What happens to your data here.

Who is responsible

The data controller under the GDPR is Denis Zadorozhnyi, a natural person who runs Roast My BnB. Contact: [email protected].

When you visit the site

What

One line per step (opening the page, starting a check, reaching payment, paying, opening a report): the time, the step, a random id kept only in the open page, where you came from, your country, the kind of device and the report id. Not your IP address. Nothing is stored on your device.

Why and legal basis

To see how many people get through each step: our legitimate interest in knowing whether the product works (GDPR art. 6(1)(f)).

How long

12 months.

Recipients

Hosting and network provider.

When you check a listing

What

The listing text, photos, price, availability and the host name as Airbnb shows it.

Why and legal basis

To produce the report you asked for: our legitimate interest in reporting on a publicly listed property (GDPR art. 6(1)(f)).

How long

While the report link is live, and 24 months at most.

Recipients

The service that collects the public listing, the AI provider that generates the report, the hosting and network provider, and anyone you share the report link with.

If you are the host of a checked listing

Someone else may check your listing. Then we process data about you that we did not get from you (GDPR art. 14).

Source and what

Your public Airbnb listing: text, photos, price, availability and your host display name.

Why and legal basis

To produce the report the person who pasted the link asked for: our legitimate interest in reporting on a publicly listed property (GDPR art. 6(1)(f)).

How long

While the report link is live, and 24 months at most.

Recipients

The same as above, and anyone the person who ordered the report shares the link with.

You can object at any time on grounds relating to your particular situation (GDPR art. 21). Write to [email protected] with the listing link, and you can also ask us to delete the report.

When you leave your email

After the free result

We keep your email with the report, the listing link and the time, to write to you about that report. Legal basis: your consent (GDPR art. 6(1)(a)). It is optional; write to us and we remove it.

If a check could not finish

We use your email to send you the report when it is ready. Legal basis: steps taken at your request (GDPR art. 6(1)(b)).

How long

12 months.

Recipients

Email delivery provider, hosting and network provider.

When you pay

What

Payment happens on the payment provider’s checkout page. Your card details go to the payment provider, not to us. It passes us your email address, which we keep with your order. Your email is required to fulfil the order.

Why and legal basis

To send you the report you paid for: performance of our contract with you (GDPR art. 6(1)(b)).

How long

For as long as accounting law requires.

Recipients

Payment provider, email delivery provider, hosting and network provider.

Orders via Etsy: we receive the order number, the listing link and the buyer name from Etsy’s order email. Legal basis: contract (GDPR art. 6(1)(b)); kept for as long as accounting law requires. Recipients: hosting provider and email provider.

Protection against abuse

What

Your IP address, held in the server’s memory only.

Why and legal basis

To limit free checks and email submissions per day: our legitimate interest in keeping the service usable (GDPR art. 6(1)(f)).

How long

24 hours.

Ad measurement (Meta Pixel), only if you accept

If you press “Accept” in the cookie notice, your browser loads Meta’s pixel. If you press “Reject”, or do nothing, the pixel is never loaded.

What

Meta sets its own cookies and receives, from your browser, the pages you open, your IP address, browser details and these events: you started a check, you went to payment, you paid (amount and currency).

Why and legal basis

To see which ads bring hosts here: your consent (GDPR art. 6(1)(a), and art. 43(4) of the Croatian Electronic Communications Act). You can withdraw it at any time in “Cookie settings”; the pixel stops at once. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Recipient

For the collection of this data and its transmission to Meta, we are joint controllers with Meta Platforms Ireland Limited. How responsibilities are split is set out in Meta’s Controller Addendum: facebook.com/legal/controller_addendum. What Meta does next falls under Meta’s own policy.

Cookies and browser storage

• rml_consent (local storage): your “Accept” or “Reject”, so we don’t ask again. Stays until you clear site data.
• rml_lang (cookie): the language you picked with the language switch, kept for a year. It is strictly necessary for showing the site in your chosen language, so it needs no consent.
• Meta’s cookies: only after you accept.

To change your choice, press the “Cookie settings” button in the bottom-left corner of the page and pick the other option.

Transfers outside the EEA

Some of our providers are outside the European Economic Area (EEA), in the United States. These transfers rely on the EU–US Data Privacy Framework or on standard contractual clauses.

Automated decision-making

The report is written by an AI model; we make no decisions based solely on automated processing that have legal or similarly significant effects on anyone (GDPR art. 22).

Your rights

You can ask for access to your data, its correction or deletion, restriction of processing and a copy in a portable form, and you can object to processing based on our legitimate interest. Write to [email protected].

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

We answer within one month.

If you think we handle your data unlawfully, you can complain to the Croatian Personal Data Protection Agency (AZOP): azop.hr.