Status of the platform
freestays is a platform on which travel creators exchange content for a hotel stay. In addition, an expense allowance is agreed, which is paid outside the platform. The platform is pre-launch. There is no production system with real data yet. This page therefore describes what exists in the program code and what is planned. It does not describe live operation.
The operator is SnapNext GmbH & Co. KG. The address and further details are on the page "Provider and contact".
Who processes what
| Party | Role | Data |
|---|---|---|
| Operator | Controller for accounts, profiles and applications | Account and profile data, channels with reach figures, applications, agreements, consents, data requests |
| Hotel (property) | Independently responsible, from receipt of an application, for the data received with it | The creator's application, profile and channels, data on the agreement |
| Creator | Data subject | Own account, profile and application data |
| Service providers | Support operations, see the page "Subprocessors" | Depending on the service |
This allocation of roles is the currently assumed position. It will be reviewed legally.
After an application is received, a property sees the creator's full profile and all channels. The property does not receive the creator's email address.
Hosting and regions
| Service | Purpose | Region |
|---|---|---|
| Vercel | Operation of the website and scheduled calls | Function region Frankfurt (fra1); the scope of the region setting is being checked |
| Supabase | Database, file storage, sign-in | EU (Ireland); a move to Frankfurt is being considered |
Further services are planned and not yet in use. The full list is on the page "Subprocessors".
Measures at a glance
The following measures exist in the program code. They have not been verified in operation, because there is no production system. "Partial" means the measure exists only in part. There is no certification and no independent audit.
| Area | Measure | Status |
|---|---|---|
| Access control | Row-level access protection for the tables on consents, log and data requests | partial, present in code, not verified in operation |
| Authentication | Sign-in through an authentication service with its own user management and an internal identifier | present in code, not verified in operation |
| Authentication | Session cookie not readable by script, transmitted only encrypted, with same-site protection | present in code, not verified in operation |
| Authentication | Session renewal on the server; the server determines the redirect target after sign-in | present in code, not verified in operation |
| Application security | Security headers against embedding, type misinterpretation and data leakage, plus HSTS | partial, present in code, not verified in operation |
| Application security | Rate limiting of sign-in | partial, present in code, not verified in operation |
| Access control | Protection of the scheduled calls by a secret token | present in code, not verified in operation |
| Application security | Time limit for calls to the database and the authentication service | present in code, not verified in operation |
| Encryption | Transport encryption (HSTS) in production | present in code, not verified in operation |
| Data subject rights | Deletion safety: lock per request, deletion in a single transaction, log with identifiers only | partial, present in code, not verified in operation |
| Access control | Check of the file path when a media entry is created: only files in the person's own folder or in a folder of a property of their own organization | partial, present in code, not verified in operation |
This list shows a selection. It is not a complete description of the security position. Measures that do not yet exist or are not documented are not listed here as present.
What is missing or still pending
- No independent security test or certification exists, and none is stated here.
- The provider contracts and the basis for transfers to third countries will be clarified and reviewed legally before launch.
- Retention periods for agreements and logs have not yet been set in the platform.
Rights and incidents
How data subjects exercise their rights is on the page "Data subject rights". The planned procedure for security incidents is described on the page "Security incidents". Questions about data protection go to support@freestays.app.