Privacy Policy

1. Purpose

• Identifying members and sending price alerts
• Checking price changes for bookings you register
• Answering inquiries
• Keeping the site secure and running

2. What we process

We process only what the service needs.

• Sign-up: email address
• Extracted from the booking confirmation email: hotel name and ID, check-in and check-out dates, room type, breakfast, guests and rooms, cancellation policy and free-cancellation deadline, total paid and currency, payment method
• Inquiries: email address and the message
• Site visits: access logs (IP address, time of access, browser details)

3. What we do not store

We delete the original email right after extracting the fields above. We do not store:

• the original email (body and attachments)
• guest names
• email addresses in the email body
• the booking number
• the manage-booking link

4. Retention

• Booking details: deleted 30 days after the check-out date
• Account details: deleted without delay when you leave
• Inquiries: deleted 1 year after we answer
• Longer only where a law requires it

5. Deletion

Personal information is deleted without delay once its retention period ends or its purpose is met. Electronic files are deleted so they cannot be recovered.

6. Sharing with third parties

We do not share your personal information with third parties, except where a law specifically requires it.

7. Processors and transfers abroad

We use the providers below to run this site and handle inquiry email, which transfers personal data abroad. Transfers happen over the network each time you visit the site or send us an inquiry. Each provider uses the data only for the task listed. Inquiries are kept as set out in section 4; access logs are kept under each provider’s policy.

To refuse the transfer, do not visit the site or email us — you then cannot view the site or contact us by email. Booking-email and alert providers are added at launch.

• Microsoft Corporation (contact: aka.ms/privacyresponse): site hosting (Azure). Data: access logs (IP address, time of access, browser details). Country: Hong Kong (Azure East Asia region) and the delivery points that serve the site
• Cloudflare, Inc. (contact: privacyquestions@cloudflare.com): domain name servers, inquiry email forwarding. Data: inquiry emails (sender address and content). Country: USA and other countries in Cloudflare’s network
• Google LLC (contact: googlekrsupport@google.com): inquiry mailbox (Gmail). Data: inquiry emails (sender address and content). Country: USA and other countries with Google data centers

8. Your rights

You can ask at any time to see, correct, delete or stop the processing of your personal information. Write to hello@dropstay.kr and we will act without delay.

9. Security

• Encryption in transit (HTTPS)
• Least-privilege access to personal information
• Original booking emails are not kept

10. Automatic collection

We use no cookies or behavioral analytics. The servers hosting this site keep access logs (IP address, time of access, browser details) for security and troubleshooting, for the period set by the hosting provider in section 7. We will update this policy before adding any analytics.

11. Privacy officer

• DropStay team
• hello@dropstay.kr

12. Remedies

For advice or to report a privacy violation, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

13. Changes

We announce changes on this page at least 7 days before they take effect.