Privacy, data & legal

Two different relationships hide behind the word "data", and it is worth keeping them apart.

Your account — your name, email and billing. Vashana is responsible for this, under the Privacy Policy.
The people who use the sites you build — your visitors, customers and renters. You are responsible for their data; Vashana only processes it on your behalf, under the Data Processing Agreement.

The DPA you already have

The GDPR requires a written agreement between a controller and its processor. Vashana's is published and self-serve: it forms part of the Terms, applies automatically, and needs no signature or negotiation. If a client or an auditor asks you for one, send them the link.

The sub-processor list names every company involved in running the service — hosting, storage, email, AI, payments and domains — and which of them are outside the EEA. You get at least 30 days' notice before a new one is added.

How long things are kept

The service enforces this automatically:

Data	Kept for
Booking photographs	90 days after the booking ends (longer while a deposit claim is open)
Accepted agreement documents	3 years after the booking ends; the record that it was accepted stays with the booking
Application logs	14 days
Everything else	As long as your account is active; deleted within 90 days of closing it

Payments never pass through Vashana

Money from your bookings goes to your own Vipps MobilePay or Stripe account, and money from your shop goes to your own Snipcart or Stripe account. Vashana is not the merchant, never holds the funds, and takes no cut. Your own subscription is the exception: that is billed by FastSpring as merchant of record — see Plans & billing.

What your visitors are asked for

Vashana's built-in site statistics set no cookies and store nothing identifying — see Analytics & cookie banner.
The AI site chatbot is anonymous: no login, and nothing kept about a visitor beyond the conversation.
Anything you add — Google Analytics, an advertising pixel, an embedded widget — is your own integration, and consent for it is your responsibility.

Closing your account

Profile in your account menu has Delete account. It permanently removes your account and everything under it, including every creation and its files, and it cannot be undone. Take a backup or export anything you want to keep first.