Privacy Policy

Who controls your information

Stay Near Universal UK is an independent accommodation directory operated by Stay Near Universal. Stay Near Universal is the data controller for the personal information described in this policy. For privacy questions or to exercise your rights, contact us through staynearuniversal.uk/contact.

Accommodation providers are separate controllers for enquiries and booking-related information they receive through a listing. Their own privacy information applies to what they do after receiving it.

What we collect and where it comes from

• Account information: name, email address, company or trading name, account type, password hash, verification and login records, and account preferences.
• Listing information: property and contact details, descriptions, photographs, amenities, addresses, coordinates, availability information and provider details. Information selected for publication is visible to anyone.
• Enquiries and support: names, email addresses, phone numbers, stay requirements, message content, support correspondence and related moderation or delivery records.
• Payments and subscriptions: order, package, coupon, invoice, refund and subscription references, billing contact information, transaction status and limited payment metadata. We do not store full payment-card details.
• Newsletter information: email address, consent time, signup source, IP address, browser information, subscription status and unsubscribe record.
• Future provider-interest information: email address and, where supplied, name, business or property name, location and notes, together with consent, confirmation-delivery and unsubscribe records. This is stored as a dedicated list separate from newsletters, listing alerts, accounts and other marketing lists.
• Listing alert information: email address, selected property type and distance, consent time, signup source, subscription status and unsubscribe record.
• Browser-only property choices: saved and comparison properties are kept in local storage when you use those features. Recently viewed properties are recorded automatically in session storage for the current tab. Shareable shortlist links contain public listing details but no account information.
• Technical, security and usage information: IP address or a derived hash, session or visitor identifier, request path, search terms and filters, referrer, browser, device and operating system, approximate country, region or city, cookie choice, timestamps, page activity and security events.

We receive information directly from you, automatically from your browser or device, from a signed-in account, and from providers involved in the service such as Stripe, Cloudflare and Google Analytics. A listing owner may also supply information about authorised staff or a property they manage.

Why we use it and our legal bases

Where we rely on legitimate interests, those interests are service delivery and improvement, security, fraud prevention, administration, customer support, and the protection of our users and legal rights. We balance those interests against the effect on you and limit the information used.

Account audit

We record sign-in and session events, account and listing changes, action requests and service outcomes to secure accounts, diagnose faults, provide support and resolve disputes. This operational audit uses our legitimate interests in a safe and reliable service. It records account identifiers, timestamps, action types, affected record identifiers and outcomes, with request references and broad browser/device families at sign-in. It does not copy passwords, security tokens, card details, form contents or message bodies into this audit.

This audit does not build an identified browsing or page-view history. Routine audit events are retained for 365 days. Authorised administrators can view and export these records; their audit access is recorded. You can request access, correction, restriction, objection or erasure through our contact page, subject to applicable legal exceptions. Separate payment and security records have their own retention rules below.

Analytics and cookies

Our first-party server analytics may record page paths, searches and filters, listing views, referrers, browser and device type, approximate location supplied by our network provider, timestamps, signed-in user ID, and shortened, hashed or full IP information depending on your account and cookie choice. Before optional analytics consent, guest activity is measured using a short-lived rotating hash rather than a persistent analytics identifier, and detailed guest fields are limited. This information is used for aggregate statistics, service improvement, fraud prevention and operational monitoring.

Optional browser behaviour events, such as saving or comparing listings, are collected only after analytics consent. Essential error diagnostics use a session identifier without consent; the persistent stay_journey cookie is used only with consent. If Google Analytics is configured, its script loads only after you accept analytics. We configure it with advertising signals and ad personalisation disabled and request IP anonymisation. Google may still receive online identifiers, IP and device information, and information about pages and interactions. You can reject or later withdraw consent without losing access to the site.

Strictly necessary cookies and storage support sessions, security, forms, your privacy choice, and browser-only saved, recent and comparison property features that you choose to use. Cloudflare Turnstile may process device, network and interaction information to detect automated abuse. See our Cookie Policy to review or change your choice.

Payments

Stripe may process card details, billing information, transaction identifiers, device and fraud-prevention information for payments, invoices, refunds and subscription management. Full card details are entered into Stripe's systems rather than stored by us. Stripe acts as a processor or independent controller depending on the activity described in its own privacy information.

Who receives information

• the accommodation provider you choose to contact;
• hosting, database, backup, email delivery and technical-support providers;
• Stripe for payment and subscription services;
• Cloudflare for network security and Turnstile checks;
• Meta for consented advertising measurement as described below;
• Google for consented Google Analytics, and Mapbox where map or geocoding features are used;
• professional advisers, insurers, auditors, regulators, courts, law enforcement or public authorities where reasonably necessary or legally required; and
• a buyer, investor or successor if the service or business is reorganised, sold or transferred, subject to appropriate confidentiality protections.

We do not sell your personal information. Public listing information is intentionally published and may be indexed by search engines or shared by visitors.

International transfers

Some providers may process information outside the UK or European Economic Area. Where data protection law requires safeguards, we use a relevant adequacy decision or contractual measures such as the UK International Data Transfer Agreement or UK Addendum and, where EU GDPR applies, the European Commission's Standard Contractual Clauses. You may contact us for information about the safeguard relevant to your data.

