Privacy Policy

1. Who we are

Bumpr ApS (CVR no. 46460960, Denmark) is the data controller for personal data processed through the Bumpr website and app (the “Platform”). Contact: support@bumpr.rent, or WhatsApp +45 31 70 17 50. This policy explains what data we collect, why, who we share it with, and your rights under the EU General Data Protection Regulation (GDPR).

2. The data we collect

• Account data: name, email address, phone number, password (stored hashed), and profile settings.
• Booking data: villa, dates, number of guests, price paid, booking history, and communications about your stay (including bump notifications).
• Payment data: payments are processed by our payment provider. We receive confirmation of payment and the last digits of your card; we do not store full card numbers. If you save a card, our payment provider stores it securely as a token linked to your account, and Bumpr stores only the provider's customer reference — never the card itself. You can remove a saved card at any time in the app.
• Host data: if you list a villa, we also collect your business name and registration number, your business registration document (NIB), and the bank account we pay you to. Bank details are shared with Airwallex to make payouts; the registration document is seen only by Bumpr staff checking the listing.
• Technical data: device type, app version, IP address, and log data generated when you use the Platform.
• Usage data: records of the actions you take on the Platform — bookings made and changed, messages sent, notifications delivered — generated by the service itself as it runs. In the app, we also measure which advertising led you to install it and whether you went on to book (see sections 4 and 9).

3. Why we process it (legal bases)

• To provide the service — creating your account, processing bookings and payments, sending booking confirmations and bump notifications (contract, GDPR art. 6(1)(b)).
• To meet legal obligations — bookkeeping, accounting and tax rules (legal obligation, art. 6(1)(c)).
• To run and improve the Platform — security, debugging and product improvement (legitimate interests, art. 6(1)(f)).
• To send marketing — only with your consent, which you can withdraw at any time (consent, art. 6(1)(a)).
• To measure our advertising — which ads, links and printed flyers lead to app installs and bookings, so we spend less on the ones that don't work (legitimate interests, art. 6(1)(f)). Sharing this with the ad network that showed you an ad, so it can measure and improve our ads, happens only with your consent: on iPhone, when you choose “Allow” in Apple's tracking prompt (consent, art. 6(1)(a)).

4. Who we share data with

We share personal data only where needed to run the service:

• Villa owners and managers: the owner of the villa you book receives your name, party size, stay dates and phone number so they can host you and reach you on the day.
• Payment processing: Airwallex processes payments and refunds. Your card details are entered in Airwallex's payment sheet and sent directly to Airwallex — they never reach Bumpr's servers. If you save a card for future bookings, Airwallex retains it as a secure token linked to your Bumpr account until you remove it in the app or delete your account; Bumpr never sees or stores the card number. Saved cards are only ever charged when you are present and confirm the payment yourself — Bumpr does not charge a saved card in the background. Airwallex handles that data under its own privacy policy: https://www.airwallex.com/hk/terms/privacy-policy
• Hosting and infrastructure: Supabase (database and backend), Vercel (web hosting) and GitHub (code and deployment infrastructure).
• Messaging: WhatsApp messages and login codes are sent through 360dialog, a WhatsApp Business provider, and delivered by Meta under WhatsApp's own terms. Emails are sent through Resend. Push notifications are delivered through Expo's push service and Apple's or Google's notification systems. Each sees the message content it delivers.
• Support: when you message our support line on WhatsApp (+45 31 70 17 50) or email support@bumpr.rent, your name, phone number or email and your message are shown to our support team in Slack, where we answer from. Those copies are deleted when your account is deleted.
• Error monitoring: Sentry receives a technical report when the app or website breaks, so we can find and fix the problem. A report contains the error message, where in our code it happened, the screen or page, and the type of device, operating system and browser. We have set it up not to collect your name, contact details, payment details, location, cookies or the content of your requests. Sentry stores this data in the EU (Germany).
• Maps: Mapbox provides the map you see in the app. Rendering it sends Mapbox technical data, including your approximate location when you allow it, under Mapbox’s own privacy policy.
• Advertising measurement: AppsFlyer tells us which ad, link or flyer led to an install of the app, and whether a booking followed. From the app it receives your device's identifiers and technical data (device model, operating system, app version, IP address), your Bumpr account number, and these actions: creating an account, viewing a villa, opening checkout, and completing a booking with its amount. It never receives your name, email address, phone number or payment details. On iPhone, your advertising identifier (IDFA) is sent only if you allowed tracking; on Android, the app never reads your phone's advertising ID, and installs are matched to ads through the referral information Google Play passes on. Where you consented to tracking on iPhone, AppsFlyer passes the result to the ad network that showed you the ad (for example Meta or Google) so it can measure and improve our ads; otherwise ad networks are told they may not use it for advertising, and AppsFlyer keeps that iPhone data only in anonymous totals. AppsFlyer is based in Israel.
• Authorities: where required by law, e.g. tax or law enforcement requests.

