Privacy policy

Guest booking data is processed in your browser and is never transmitted to or stored on Visitor Levy App's servers. Spreadsheet parsing, column mapping and every levy calculation happen on your device. Guest names, individual stay dates and per-booking charges do not reach us, are not written to our database, and do not appear in our logs.

What we do hold: your account details, your property records, and the quarter-level totals you choose to save.

• Account data — name, email address, business name and contact details.
• Property records — property name, address, council area, type and room/unit/bed count.
• Return summaries — per property, per quarter: total accommodation charge, total levy, number of bookings processed, number flagged exempt, filing status and dates.
• Subscription data — plan, billing status and payment references. Card details are handled by Stripe and never touch our servers.
• Security and audit records — changes to account, property and return-status records.

• Guest names, contact details or individual stay records.
• Uploaded booking files. Your spreadsheet is read locally and never uploaded.
• Any special-category data. We provide no way to upload benefit letters, identity documents or evidence of a guest's circumstances, because guests claim exemption refunds directly with the council.

Account data, property records and return summaries are processed on the basis of contract — they are necessary to provide the service you have signed up for. Return summaries are aggregate business records; they are not special-category data.

Account and property data is stored in the EU (Ireland, eu-west-1). All traffic to and from Visitor Levy App is encrypted in transit over HTTPS.

• Supabase — database, authentication and hosting infrastructure, EU region.
• Stripe — payment processing. Stripe is responsible for card data under its own PCI and GDPR compliance; card numbers never reach us.
• Transactional email provider — delivery of deadline reminders and account emails, with EU data residency where available.
• Analytics — we use cookie-free, aggregate analytics that does not track individuals across sites and sets no non-essential cookies. If we ever adopt a cookie-based tool, we will block it behind a consent banner with a clear reject option.

This list is kept current. Material changes are notified to account holders by email.

• Account and property data is retained while your subscription is active and deleted within 30 days of account closure, except where we are legally required to retain billing records.
• Return summaries are retained for your own reference while your account is open.
• This does not replace your own legal duty to retain the underlying booking records your council requires — generally five years. Those records, and that responsibility, stay with you.

You can export all of your account data, properties and return summaries from your account settings at any time, and you can delete your account yourself. Deletion cascades to your properties and return records after a short, clearly explained grace period. You also have the right to access, correct, restrict or object to processing, and to complain to the ICO.

For anything not covered by self-service, email privacy@visitorlevyapp.com or use the contact page.

We set only the cookies strictly necessary to keep you signed in. We do not run marketing or advertising cookies. Our analytics is cookie-free.