How long we keep information

• Analytics events: up to 365 days under the site's current retention setting. Google Analytics data follows the retention configured with Google.
• Accounts and listings: while active and afterwards for as long as needed to handle restoration, moderation, disputes, fraud prevention or legal claims.
• Checkout acceptance and dispute evidence: we keep dated records of the payment terms accepted, the account and relevant payment, cancellation and service events to administer contracts and resolve payment disputes. These are separate from short-lived diagnostic logs and remain linked to an archived account. We review retention and handle requests for erasure individually, retaining only what remains necessary for accounting obligations or legal claims.
• Closed accounts: closing an account disables access, removes listings from public view and stops future subscription billing. The account is archived for administrator review rather than immediately erased. To request erasure of personal information, contact us using the details below.
• Orders, invoices and payment records: generally six years after the relevant financial period or transaction where needed for UK tax, accounting and legal records.
• Enquiries, support and security records: for as long as needed to deliver the service, protect users, enforce rules and resolve disputes; blocked or quarantined material may be retained for a limited fraud-prevention period.
• Newsletter records: while subscribed. After unsubscribing, we may keep the minimum information needed to prove consent and honour the opt-out.
• Future provider-interest records: while subscribed and until the visitor accommodation phase is ready. After unsubscribing, we keep only what is reasonably needed to demonstrate consent and honour the separate opt-out.
• Cookie choices: the browser choice normally lasts up to 180 days; a consent record may be retained longer where reasonably needed to demonstrate compliance.

We may keep information longer where law requires it, a dispute or investigation is active, or a legal claim could arise. We securely delete or anonymise information when it is no longer required.

Your data protection rights

Subject to the conditions in applicable UK or EU data protection law, you may ask us to give you access to your personal information, correct it, erase it, restrict its use, or provide it in a portable format. You may withdraw consent at any time without affecting processing that was lawful before withdrawal. You are not normally required to pay a fee, and we normally respond within one month after verifying the request. Some rights do not apply in every circumstance, including where records must be kept by law.

To exercise a right, use our contact page. You may complain to the UK Information Commissioner's Office. If EU GDPR applies to you, you may also complain to the data protection authority where you live, work, or believe an infringement occurred.

Your right to object

You may object at any time to our use of your personal information based on legitimate interests. We will stop unless we demonstrate compelling legitimate grounds or need the information for legal claims. Your right to object to direct marketing is absolute: if you object or unsubscribe, we will stop using your information for that marketing.

Customer accounts and contractor requests

Customer accounts store your contact preferences, saved properties, accommodation requests, quotes and conversations. When you submit a quote request, we share your brief, contact name and any company name you supply with matching providers who have opted in. Your account email and phone number are not automatically included in the brief. Avoid including information in the notes that you do not want those providers to receive.

Matching uses accommodation requirements such as dates, bed capacity, parking and facilities. It does not confirm availability or a booking. Each provider can see their own quote and conversation, not competing providers’ quotes or messages. We send account notifications to your verified email. Administrators can review requests reported as inappropriate and close requests where necessary.

Automated decisions and children

We do not make solely automated decisions that produce legal or similarly significant effects for users. Automated security or moderation signals may flag activity for restriction or human review. The service is not directed at children, and provider accounts and paid services are intended for people aged 18 or over.

Meta advertising measurement and future Google AdSense

Only after you accept marketing cookies, we use the Meta pixel to measure selected public page visits, successful email/password account registrations (distinguishing property owners and accommodation seekers) and accommodation enquiries saved for providers. Our lawful basis for this optional processing is consent. Analytics consent alone does not enable Meta. You can reject marketing or withdraw consent at any time through Review cookie choice on our Cookie Policy, without losing access to the website.

Meta receives event information, page URLs, browser/device information, IP address and cookie/ad-click identifiers. Meta may match this activity to your Facebook or Instagram account for advertising measurement, optimisation and personalised advertising. We do not supply names, email addresses, telephone numbers, account IDs or enquiry contents in our pixel events. We disable automatic event configuration and do not supply advanced matching data.

Meta Platforms Ireland Limited is a recipient of this data. Meta may process it internationally, including in the United States, under the safeguards and retention arrangements described in Meta’s Privacy Policy. First-party Meta identifiers typically last up to 90 days; our marketing preference lasts up to 180 days. Withdrawing consent stops future pixel activity but does not recall data already received by Meta.

We do not currently serve Google AdSense advertising. We may introduce advertising in the future, but this policy is not consent to advertising cookies or personalised advertising. Before enabling AdSense, we will update this policy and the Cookie Policy, identify the advertising partners and purposes in use, and provide the required controls.

If AdSense is enabled, Google and other approved advertising vendors may use cookies, web beacons, IP addresses and other identifiers to deliver, limit, measure and personalise ads, subject to your choices and applicable law. For users in the UK, EEA and Switzerland, we will use a Google-certified consent management platform where required and will not request personalised ads unless the necessary consent has been given. Google's use of information from partner sites is explained in Google's partner-sites privacy information.

Changes to this policy

We may update this policy when the website, providers, legal requirements or our use of information changes. We will post the revised policy here, change the date above and provide a more prominent notice where a change materially affects your rights or choices.