How we handle your information.

bayn is operated from Portugal by Rami Rmeileh and Bahaa Rizik, who are the data controllers for the information described here. For our postal address, write to contact@bayncom.io and we will give it to you. You can reach us at contact@bayncom.io.

• When you apply to the waiting list: your name, email address, phone number, the place you are based, what you would like to use bayn for, whether you want to join the WhatsApp community.
• Your password, when you join as a member.
• Your date of birth. bayn is for adults because members stay in each other’s homes, so we ask once, check that you are 18 or over, and never show your age to anyone.
• Your profile details: your photo, where you are based, the languages you speak, what you do, what you are into, and a short bio. All of that is yours to fill in or leave empty, and other members see it.
• Listings you publish, requests and messages you send, and homes you save.
• Who invited you, so connections in the community stay clear.
• References and stay notes members write about each other — who wrote it, who it is about, how they know one another, and what they said.
• Reports you make or that are made about you, anything sent in to support one, and what we decided. Why we keep these is in reporting and moderation.
• Your membership: what you have chosen to pay, free time you have earned from invitations, and whether a subscription is running. If we ever take payment it is handled by a payment provider and we do not need or keep your card number.
• The technical records any website keeps: your IP address, your browser or device, when you signed in, and security events such as a failed sign in. We use these to keep accounts from being broken into, not to build a picture of you.

bayn never asks an ordinary member about their religion, their politics, their sexuality, their health or anything else the law treats as special. None of it is required to have an account.

But people do volunteer it — in a bio, in a message, in a request for help, or in a report about something that happened to them. If you would rather something was not visible to other members, do not put it in your profile or a listing. If a feature ever needs this kind of information to work, we will ask for your explicit consent before we build it, not afterwards.

• To show your listings, requests and messages to the members they are meant for.
• To let members see who invited whom, which is how trust works here.
• To send you the emails the service needs, such as sign in and replies.
• To review applications to the waiting list personally.
• To look into reports, to keep scams and abuse off bayn, and to keep accounts from being broken into. Here we rely on our legitimate interest in a community that is safe to be part of, and sometimes on a legal obligation.
• To keep the accounting records the law requires, if we take payment.

For the waiting list, we rely on your consent: you chose to apply, and you can withdraw at any time by asking us to delete your application. For members, we rely on the contract between us, because we cannot run the service without this information. Where we contact you with announcements, that is consent too, and every such email carries an unsubscribe link.

We keep an application for as long as it is under consideration. If we decide not to offer you a place, we delete the application within twelve months unless you ask us to keep you in mind for longer. Member information is kept while your account is open and removed when you close it. Ask us at any time and we will delete yours sooner.

Two things outlive an account on purpose. Where we have removed somebody for something serious, we keep enough of the record to recognise them if they come back, and to defend the decision if we are asked to. And where the law sets a period — accounting and tax records, or something we have been ordered to preserve — we keep it for that period and no longer. Deleted information can also sit in a backup for a while before it is overwritten.

• We do not sell your information.
• We do not run advertising on bayn.
• We do not claim to verify, vet or screen anyone. Trust here comes from personal invitations, references and stay notes, not from a badge.

Your listings, public profile and city guides are visible to other members. Your email, waiting list application and private messages are not shown to other members. The bayn team can see what it needs to run the community and review applications.

Private messages are not public content and we do not read them as a matter of course. Someone at bayn may look at a message or something else private where it is genuinely necessary: to look into a report, to answer something you have asked us for help with, to stop fraud or a serious misuse of the platform, to keep bayn secure, or because the law requires it. We look at as little as the question needs.

These companies process your information on our behalf, and only on our instructions:

• Supabase — our database, where applications and member accounts are stored.
• Vercel — hosting, which serves this website and processes the requests your browser makes.
• Resend — our email provider, which delivers the emails we send you.

Some of these are based in, or store data in, the United States. Where information leaves the European Economic Area it is transferred under the European Commission’s standard contractual clauses.

When you type in the “where are you based” box, your browser asks OpenStreetMap for matching places. That request comes from your device, so OpenStreetMap sees your IP address and what you typed. It is not sent by us and we receive nothing back about you. You can avoid it by typing your city and not waiting for suggestions.

Anything about your information — a copy of it, a correction, a deletion, or a question about this page — goes to privacy@bayncom.io, which reaches the people who can actually do it.

bayn has no data protection officer. One is required of public authorities, of services that monitor people on a large scale, and of those handling special category data at scale; bayn is none of those, and naming someone in a role they do not hold would tell you something untrue about how your data is looked after. The day it is required, the person will be named here.

bayn needs no European representative either. That obligation is for controllers established outside the EU, and bayn is operated from Portugal.

Under the GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, and ask for it in a portable form. Where we rely on your consent you can withdraw it at any time, which does not affect anything we did before you withdrew it. Members can edit their profile from their account; for anything else write to contact@bayncom.io and we will do it. We answer within one month.

If you think we have handled your information badly, you can complain to the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection authority, or to the authority where you live.

There is no cookie banner here because there is nothing to ask you about. bayn runs no analytics, no advertising and no session recording, and sets nothing on your device to follow you anywhere.

Signing in does store one thing: a cookie that holds your session, so that you stay signed in from one page to the next. It is strictly necessary to work at all — without it you would be signed out on every click — which is exactly the kind the law says needs no consent. It lasts until you sign out or it expires, and nobody else can read it.

Reading the public pages or applying to the waiting list stores nothing. If we ever wanted a cookie for something other than keeping you signed in, we would ask you first, and you would be able to say no and carry on using bayn.

Questions about privacy go to privacy@bayncom.io, or through the contact page if you would rather.