Privacy Policy

Birch Stays — birchstays.com

Effective date: 4 August 2026
Last updated: 4 August 2026

1. Who we are

This Privacy Policy explains how Birch Stays Ltd ("Birch Stays", "we", "us", "our") collects, uses, shares and protects personal data when you use our website at https://birchstays.com (the "Website"), book a stay with us, create a guest account, subscribe to our communications, or otherwise interact with our services.

Birch Stays Ltd is the data controller for personal data processed through the Website. We are a private limited company registered in England and Wales under company number 13824705. Our registered office is at 76 Duddy Road, Disley, Stockport, England, SK12 2GB.

If you have questions about this policy or how we handle your data, contact us at hello@birchstays.com.

This policy should be read together with our Cookie Policy, which explains how we use cookies and similar technologies in more detail.

2. What this policy covers

This policy applies to personal data we process when you:

• browse or search the Website;
• enquire about or book a property stay through our checkout;
• create or use a Birch Stays guest account;
• subscribe to our newsletter or submit a marketing form;
• use our live chat or booking enquiry widgets;
• contact us by email, phone or through forms on the Website.

This policy does not cover third-party websites or services that may be linked from the Website (for example, property owners' own sites or social media platforms). Those services have their own privacy policies, and we encourage you to read them before providing personal data.

Our separate privacy policy for the Birch Stays Owner Portal (at owner.birchstays.com) applies to property owners and is not covered here.

3. Personal data we collect

The data we collect depends on how you use the Website. We may collect the following categories of personal data.

3.1 Identity and contact data

Name, email address, telephone number, postal address (including address lines, city, postcode and country), and any special requests or messages you provide when booking, enquiring, signing up for an account, or contacting us.

3.2 Account data

If you create a guest account, we collect your email address, name, password (stored in hashed form), and optionally your phone number and address details. We may also link bookings to your account when your email address is verified.

3.3 Booking and transaction data

Property booked, check-in and check-out dates, number of guests (adults, children, infants, pets), nights stayed, pricing, deposits, balances, voucher codes, booking reference, and payment status. We store Stripe customer and payment identifiers so we can process your booking, take deposits and balance payments, and handle refunds or security deposits.

3.4 Payment data

Payment card details and billing address are collected directly by Stripe when you pay through our checkout. We do not store your full card number on our servers. Stripe provides us with limited payment information (such as the last four digits of your card, card brand and payment status).

3.5 Marketing and communications data

Your email address and marketing preferences when you subscribe to our newsletter or submit a form. We may also record which pages or campaigns led you to subscribe.

3.6 Technical and usage data

IP address, browser type and version, device type, operating system, referring URL, pages viewed, actions taken on the Website (such as viewing a property or starting checkout), and approximate location derived from your IP address.

3.7 Analytics and attribution data

To understand how visitors find and use the Website, and to measure the effectiveness of our advertising, we collect:

• First-party attribution data stored in a cookie on your device, including UTM campaign parameters, referring website, landing page, and advertising click identifiers (such as Google gclid / gbraid / wbraid and Meta fbclid);
• Analytics identifiers from Google Analytics and Hotjar (such as client ID, session ID and Hotjar identifiers), where you have consented to analytics cookies;
• Marketing identifiers from Meta (such as _fbp and _fbc cookies) and Google Ads, where you have consented to marketing cookies;
• Consent choices you make through our cookie banner (analytics and marketing preferences), which we store in a first-party cookie and, when you complete a booking, alongside your booking record.

Some attribution data is collected in a first-party cookie when you first visit the Website, before you make a consent choice, so we can understand how you arrived at our site. Analytics and marketing tags that set third-party cookies or share data with advertising partners only run if you grant the relevant consent.

3.8 Communications and support data

Records of emails we send to you (such as booking confirmations), messages you send us, and information you provide when using our live chat widget. If you are signed in to your guest account when using chat, we may pass your name and email address to our chat provider so we can assist you.

3.9 Form submissions

If you complete a form on the Website (for example, a contact or enquiry form), we collect the fields shown on that form, which may include your name, email address, phone number, and any other information you choose to provide.

