Quick answer
What data does StaySats process?
StaySats processes the minimum needed to book a hotel paid in crypto. That is an account number created at your first top-up, your top-ups and bookings, and the lead guest's name. An email address is required for each booking. We ask for no ID upload, no selfie and no card, and we do not sell personal data.
What we process, and why
| Data | Why we need it | Who receives it |
|---|---|---|
| Account number | Your login: it opens your balance and bookings | Nobody outside StaySats, except service providers acting for us |
| Email address (required for each booking) | The voucher, changes and cancellation of your bookings; never published or sold | Service providers acting for us (email delivery); the hotel, if it needs it to reach the guest |
| Top-up records: coin, network, amount, transaction ID | To credit your balance and answer payment questions | Nobody outside StaySats, except service providers acting for us; the transfer itself is public on the blockchain |
| Booking details: hotel, dates, rooms, number of guests, special requests | To make and manage the booking | The hotel and our booking partners |
| Lead guest's name | The hotel registers the stay in this name | The hotel and our booking partners; checked against sanctions lists |
| Hotel confirmation number and our booking reference | To prove and find the booking | You and the hotel |
| Withdrawal address (only if you ask for a withdrawal) | To send USDT or USDC that you are owed | May be screened against sanctions lists |
What does StaySats never ask for?
We never ask you to upload an ID document, a passport scan or a selfie, at checkout or later. We accept no card, so we hold no card number. We never ask for your account number, a passport scan or a selfie by email or chat. If someone asks in our name, it is not us.
The hotel checks your ID at check-in, as local law requires. That check happens at the hotel, not with us.
Who receives the data of a booking?
The hotel and our booking partners receive what they need to make and register the booking. That is the lead guest's name, the dates, the rooms, the number of guests and your special requests. Where local law requires a guest register, the hotel may pass guest data to the authorities.
We do not sell personal data and do not share it for advertising. We may disclose data when the law obliges us to, for example to comply with sanctions rules.
Do you screen names and addresses?
Yes. US sanctions law forbids us to deal with listed persons, and we also check the EU and UK lists. The lead guest's name is checked against the public sanctions lists of the United States, the European Union and the United Kingdom before booking. A withdrawal address may be checked against sanctions lists before we send funds. These checks need no document from you.
What do crypto payments reveal?
A blockchain is public. Anyone can see a transfer, its amount and the addresses involved, and can sometimes link an address to an exchange account. So the checkout is private on our side, but the payment itself is not hidden.
We link each top-up to your account by its exact amount and its transaction. We keep that record so that your balance can be checked.
What do you do with my IP address and my searches?
We keep no access logs: our web server does not record visits. Only critical errors are logged, without page content.
We store no IP address. Your IP address is used only in memory, to limit the number of requests, and is then forgotten.
We keep no individual search. Your searches are used to show you live prices. The server keeps only aggregated counters with no personal data, such as the number of searches per city and the cache rate. These counters hold no IP address, no account number and no dates of stay.
How long do you keep data?
Travel data is deleted 30 days after the end of the stay. The booking history, without any identity document, is kept for 2 years. We never receive a passport or an ID copy for a hotel booking. We keep no copy of an ID document, because we never receive one.
You can ask us to delete your account and the data that we are not required to keep.
On what legal basis, and who processes data for us?
We process booking data to perform our contract with you: to credit your top-ups, make your bookings and pay what we owe you. We screen names and withdrawal addresses to comply with sanctions law. We use IP addresses to limit requests and prevent abuse, which is our legitimate interest.
Service providers process some data for us, on our instructions. Examples are hosting and email delivery.
TravelGoat LLC is a United States company, and hotels are in many countries. So your data may be processed outside your country, including in the United States. If you live in the European Economic Area or the United Kingdom, you may also complain to your data protection authority.
What can I ask for?
You can ask what data we hold about you and ask us to correct it. You can also ask us to delete what the law allows us to delete. Write to [email protected] from the contact you gave us, with your booking reference. Never send your account number.
Depending on where you live, the law may give you more rights. This policy does not reduce them.
Who is responsible, and can this policy change?
TravelGoat LLC (United States), which operates StaySats, is responsible for this policy. We may update it; the date at the top changes, and the change is listed in the changelog.