Privacy policy

Who we are

Rantio is a trading name of Elda-Auto Tmi, a Finnish sole proprietorship (business ID [Y-tunnus]). Elda-Auto Tmi is the controller of the personal data described here.

Questions about privacy, or a request about your own data: hello@rantio.fi. We answer within a month, usually much sooner.

Guests who send a question to an owner

When you use the contact form on a cottage page, we save what you write and pass it to the cottage owner. We use your email address to send you a private link to the conversation and to tell you when the owner replies. Anyone who has the link can read the conversation, so keep it to yourself.

Legal basis: our legitimate interest in delivering the question you asked us to deliver and letting the owner answer it (GDPR article 6(1)(f)).

What we save:

• Your name and email address
• The dates and number of guests, if you give them
• Your messages and the owner's replies
• The language of the site, so we can write to you in it

Cottage owners

When you sign up, we save the details from the sign-up form so we can contact you and plan your listings. If you become a customer, we also keep your account, your cottages, bookings, fees and invoices. You sign in with a one-time code sent to your email; codes stop working after 15 minutes and are stored only in scrambled (hashed) form.

Legal basis: steps you asked for before a contract, and your consent in the sign-up form (article 6(1)(b) and (a)); carrying out the owner service agreement (6(1)(b)); and keeping the accounting records Finnish law requires (6(1)(c)).

What we save:

• Your name, email address and phone number, if you give it
• Country, region, number of cottages, Nettimökki link and message from the sign-up form
• Your cottages' descriptions, photos, prices and calendars
• Bookings, yearly fees, commissions, invoices and whether they're paid (payments go through Stripe; we never see or store card numbers)
• Your messages with guests and with us

Bookings and calendars

To keep an owner's calendars in sync and work out commissions, we handle booking details that come from the listing sites through our channel manager, and from Nettimökki booking emails that owners forward to us. These contain the guest's name, dates, number of guests and the amount paid, and sometimes contact details the site shares. We use them only to block dates, show the bookings to the owner and bill our commission.

Legal basis: providing the service to the owner (6(1)(b)) and our legitimate interest in preventing double bookings (6(1)(f)). If you booked a cottage as a guest, the listing site and the owner are responsible for the booking itself, and their own privacy policies apply to it.

AI reply suggestions

Owners can ask for a suggested reply to a guest. Only when they press the button do we send the conversation (including the guest's name and messages) and the cottage's details to Anthropic, whose AI model writes a draft. The owner reads and edits the draft before anything is sent. No decisions about anyone are made automatically.

Legal basis: our legitimate interest in helping owners answer guests quickly and well (6(1)(f)). Under its commercial terms, Anthropic does not use this data to train its models.

Visiting the website

Our servers record technical details of each request, such as IP address, time, page and browser type. We need them to keep the site running, stop abuse (for example, too many form submissions from one address) and fix errors. These logs are kept only briefly. On a first visit the site also looks up, on our own server, which country your IP address is in (using DB-IP's database), so it opens in your country's language; that country isn't stored. Legal basis: our legitimate interest in a secure, working service (6(1)(f)).

Some parts of the site load content straight from other services: maps from Google Maps (OpenStreetMap where Google Maps isn't available), nearby places and their pictures from Wikipedia, website icons through Google, and cottage photos from Unsplash. Your browser then contacts those services directly, so they see your IP address, as with any website. We don't send them anything else about you.

Who receives your data

Cottage owners see the questions and messages guests send them. We give data to authorities only when the law requires it.

We don't sell personal data and we don't share it for advertising. We use these providers, who handle data on our behalf and only as we instruct:

• Hetzner Online (Germany): servers in Helsinki, Finland, where our database and files are kept
• A transactional email service that delivers our emails (sign-in codes, messages and notifications)
• Stripe: invoices and payments for owners
• Anthropic: AI reply drafts, only when an owner asks for one
• Beds24: the channel manager that connects owners' calendars and listings to the listing sites
• Listing sites such as Airbnb, Booking.com and Vrbo: they receive the cottage listing and calendar from us and send us booking details. They decide for themselves how they use guest data.

Transfers outside the EU

We keep our data in the EU. Anthropic and Stripe may process data in the United States. When that happens, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses, together with the providers' own security measures. The same applies if any other provider processes data outside the EU or EEA. Ask us if you'd like to know more about these safeguards.

How long we keep data

We keep data only as long as we need it:

• Guest conversations: up to 24 months after the last message, then deleted
• Sign-ups from owners who don't become customers: up to 24 months after our last contact
• Owner accounts, cottages and bookings: while the owner agreement runs, and up to 12 months after it ends
• Invoices and other accounting records: six years from the end of the financial year, as Finnish accounting law requires
• Server logs: a short time, normally a few weeks

Cookies and browser storage

We don't use analytics, advertising or tracking cookies, and we don't follow you around other websites. We only store what the site needs to work and what you choose yourself.

You can delete cookies and stored data in your browser settings at any time. The site still works, but you may need to pick your language again or sign in again.

What we store:

• stugora_lang cookie: the language you picked, for a year. It's set only when you pick a language.
• sessionid cookie: keeps a cottage owner signed in, for up to 30 days or until they sign out
• csrftoken cookie: a security cookie that stops other websites from sending forms in your name
• Your browser's local storage: the currency you picked, the cottages you saved, and cached exchange rates, homepage photos and nearby places so pages load faster. This stays on your device; we don't receive it.
• The browser tab's session storage: whether you're signed in as an owner, so the menu shows the right link

Your rights

To use any of these rights, email hello@rantio.fi. We may ask you to confirm who you are before we act.

You have the right to:

• see the personal data we have about you and get a copy
• correct details that are wrong
• have your data deleted when we no longer need it or have no basis to keep it
• restrict how we use it, or object to use based on our legitimate interest
• get the data you gave us in a machine-readable format and take it elsewhere
• withdraw your consent at any time; this doesn't affect what was done before

Complaints

If you think we handle your data wrongly, please tell us first and we'll try to put it right. You can also complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi), or to the data protection authority in the EU country where you live.

Changes

When we change this policy, we update the date at the top. If a change matters for you as an owner, we'll also tell you by email.