Privacy policy

Guest booking data is processed in your browser and is never transmitted to or stored on Visitor Levy App's servers. Spreadsheet parsing, column mapping and every levy calculation happen on your device. Guest names, individual stay dates and per-booking charges do not reach us, are not written to our database, and do not appear in our logs.

What we do hold: your account details, your property records, and the quarter-level totals you choose to save.

• Account data — name, email address, business name and contact details.
• Property records — property name, address, council area, type and room/unit/bed count.
• Return summaries — per property, per quarter: total accommodation charge, total levy, number of bookings processed, number flagged exempt, filing status and dates.
• Subscription data — plan, billing status and payment references. Card details are handled by Stripe and never touch our servers.
• Security and audit records — changes to account, property and return-status records.

• Guest names, contact details or individual stay records.
• Uploaded booking files. Your spreadsheet is read locally and never uploaded.
• Any special-category data. We provide no way to upload benefit letters, identity documents or evidence of a guest's circumstances, because guests claim exemption refunds directly with the council.

Account data, property records and return summaries are processed on the basis of contract — they are necessary to provide the service you have signed up for. Return summaries are aggregate business records; they are not special-category data.

Account and property data is stored in the EU (Ireland, eu-west-1). All traffic to and from Visitor Levy App is encrypted in transit over HTTPS.

• Supabase — database, authentication and hosting infrastructure, EU region.
• Stripe — payment processing. Stripe is responsible for card data under its own PCI and GDPR compliance; card numbers never reach us.
• Transactional email provider — delivery of deadline reminders and account emails, with EU data residency where available.
• Google Analytics 4 (Google Ireland Ltd) — optional website analytics, used only to understand which public pages people find useful. It does not load at all unless you actively accept optional cookies, IP addresses are anonymised, Google Signals and advertising personalisation are switched off, and no advertising cookies are set. We never send booking, property, guest or account data to it, and pages inside your signed-in account are excluded from tracking entirely.

This list is kept current. Material changes are notified to account holders by email.

• Account and property data is retained while your subscription is active and deleted within 30 days of account closure, except where we are legally required to retain billing records.
• Return summaries are retained for your own reference while your account is open.
• This does not replace your own legal duty to retain the underlying booking records your council requires — generally five years. Those records, and that responsibility, stay with you.

You can export all of your account data, properties and return summaries from your account settings at any time, and you can delete your account yourself. Deletion cascades to your properties and return records after a short, clearly explained grace period. You also have the right to access, correct, restrict or object to processing, and to complain to the ICO.

For anything not covered by self-service, email support@visitorlevyapp.com or use the contact page.

We use only strictly necessary cookies and browser storage, which under the Privacy and Electronic Communications Regulations do not require your consent:

• Authentication session — keeps you signed in to your account.
• Cookie preference record — remembers your choice so we don't ask on every visit. This one is exempt from consent because it exists to honour your decision.
• Local booking working data — booking rows you enter or import stay in your own browser's storage and are never sent to our servers.

We also offer one optional analytics cookie set: Google Analytics 4, used only to measure general usage of our public pages. It is blocked until you actively accept optional cookies — if you reject, or have not yet chosen, the script is never loaded and no analytics cookie is set. IP anonymisation is on, advertising features and Google Signals are off, and signed-in account pages are excluded. We run no marketing or advertising cookies and no third-party tracking pixels. You can withdraw consent at any time using the Cookie settings link in the footer.