These providers act as data processors on our behalf under data processing agreements, except where they are independent controllers (e.g. villa owners, payment networks, authorities). We do not sell personal data.

5. International transfers

Villa owners are located in Indonesia, so booking details necessary for your stay are transferred there in order to perform your contract (GDPR art. 49(1)(b)). Some of our service providers process data in the United States or other countries outside the EEA; where they do, transfers are protected by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. AppsFlyer (section 4) is based in Israel, which the European Commission recognises as providing an adequate level of protection.

6. How long we keep data

• Account data: for as long as your account is active, and up to 12 months after deletion for fraud prevention and dispute handling.
• Booking and payment records: 5 years after the end of the financial year, as required by the Danish Bookkeeping Act.
• Technical logs: up to 12 months.
• Advertising measurement data: held by AppsFlyer under our data processing agreement. Records about your device are deleted on AppsFlyer's schedule, which depends on the ad network involved; anonymous totals are kept for up to 25 months. If you ask us to delete your data (section 7), we pass the request on to AppsFlyer.
• Marketing consents and related data: until you withdraw consent.

7. Your rights

Under the GDPR you have the right to access, rectify and erase your data; to restrict or object to processing; to data portability; and to withdraw consent at any time (without affecting processing before withdrawal). To exercise any right, email support@bumpr.rent or message +45 31 70 17 50 on WhatsApp from the number on your account. We respond within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk) or your local supervisory authority.

8. Deleting your account

In the app: open Profile, then Account settings, then Delete account. Your profile, email, phone number and login are removed immediately. Saved cards are revoked at our payment provider.

Without the app: email support@bumpr.rent from the address on your account with the subject "Delete my account", or message our support line on WhatsApp at +45 31 70 17 50 from the phone number on your account. We confirm within 7 days and delete within 30. We may ask you to confirm from that address or number before we act.

What we keep, and why: booking and payment records for 5 years after the end of the financial year, as the Danish Bookkeeping Act requires, with your name and contact details removed from them. Nothing else is kept beyond the periods in section 6. Deletion is refused only while you are checked in to a villa, or while a guest is staying in a villa you host; it is available again the day after check-out.

9. Cookies and analytics

The website sets strictly necessary cookies only — the session cookies that keep you signed in. It sets no analytics or marketing cookies, and it does not build a profile of your browsing. Because nothing is set that requires consent, there is no cookie banner to accept or reject. The app sets no cookies. It contains a crash reporter (Sentry, see section 4), which sends a technical report only when something goes wrong, and one measurement tool, AppsFlyer (see section 4), which records how you came to install the app and the four actions listed there. On iPhone, Apple asks whether Bumpr may track you; if you choose “Ask App Not to Track”, your advertising identifier is never collected and installs are matched to ads only through Apple's anonymous SKAdNetwork reports. You can change that answer at any time in Settings, then Privacy & Security, then Tracking. On Android, the app does not read your phone's advertising ID at all. Some features are provided by embedded third parties — the Airwallex payment sheet and the Mapbox map — which collect their own technical data when you use them, under their own privacy policies; see section 4.

10. Security

We protect personal data with technical and organisational measures including encryption in transit, access controls, and row-level security on our database. No system is perfectly secure; if a breach affects your rights, we will notify you and the supervisory authority as required by law.

11. Children

The Platform is not directed at children. You must be 18 or older to create an account, and we do not knowingly collect data from anyone under 18.

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be notified through the Platform or by email. The current version is always available on our website.

13. Contact

Bumpr ApS · CVR 46460960 · Denmark · support@bumpr.rent