we only keep the record of your own privacy choices)
• Full measurement of your use: statistics on how you use the site, linked to your account or your browser, to improve it. Legal basis: your consent. It is off by default and only works if anonymous measurement is also on
• Reminders of what you have viewed: an email if you leave a search, a hotel you were looking at or a payment unfinished. Legal basis: your consent. They are off by default and need an account you are signed in to (and personalised recommendations on, as they are built from them). You can switch them off in your account settings, on the Your data page or with the unsubscribe link in each of these emails, which switches off only the reminders, not the newsletter

How anonymous measurement works: we use a first-party cookie (sb_vid, valid 390 days and never extended) and record pages visited, active time, scrolling, clicks on links and buttons (never form contents) and which destinations, accommodations and listings were viewed, with your country, language and type of device. They are counts only: they are not linked to your account or to any person, and we do not store your IP address, your precise location or your browser's full identifier (user agent (opens in a new tab)). They are never used for advertising, profiling or recommendations, and are not shared with third parties. This follows the exemption for strictly necessary first-party audience measurement under article 22.2 of the LSSI (opens in a new tab) as interpreted by the AEPD (2023 cookie guide (opens in a new tab)), equivalent to the one applied by the CNIL. The onedollarstats visit statistics (section 11) follow this switch too. We also collect anonymous page-speed measurements (Web Vitals) with no identifier. With this measurement we also count how many people see each listing and each accommodation and how many click on its bookings, per day and without knowing who they are; sellers only see these totals for their own listings.

The sb_vid cookie is set in every browser from the first visit, even if you switch measurement off, because it is not used only for measurement. We also use it to protect the service against visitors who abuse it (security, on the basis of legitimate interest; section 7), as the key to what has been viewed in that browser for personalised recommendations and, only with your consent, for full measurement. If you switch anonymous measurement off, we stop recording what you do on the site, whether anonymously or for full measurement, so from that point on your browsing no longer feeds the recommendations either. What does not change: the cookie is still set, and we still use it to protect the service against abuse and to remember the privacy choices made in that browser.

Device fingerprint: only if you have switched full measurement on (with your consent), your browser computes a technical fingerprint of the device (opens in a new tab) using the FingerprintJS library, that is, a summary code generated from technical characteristics of the browser and the device (such as the screen, the installed fonts or the way the browser draws graphics and processes audio). It does not contain your name or contact details. Your browser sends it to us once per session and we associate it with your sb_vid identifier, so that we can recognise the same browser even if its cookies are deleted or change, for example when protecting the service against abuse. Without your consent it is neither computed nor sent, and if you withdraw your consent it is no longer computed.

From all this we produce anonymous, aggregate statistics (for example, how many people visit a destination or which pages load slowest). They cannot identify anyone and are not personal data, so they have no switch.

Further details about cookies are available in our Cookie Policy.

• Performance of the contract: creating and managing your account; publishing and verifying listings; processing purchases, payments, refunds and payouts to sellers; handling the change of name; sending you service emails and helping you when you write to us
• Legitimate interest: keeping the platform and your account secure (sessions, security alerts, usage limits, message moderation and fraud prevention), recommending hotels and destinations based on what you look at and measuring our audience anonymously (section 9), looking up your profile photo and alerting our team to activity that needs their attention
• Consent: newsletter and deals, destination alerts, full measurement of your use and email reminders of what you have viewed (section 9). You can withdraw it at any time
• Legal obligation: keeping the information the law requires and responding to requests from the authorities

We do not sell your personal data. We share it only with the providers that help us run the service, and only what each one needs:

