Privacy policy

Areca is committed to protecting your privacy. We collect only what we need to provide the service, we do not sell your data, and we do not use social media pixels on our website. Analytics and advertising cookies are used on our website only as described in the Cookies section below, and in the European Economic Area, the United Kingdom, and Switzerland only with your consent.

This policy explains what data we collect, how we use it, and what rights you have over it.

The data controller for Areca is Jakub Pomykała Software, operating Areca at arecabooking.com. You can reach us at [email protected].

• We do not ask for your name, email address, or other contact details unless you choose to send them to us, for example through a contact or sign-up form.
• No information is sold or rented to third parties.
• We use Plausible, a privacy-friendly analytics tool that does not use cookies and does not identify individual visitors.
• We use Google Analytics, loaded through Google Tag Manager, to measure traffic and the results of our advertising campaigns. It collects usage data such as pages viewed, approximate location derived from your IP address, device and browser information, and cookie identifiers. Details and your choices are in the Cookies section below.
• We use the Meta pixel to measure the results of our advertising on Facebook and Instagram. It is loaded only if advertising cookies are allowed, and it reports the pages you view on our website and whether you created an account, together with device and browser information and cookie identifiers. If you type contact details into a form on our website, such as your email address, name, or phone number, the Meta pixel turns them into a hashed code in your browser and sends that code to Meta. Meta uses it to match your visit to a Facebook or Instagram account, so that we can measure and target our advertising. Details and your choices are in the Cookies section below.

• Email address: required to create an account, used for login, invoices, and essential service communications.
• Property information: name, address, room or unit count, and other details you provide when setting up your property in Areca.
• Billing information: handled by our payment processor Polar. We do not store your payment card details. See Polar's privacy policy for details.
• IP address: processed to prevent abuse and unauthorized access.
• Usage data: information about how you use the Service, such as features accessed and actions taken, used to maintain and improve the platform.

When you use Areca to manage your property, you may input personal data about your guests (names, email addresses, ID numbers, dates of birth, nationalities, booking details, and similar). This data belongs to you. Areca processes it only as your data processor, in accordance with your instructions and as necessary to deliver the Service.

You are responsible for ensuring that guest data is collected and processed in accordance with applicable data protection laws, including obtaining any necessary consents from guests and responding to their requests under those laws.

We use the information we collect to:

• Operate and maintain your Areca account and property setup.
• Process payments and issue invoices.
• Send essential service communications (account updates, security alerts, billing notices).
• Provide customer support.
• Improve and develop the Service based on how it is used.
• Prevent abuse, fraud, and unauthorized access.

We do not use your account data or your guests' data for advertising, and we do not share it with advertising networks. The only data used for advertising is the data collected on our website through Google Analytics and the Meta pixel, including hashed contact details you enter in forms there, as described above and in the Cookies section below. If you allowed advertising cookies on our website, the Meta pixel is also told that an account was created, without your email address or any other account details. The Meta pixel is not loaded inside the application, so nothing you enter there, including your guests' data, is sent to Meta.

We may send you product updates or feature announcements by email. You can unsubscribe from these at any time using the link in any such email or by contacting us at [email protected].

For users in the European Economic Area and the United Kingdom, our legal bases for processing personal data are:

• Contract performance: processing necessary to provide the Service you have subscribed to.
• Legitimate interests: processing necessary for fraud prevention, security, and service improvement, where these interests are not overridden by your rights.
• Legal obligation: processing required to comply with applicable law, such as retaining billing records.
• Consent: where you have explicitly opted in, such as for non-essential communications or for analytics and advertising cookies on our website.

Your data is stored on servers operated by our infrastructure sub-processors within the European Union. Details are listed in the sub-processors section below.

Website usage data collected through Google Analytics is processed by Google and may be transferred to countries outside the European Economic Area, including the United States. Google relies on the EU-U.S. Data Privacy Framework and standard contractual clauses for these transfers. The same applies to data collected through the Meta pixel, which is processed by Meta.

We work with the following third-party service providers who may process personal data on our behalf. All are contractually bound to process data only according to our instructions and in compliance with applicable data protection law.

We will update this list if we add or change sub-processors and will notify you of material changes.

We retain your account data for as long as your account is active or as needed to provide the Service.

If you cancel your account, you may request an export of your data within 30 days. After that period, we will delete your account data from our systems, except where retention is required by law (for example, accounting records).

Guest data you have entered into Areca is retained as part of your account data under the same conditions. You may request deletion of specific records at any time through the Service or by contacting us.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your personal data.
• Portability: request your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdrawal of consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before acting on your request.

If you are located in the EU or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

We use two kinds of cookies and similar browser storage:

• Essential: required for the Service to function, such as session authentication cookies. We also store your cookie choice in your browser's local storage and in a cookie (areca_consent) so we do not ask you again on every page and so the choice also applies at app.arecabooking.com. These do not require consent.
• Analytics and advertising: set by Google Analytics (for example _ga) and the Meta pixel (for example _fbp) on our website to measure traffic and the results of our advertising campaigns. With these allowed, the Meta pixel also sends Meta a hashed version of contact details you enter in forms on our website, such as your email address.

We use Google Consent Mode, which covers four permissions: analytics storage, advertising storage, sending user data to Google for advertising, and ad personalization. Your choice applies to all four, and to the Meta pixel: it is loaded only while they are on.

• European Economic Area, United Kingdom, and Switzerland: all four are off by default. When you first visit, a banner asks you to accept or reject them, and analytics and advertising cookies are set only if you accept. We also ask when we cannot determine your country.
• Other countries: all four are on by default and no banner is shown. You can turn them off at any time.

We determine your country from your IP address when the page loads, and we do not store it. If you reject, Google does not set or read analytics or advertising cookies, but our website may still send Google limited information without cookies (such as the page visited, the time, your browser type, and your approximate location) so that it can estimate overall traffic. Nothing is sent to Meta.

You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of our website, or open cookie settings here. Withdrawing consent does not affect processing that took place before you withdrew it. See how Google uses information from sites that use its services.

Our other analytics provider (Plausible) does not use cookies and does not collect personally identifiable information.

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before sharing any personal data with them.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice in the Service before the change takes effect, and we will update the "Last modified" date at the top of this page.

If you have questions, requests, or concerns about this Privacy Policy, please contact us at [email protected].