quartavo

Privacy policy

Last updated: 10/06/2026

This English version is a translation for your information. Only the German version is legally binding.

1. Who is responsible

The controller for the processing of your data on the Quartavo platform — website and app — is:

Steven Bohm Media Solutions
Detmolder Str. 317, 33175 Bad Lippspringe, Germany
Email: hallo@quartavo.com

For any question about data protection and to exercise your rights (section 21), an email to this address is enough.

2. The essentials

  • We process your data to broker accommodation: account, listings, bookings, payments, messages. On top of that come legal obligations, above all under tax law.
  • We use no analytics, advertising or tracking tools and do not sell data. There is no third-party advertising on Quartavo; we send reminders about your search only if you switch them on (section 14).
  • Guest and host see of each other only what the booking needs. The exact address and phone number are released only once a booking is confirmed and paid.
  • Some service providers are located outside the EU (payments, push notifications, maps). Which ones, and how the transfer is safeguarded, is set out in sections 17 and 18.
  • You can delete your account yourself at any time (section 20). What we have to keep for legal reasons is stated there precisely.

3. Visiting the website and the app

When you open Quartavo, our server processes technically necessary data: your IP address, date and time, the address requested, the browser or app version and the operating system. This is needed to deliver the page and to detect attacks.

  • Server: The platform runs on a server of Server4You GmbH in Germany. Email and real-time connections (e.g. new messages without reloading) also run on this server, not on third-party services.
  • Error logs contain the IP address only where it is needed to trace an error, and are deleted after 14 days.
  • Session: While you are signed in, we store your IP address and browser identifier with your session, so that we can detect a hijacked session. The session ends two hours after the last activity and is then deleted.
  • Abuse protection: We count failed sign-in attempts per email address and IP address for a few minutes to slow down password guessing.
  • Country from the IP address: To suggest the right currency, we derive the country from your IP address. This is done with a database on our own server (GeoLite2 by MaxMind); nothing is sent to MaxMind. We store only the country, not the IP address.

The legal basis is our legitimate interest in secure and working operation (Art. 6(1)(f) GDPR).

4. Cookies and storage on your device

We use only strictly necessary cookies:

  • a session cookie that keeps you signed in (it ends with the session),
  • a security cookie against forged requests (CSRF),
  • a cookie that keeps you signed in after you close the browser — only if you choose "Remember me" when signing in; it ends when you sign out, after 400 days at the latest.

In your browser's local storage we also keep only what you set or trigger yourself:

  • whether the notification sound is on,
  • when you closed the hint about our app, so that it does not reappear for 30 days.

Because there is nothing else, we do not ask for consent either — there is no cookie banner. The app stores your sign-in encrypted in the device's secure storage.

The legal basis is Section 25(2) no. 2 TDDDG (strictly necessary) and Art. 6(1)(f) GDPR. We set no statistics or marketing cookies, and no third-party service sets cookies through our pages.

5. Account and sign-in

For an account we need your name, email address and a password. We store the password only as a hash, never in plain text. We also store language, time zone and currency, your notification settings, and which edition of the Terms of Use you accepted or rejected, and when.

  • Second factor: A second factor is required for bookings, listings and payments — a code from an authenticator app or a passkey. We store the authenticator secret and the recovery codes encrypted. A passkey stays on your device or in your password manager (iCloud Keychain, Google Password Manager); we store only its public part.
  • Confirmation codes sent by email (sign-in, forgotten password) are valid for 10 to 15 minutes and stored only as a hash.
  • Signed-in devices: For each app sign-in we store the device name and when it was last used. The sign-in lasts until you sign out or end it in the settings.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR), and Art. 32 GDPR for the security measures.

6. Profile and what others see

You may add a profile picture, a text about yourself, where you live, your occupation, languages, interests and a dream destination. We store profile pictures without embedded metadata such as the location where they were taken.

Publicly visible on your profile — also without signing in — are: your name, profile picture, your voluntary details, badges (e.g. "identity verified"), reviews you have received, your published listings, and the provider identification if you let commercially (section 8). The countries in which you have stayed through Quartavo appear on the profile only if you switch this on in the privacy settings; it is off by default.

Reviews appear with your name and profile picture. So that neither side can react to the other, both reviews of a booking become visible only once both have been submitted or 14 days after departure have passed.

If you share a wishlist by link, the recipient sees only your first name.

The legal basis is the user agreement (Art. 6(1)(b) GDPR): profiles and reviews are at the core of a platform on which strangers must trust each other.

7. Identity verification

Before you can book or let, we verify your identity. To do so, you upload a photo or scan of your identity card, passport or driving licence.

