Privacy

Who holds your information

FinnCabin is a single holiday property above Alforja, in Catalonia, Spain, run by its owners. The information you send through the enquiry form is held by them and is not shared with anyone marketing anything.

If you need the registered contact details for a formal request, ask for them in writing at the address below and they will be given to you.

When you arrive here from somewhere else

When you land on this site from somewhere else — a search result, a shared link, an advert — we record one line: the page you arrived on, where you came from, any campaign tags in the link, and your browser’s language. This happens once, on that first arrival; clicking around the site afterward is not recorded again.

That line carries no name, no email, and nothing that identifies you — there is no cookie, no ID stored in your browser, and no way to connect it to anything else you do here or on a later visit. It exists so we can tell, in general terms, how people are finding the property, not to build a picture of any one visitor.

This does not touch the promise below: no analytics script, no advertising pixel, no tracking cookie. What is described here is one line written by our own server when you arrive, not a script watching what you do.

What the enquiry form collects

This is the complete list. There is no analytics script, no advertising pixel and no tracking cookie on this page or on the enquiry form.

What the guest book collects — and what’s different about it

The guest book is a second form, separate from the enquiry one above, and it works differently: some of what you post there is deliberately made public.

You choose the visibility yourself, every time you post: private (only the house sees it), guest book (other guests can read it during their stay, never the public site), or public (this website, to anyone, including people who have not booked yet and are deciding whether to). Choosing public is the one option that puts your words — and the name or initials you picked — in front of a stranger. Nothing described above, on the enquiry form, is ever published; this is.

The basis for publishing is your own consent, not the reply-to-your-question basis the enquiry form relies on below — you set the level when you post, and you can change it or take a post down at any time. If you posted without an account, the one-time code shown when you posted is the fastest way to ask for that; otherwise, write to us.

What a booking collects

Holding dates asks for more than an enquiry does: the same name and email, a phone number so we can reach you on the day, the dates themselves, and how many people are coming. If you tell us you would like the sauna lit or that you are planning a party, we keep that too, because it is what we would be arranging with you.

Anything you write in the note field is kept as you wrote it. It reaches the owners and the partner who answers it, and nobody else.

Your card, and the part of it we never see

Payments run through Stripe Payments Europe. We never see your card number. It goes from you to Stripe directly, and what comes back to us is the brand, the last four digits and the expiry date — enough to tell you which card is on file, and not enough to charge it anywhere else.

Stripe keeps the card and gives us a reference to it, so the deposit and the balance described in the booking terms can be taken on the dates those terms name without asking you to type it again. You can have that reference removed by writing to us; it is a message to a person, not a form to hunt for.

The register the police require

Spanish law requires accommodation to register the people who stay in it, and in Catalonia that register goes to the Mossos d’Esquadra rather than to the national system. It asks for identity-document details for everyone staying, and we collect them shortly before you arrive.

This is the one thing on this page we hold because we are obliged to, not because it helps us. We cannot host you without it and you cannot ask us to delete it early: the law sets the period at three years from the end of your stay. Nothing in it is used for anything else.

What you write in Messages

Once you are signed in for your stay, anything you write in Messages is kept as you wrote it and reaches the owner and the partner who answer it — the same people who read a booking’s note field, above, and nobody else.

We use it to run your stay and, if a disagreement ever needed sorting out, as a record of what was actually said.

Why we are allowed to hold it

For an enquiry: you asked us a question and we are answering it. Holding your name and address for long enough to reply is the whole basis — we are not relying on consent you would have to withdraw, and there is no box you needed to tick.

For a booking: we are performing the contract you are entering into. The dates, the phone number and the card reference exist so that the stay described in the terms can happen.

For the police register: a legal obligation, which is the one basis that does not bend to either of our preferences.

Where it is stored, and who else touches it

The site runs on Vercel and the database is Neon, both in the Frankfurt region. Email we send you goes out through Resend, and payments through Stripe Payments Europe. Photographs and videos posted to the guest book are stored by Cloudinary — location data is stripped from them before they are stored, and we have not yet confirmed which region holds them. Those five companies process your information on our behalf and for no purpose of their own — with one honest exception: Stripe is also a payments business in its own right and holds your card under its own responsibility, not merely on instruction from us.

Inside FinnCabin, an enquiry can be read by the owners and by the partner who answers it. Cleaners, gardeners and other helpers cannot see enquiries at all — that is enforced by the system, not by a rule people are asked to remember.

Cookies

The site sets one kind of cookie — a session cookie that keeps you signed in on the console, portal or guest area once you have logged in. It carries no tracking, no advertising identifier, and it is read by nobody but this site.

Nothing else here needs your permission to run: no analytics, no advertising pixel, no third-party script. That is why there is no cookie banner — under Spanish law, a cookie that is strictly necessary for something you asked for, like staying signed in, does not need one.

How long we keep it

An enquiry that never becomes a booking is kept for twelve months from the last time we spoke, and then deleted.

A booking, and the accounting record it becomes, is kept for the six years Spanish commercial law requires of business records. The identity details in the police register are kept for three years from the end of your stay, because that is the period the law setting up the register names.

A guest-book post is kept while it is published, up to five years, and we ask you again before keeping it longer. If you withdraw it we keep the record of your consent for three years, because that record is the proof we had your permission in the first place.

A message you send us through Messages is kept for three years from when you send it.

You can ask us to delete your enquiry at any time and we will, without waiting for any of those periods to run out.

What you can ask for

A copy of what we hold about you, a correction to it, or its deletion. You do not need an account and you do not need a reason. Ask at the address below and say which enquiry you mean — the email address you used is enough to find it.

If you are unhappy with how we have handled it you can complain to the Spanish data protection authority, the AEPD, at aepd.es.

Getting in touch

Write to thefinncabin@gmail.com. It is read by the owners.

You can also reply to any email we have sent you, which reaches the same place.