4. How we collect personal data

We collect personal data:

• Directly from you — when you book, register, subscribe, complete a form, or contact us;
• Automatically — through cookies, server logs and similar technologies as you use the Website (see our Cookie Policy);
• From payment providers — Stripe provides us with payment confirmation and limited card details;
• From our property management systems — when we synchronise booking data with Hostfully, our property management platform;
• When you use embedded widgets — such as our booking enquiry widget powered by Hostfully, which may receive your enquiry details and referrer information.

5. How we use your personal data

We use personal data to:

• operate the Website and provide our booking services;
• process and manage your reservation, including sending booking confirmations and pre-arrival communications;
• create and manage your guest account and link bookings to it;
• take payments, deposits, balance payments and security deposits, and process refunds;
• provide customer support through email, chat and other channels;
• send marketing communications where you have opted in (or where permitted by law);
• understand how visitors use the Website and improve our content, search and booking experience;
• measure the performance of our advertising on Google, Meta and other platforms;
• prevent fraud, abuse and unauthorised access;
• comply with legal, tax and regulatory obligations;
• enforce our terms and protect our rights.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible purpose.

6. Cookies and similar technologies

We use cookies and similar technologies on the Website. Some are strictly necessary for the site to function (for example, keeping you signed in, remembering a booking claim link, or storing your cookie preferences). Others help us understand usage or measure advertising, and these require your consent.

When you first visit the Website, you will see a cookie banner allowing you to accept all cookies, reject non-essential cookies, or choose your preferences for:

• Analytics cookies — including Google Analytics (via Google Tag Manager) and Hotjar (session analytics and heatmaps);
• Marketing cookies — including Meta Pixel and Google Ads measurement.

We implement Google Consent Mode v2, which means analytics and advertising tags respect your choices. You can change your preferences at any time by clearing cookies and revisiting the Website, or by using your browser settings.

For full details of the cookies we use, how long they last, and how to manage them, see our Cookie Policy.

7. Marketing and communications

Newsletter

If you subscribe to our newsletter, we collect your email address and add you to our mailing list managed by Mailchimp. We may apply tags based on where you subscribed (for example, "homepage"). Depending on our settings, you may receive a confirmation email before your subscription is activated (double opt-in).

You can unsubscribe at any time using the link in any marketing email or by contacting us.

Booking-related communications

We will send you transactional emails about your booking (confirmations, payment reminders, check-in information) regardless of marketing preferences, because these are necessary to perform our contract with you.

Advertising measurement

If you consent to marketing cookies, we use Meta Pixel (on your device) and Meta Conversions API (on our servers) to measure whether our advertising led to a booking. When you complete a booking with marketing consent, we may send Meta a hashed version of your email address, phone number and name, along with your IP address, browser information and advertising identifiers. Meta uses this data under its own privacy policy.

Similarly, if you consent to analytics cookies, we use Google Analytics 4 to understand site usage and measure conversions. We may also send purchase events to Google from our servers when you complete a booking with analytics consent. With analytics consent we may also use Hotjar to understand how visitors interact with the Website.

We do not sell your personal data to third parties for their own marketing purposes.

8. Lawful bases for processing

Under UK GDPR, we rely on the following lawful bases:

PurposeLawful basis

Processing and managing your booking

Contract — necessary to perform our agreement with you

Creating and operating your guest account

Contract

Sending booking confirmations and service emails

Contract

Processing payments via Stripe

Contract

Responding to enquiries and providing support

Contract or Legitimate interests

Operating the Website securely and preventing fraud

Legitimate interests

First-party attribution tracking (how you found us)

Legitimate interests — to understand marketing effectiveness and allocate spend

Analytics cookies (Google Analytics, Hotjar)

Consent

Marketing cookies and ad measurement (Meta, Google Ads)

Consent

Newsletter subscriptions

Consent

Retaining booking and payment records for tax and accounting

Legal obligation and Legitimate interests

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You have the right to object to processing based on legitimate interests in certain circumstances (see section 12).

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

9. Who we share your data with

We share personal data only as described below. We require all service providers that process personal data on our behalf to protect it appropriately and to process it only on our documented instructions.

