Privacy

Rock & Home is a small family guesthouse. We take our bookings ourselves, on our own website, and the only people who read what you send are the family who run the house.

This page says exactly what happens to your details. It is written to meet the General Data Protection Regulation (EU) 2016/679. The short version: we ask for what we need in order to answer you, we keep it only as long as we need it, and then it is erased automatically.

[REGISTERED NAME — e.g. Rock & Home, Unipessoal Lda.]
[REGISTERED ADDRESS, Ribeira da Janela, 9270-??? Porto Moniz, Madeira, Portugal]
NIF: [NIF]
Alojamento Local registration: [RNAL No.]
support@rockandhome.com · +351 964 519 558

That is the controller of your personal data. For anything at all about it — a copy, a correction, an erasure — write to support@rockandhome.com and one of us will answer personally.

Only what a form asks for. Anonymous visit statistics are covered under Cookies below; nothing else is collected in the background.

• A booking request — your name, email, phone, the dates, how many of you there are, which apartment, your message and the language you wrote in. We need it to check the dates are free, hold them for you and reply.
• A question — the same details, without the dates being held. Some people write to ask whether the road is steep or whether a cot fits, and that should not start a clock on a room.
• A handy-work request — your name, email, phone, the kind of work, where you are on the island and what needs doing, so we can come and quote for it.
• With every form, a short one-way fingerprint of your IP address — a salted hash, never the address itself, which cannot be turned back into it. It exists only to stop a machine sending the form a thousand times, and nothing else reads it.

We never ask for card or bank details: nothing is paid on this website. We do not use your details for marketing, we do not sell them, we do not share them for advertising, and nothing here is decided about you automatically.

• Your request (Art. 6(1)(b) — a contract, or the steps before one). A booking or a job cannot be arranged without a name and a way to reply.
• Our legitimate interest (Art. 6(1)(f)) in keeping the forms usable, which is the hashed IP, and in keeping a record of the stays we have taken.
• The law (Art. 6(1)(c)) — the guest registration every Alojamento Local in Portugal has to make, and the bookkeeping the tax rules require.

Three suppliers, each under a data-processing contract, each keeping the data inside the European Union:

• Neon — the database, on servers in Frankfurt, Germany.
• Vercel — the hosting that runs this website and its booking API.
• Spacemail — the mailbox that sends your confirmation and receives your reply.

Beyond those: the Portuguese authorities, where the law requires it — an Alojamento Local must register the guests who stay. Nobody else. Your details are never transferred outside the EU.

• A request that never became a stay — declined, cancelled or lapsed: 2 months.
• A question that was never a booking: 3 months.
• A handy-work request: 24 months.
• A stay that actually happened: 10 years, because Portuguese bookkeeping asks for the record.

This is not a promise we keep by hand. A job runs every night and strips the name, email, phone number and message out of every record past its date. What is left is a row with dates in it and no person — enough to know the house was full that week, not enough to know who was in it.

Analytics cookies are off until you say yes. We use Google Analytics to count visits and see which pages are useful. The Google script loads on every page, so Google receives a basic, cookie-free request — including your IP address — even before you choose. Until you press Accept, it sets no cookies and no identifier on your device. If you press Reject, that stays so. You can change your mind any time with Cookie settings in the footer. Google (Google Ireland Ltd., with transfers outside the EU possible) is the recipient. There is no advertising pixel and no third-party font. The map on the home page loads from Google by itself once you press Accept. If you have not accepted, it loads only when you press Show map; until then nothing is sent to Google. Once it loads, Google may set its own cookies and receives your IP address.

Stored on your device:

• Analytics (_ga, _ga_*, set by Google Analytics only after you accept; up to 2 years) and your choice (rh_consent, kept in your browser).
• Your language (rh_lang), saved in your own browser so the site opens in the language you chose last time. You set it yourself by pressing a button, and it never leaves your device.
• The owners' session (rh_admin) — a cookie set only when the family sign in to the private area of this site. A guest is never sent one.
• The building notice (rh_dev_notice) — set when you close the strip that says the site is still being finished, so it does not greet you again.

If we ever add something that does watch you, this page changes before it does, and you will be asked first.

Everything travels over an encrypted connection. The database sits behind credentials the website alone holds; the owners' area is behind a password stored only as a bcrypt hash, and its session cookie is httpOnly and SameSite=Strict, so no other site can borrow it. No card number ever touches this website, because none is ever asked for.

You may ask us for a copy of what we hold about you, ask us to correct it, ask us to erase it, ask us to restrict or stop what we do with it, ask for it in a portable file, or object to it. Write to support@rockandhome.com. There is no charge, and we answer within a month.

If you think we have handled it badly, you can complain to the Portuguese supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. We would much rather you told us first.

If what we do changes, this page changes with it, and the date below changes too. There is no version we keep quiet about.