Last updated: 22 August 2026 · Draft for legal review
This policy explains how subase, Vukovarska 4 g, 23 000 Zadar, Croatia ("Porat", "we") processes personal data when you use porat.io, contact us, or book a stay on a website we operate for an accommodation provider. Questions and requests: hello@porat.io.
From operators and prospects: name, email, phone, property details and messages you send us. From guests booking on a property website: name, email, phone, stay details, and the information required for the reservation and legal registration of guests. Payment card data is processed by Stripe and never touches our servers.
To operate the booking website and reservation service (performance of contract), to respond to enquiries and demo requests (legitimate interest), to meet legal obligations such as invoicing and guest registration, and, with consent where required, to send product updates you asked for. We do not sell personal data and we do not use it for third-party advertising.
For bookings made on a property website, the accommodation provider is the data controller and Porat acts as processor. Each property runs on its own isolated database hosted in the EU. Guest lists are available to the property owner and are never shared between properties.
We use a small set of service providers to run the Service: EU-hosted infrastructure and databases, Stripe for payments, email delivery providers for transactional messages, and analytics configured without advertising identifiers. Each processes data under a data-processing agreement.
We keep personal data only as long as needed: enquiry and demo data until resolved and up to 12 months after, reservation data for as long as the property requires it and the law prescribes (tax and guest-registration records have statutory retention periods), and account data for the life of the subscription plus 30 days, after which the property database is deleted.
Under the GDPR you can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest. Write to hello@porat.io and we respond within 30 days. You can also complain to your supervisory authority; in Croatia that is AZOP (azop.hr).
Property websites use cookies necessary for the booking flow (session, language, currency) and, where enabled by the property, analytics cookies that require your consent. We do not run cross-site tracking or advertising cookies.
We may update this policy; material changes are announced on this page and, for operators, by email. The date above always shows the current version.