• Hetzner: our servers, in Germany, where the application and database run
• Cloudflare: file storage (photos, proof documents, maps), email sending, DNS (opens in a new tab) and the anti-bot check on sign-in
• Backblaze: database backups, in its European region, and an archive of analytics data
• Stripe: payment and refund processing
• Google and Apple: sign-in, if you choose to use them
• OpenAI: automatic classification of chat messages (section 5)
• Avatar service: looking up your profile photo from your email address (section 2)
• IP geolocation provider: approximate location from your IP address
• Proxy (opens in a new tab) providers: network providers through which some of our requests to external services are routed
• Our internal communication tool: internal alerts for our team, which may include your name and email address (for example, when we receive your contact message or a sale closes) and, in error reports, your IP address and browser. Our team can also look up your account details from there
• onedollarstats: cookieless visit statistics (pages viewed and where the visit came from)
• Map provider: the maps on the site; your browser downloads the maps from that provider's servers, which receive your IP address as with any website visit

To show you prices from other websites we query partners of ours that sell hotel stays with only the destination, dates and guests of your search, never with your data. If you click one of their offers, you go to that partner's website and its own privacy policy applies.

The satellite-imagery provider and the place-name service used for security alerts receive no personal data (section 7). We may also disclose data to the authorities when the law requires it.

Each provider processes your data only to provide its service to us, under data protection obligations equivalent to ours.

Some of these providers, such as Cloudflare, Stripe, Google, Apple, OpenAI and the provider of our internal communication tool, are companies based outside the European Economic Area (opens in a new tab), mainly in the United States, so your data may be processed there.

If you would like more information about the safeguards that apply to each transfer, write to us at soporte@secondbookapp.com.

These transfers rely on the standard contractual clauses (opens in a new tab) approved by the European Commission or, where the company has signed up to it, the EU-U.S. Data Privacy Framework (opens in a new tab).

• Email log: 24 months for contact messages and support emails; 12 months for service and marketing emails
• Proof documents uploaded without publishing the listing: 24 hours
• Area maps in security alerts: deleted after 30 days without use
• Anonymous audience measurement: about 90 days, and never more than 25 months; anonymous speed measurements, 90 days
• Moderation warnings (strikes): expire after 90 days
• Database backups: about five weeks
• Usage-limit counters: from a few minutes to 24 hours

Database backups are kept for no more than 35 days and are not modified; if we ever had to restore one, we would re-apply every erasure that has been requested before putting the service back into operation.

Each time you accept the Terms (when you sign up, when you publish a booking and on every purchase, with or without an account), we record the version accepted, the date, your IP address and your browser. We keep this record, pseudonymised, even after your account is deleted, so that we can defend ourselves against possible claims.

The rest of the data (account, sessions, listings and their proof documents, purchased bookings, payments, messages and subscriptions) is not deleted automatically today. If you would like us to erase it, write to us at soporte@secondbookapp.com.

You can exercise at any time your rights of:

• Access to your data
• Rectification
• Erasure
• Restriction of processing
• Objection
• Portability
• Withdrawal of your consent, without affecting processing carried out before

The quickest way is the Your data page: there you can see your data and take a copy, correct it, restrict or object to a use of it, and ask us to erase it. The copy also includes the business details you gave on each listing, the statements of reasons for moderation decisions that affected you, and your complaints with our answers. We confirm each request with a code or a link sent to your email. If you ask for erasure, it happens after 30 days and you can cancel it until then; before that we prepare a copy of your data for you.

You can also write to us at soporte@secondbookapp.com. We will answer within one month at most.

You can unsubscribe from the newsletter, from reminders of what you have viewed and from the notices that can be switched off with the link in every email. You turn the optional uses of your data (section 9) on or off on the Your data page.

If you think we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es (opens in a new tab)).

Chat moderation is automatic (section 5). If you collect 5 warnings in the chat, your account is suspended automatically and your sessions are closed: the first time for 24 hours; if it happens again, permanently.

You can appeal the suspension. Our team reviews appeals and can remove the warnings.

Chat messages are checked automatically, with rules and an artificial intelligence model, to block contact details, payments outside SecondBook, abuse and spam; repeated blocks automatically suspend the account. You may ask for a person to review the suspension through the link in the email we send you or from the sign-in screen, express your point of view and contest the decision.

We reserve the right to modify this Privacy Policy.

Changes will be published on the platform.