9.1 Service providers (data processors)

ProviderPurposeData shared

Stripe

Payment processing

Name, email, payment card and billing details, IP address, transaction amounts

Hostfully

Property management and booking operations

Guest name, email, phone, stay dates, occupancy, booking and payment details

Mailchimp (Intuit)

Email marketing

Email address, subscription status, tags

Google (Tag Manager, Analytics, Maps, Ads)

Analytics, advertising measurement, maps

Usage data, device data, advertising identifiers, conversion events (with consent)

Meta (Facebook / Instagram)

Advertising measurement

Hashed contact details, IP address, browser data, conversion events (with marketing consent)

Hotjar

Website experience analytics

Usage and interaction data (with analytics consent)

Conduit

Live chat support

Name and email (when signed in), chat messages

Resend

Transactional email delivery

Email address, name, booking details in email content

Cloud hosting providers

Website and database hosting

Data stored on our systems

9.2 Other disclosures

We may also share personal data:

• with professional advisers (lawyers, accountants, insurers) where necessary;
• with regulators, courts or law enforcement when required by law or to protect our rights;
• in connection with a merger, acquisition or sale of Birch Stays Ltd, subject to appropriate confidentiality safeguards.

We do not sell your personal data.

10. International transfers

Some of our service providers are based outside the United Kingdom, including in the United States (for example, Stripe, Google, Meta, Mailchimp and Hotjar). Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place, such as:

• a transfer to a country recognised by the UK government as providing adequate protection;
• the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses; or
• another mechanism approved under UK data protection law.

You can contact us for more information about the safeguards we use.

11. How long we keep your data

We retain personal data only for as long as necessary for the purposes described in this policy:

Data typeTypical retention

Booking and payment records

At least 6 years after the end of the financial year in which the transaction occurred, to meet UK tax and accounting requirements

Guest account data

For as long as your account is active, plus a reasonable period afterwards

Newsletter subscription data

Until you unsubscribe, plus a short period to process your request

Analytics and attribution data (cookies)

Up to 90 days for attribution cookies; analytics cookie lifetimes vary (see Cookie Policy)

Consent records

For as long as needed to demonstrate compliance, typically aligned with the related booking or cookie lifetime

Support and chat records

Up to 3 years after the interaction, unless a longer period is needed for a dispute

When data is no longer needed, we delete or anonymise it.

12. Your rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — to receive a copy of the personal data we hold about you;
• Right to rectification — to correct inaccurate or incomplete data;
• Right to erasure — to request deletion in certain circumstances;
• Right to restrict processing — to limit how we use your data in certain circumstances;
• Right to object — to object to processing based on legitimate interests, and to object to direct marketing at any time;
• Right to data portability — to receive data you provided to us in a structured, machine-readable format, where applicable;
• Right to withdraw consent — where we rely on consent, you may withdraw it at any time.

To exercise any of these rights, email hello@birchstays.com. We may need to verify your identity before responding. We aim to respond within one month.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk. We would appreciate the chance to address your concerns before you contact the ICO.

Some rights are subject to exceptions — for example, we may need to retain booking records for legal and accounting purposes even if you request erasure.

13. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, secure payment processing through Stripe, and supplier due diligence.

No method of transmission or storage is completely secure. If you believe your account or data has been compromised, contact us immediately at hello@birchstays.com.

14. Children

The Website and our booking services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will take steps to delete it.

15. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

16. Changes to this policy

We may update this Privacy Policy from time to time. The current version will always be available at https://birchstays.com/privacy/. Where changes are material, we will provide reasonable notice (for example, by posting a notice on the Website or by email where appropriate).

17. Contact us

Data controller: Birch Stays Ltd
Email: hello@birchstays.com
Website: https://birchstays.com
Registered office: 76 Duddy Road, Disley, Stockport, England, SK12 2GB
Company number: 13824705

This document is provided for publication on birchstays.com. It is not legal advice. We recommend having it reviewed by a qualified adviser before publication.

Main privacy update vs the previous draft: ContentSquare → Hotjar everywhere it appeared (banner summary, lawful bases, processors, transfers). Cookie Policy lists the real first-party cookies (birch_consent_v1, birch_attr_v1, guest_pending_claim) plus consent-gated GA/Hotjar/Meta/Ads. Not legal advice — worth a quick solicitor pass before you publish.