  • Until the check, the document is stored encrypted and can be viewed only by the few staff members with verification rights. Other users see only that your identity is verified.
  • As soon as the check is decided, we delete the image. If we reject a document, we delete everything. If we confirm it, we keep only the result (verified, with which kind of document, when and by whom) and your date of birth (encrypted). We need the date of birth in case you let: it is one of the details we must have checked for the tax report (section 11).
  • Before uploading, please black out any details we do not need for the check — in particular the six-digit card access number (CAN) of a German identity card, as well as the document number, height and eye colour. We point this out during the upload as well.

The legal basis is the user agreement (Art. 6(1)(b) GDPR) and our legitimate interest in preventing fraud and fake identities (Art. 6(1)(f) GDPR); for hosts also the obligation to verify their identity for the tax report (Art. 6(1)(c) GDPR in conjunction with the German Platform Tax Transparency Act, PStTG). You upload a German identity card with your consent within the meaning of Section 20(2) PAuswG.

8. Listings and hosts

  • Address and location: We derive the coordinates from the address of your property. For this, our server sends the address to the Nominatim geocoding service of the OpenStreetMap Foundation (United Kingdom). Publicly we show only an approximate location (shifted by around 1.3 km). A guest receives the exact address and location only once their booking is confirmed and paid.
  • Photos: On upload we remove embedded metadata such as the location.
  • Provider identification: If you let commercially, the listing and your profile publicly show the legally required details (name or company, address, email, phone, register, VAT ID; Section 5 DDG, Art. 30 DSA).
  • Registration number: Where a municipality requires a registration number for short-term rentals, we store and show it (section 11).
  • Translation: Title, description, house rules and exchange terms may be translated automatically into other languages (section 12).
  • Search engines: Whether a listing may be found by search engines is set per listing in the privacy settings.

The legal basis is the user agreement (Art. 6(1)(b) GDPR), and the legal obligation (Art. 6(1)(c) GDPR) for the provider identification.

9. Bookings

For a booking we process the property, dates, number of guests, price and payment status, and for an exchange booking the agreed exchange terms. Before your first booking we ask once for your country of residence and keep it on your account (not public, changeable in your profile) — we have to report it to the authority with stays in areas with a registration requirement (section 11).

  • What the host sees: your name, your profile picture, whether your identity is verified, how many stays you have had, and the names of your fellow travellers.
  • Fellow travellers: If you add fellow travellers, we store their first and last names. If you give an email address and the person has an account, we link them to the booking. You confirm that you may provide these details and inform the fellow travellers of this privacy policy (§ 6 (5) of the terms); we do not contact them ourselves (Art. 14(5)(b) GDPR).
  • Once confirmed and paid, guest and host receive each other's phone number (if provided), and the guest also receives the exact address.
  • Automatic deadlines: An unpaid or unanswered request lapses automatically after the period stated in the Terms of Use.

The legal basis is the user agreement with us and the preparation and performance of the contract between guest and host (Art. 6(1)(b) GDPR).

10. Payments and payouts

We process payments through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland).

  • Guests: For the payment we send Stripe your name, email address, amount, currency and a booking reference. You enter card details directly with Stripe; we never see them. If you save a payment method for later in the payment sheet, it is held by Stripe. Stripe tells us the country of your billing address and the country that issued the card.
  • Hosts: For payouts you set up a payout account through Stripe (Stripe Connect). Stripe verifies your identity and bank details under anti-money-laundering rules as a controller in its own right; we send only your email address and whether you act privately or commercially. If you owe us money that cannot be set off against a payout, you receive an invoice through Stripe (name, email address, amount).
  • Fraud prevention: Stripe screens payments for fraud and also uses device and connection characteristics for this. It does so as a controller in its own right (https://stripe.com/privacy).
  • With us we store amount, status, refunds and, for each payment, the country of the billing address, the country that issued the card and the country derived from the IP address (not the IP address itself), as evidence for the VAT treatment.

Stripe also processes data in the USA (section 18). The legal basis is the user agreement (Art. 6(1)(b) GDPR), and the tax obligations (Art. 6(1)(c) GDPR) for the evidence and its retention.

11. Tax and regulatory obligations

  • Reporting host income (DAC7): As a platform operator we must report hosts' income annually to the German Federal Central Tax Office (BZSt). For this we collect from hosts their name, address, date of birth, tax identification number, VAT ID and commercial register number where applicable, the IBAN and, per property, its address, land register or registration number, income, fees withheld and number of nights. We store the tax ID and IBAN encrypted. If the details are still missing after two reminders, we must withhold payouts until they are provided. The basis is the PStTG; we keep these details for ten years after the end of the reporting period. Hosts tax resident outside the EU (for example in Switzerland) are reported only for their properties in the EU. A host who only offers properties outside the EU is not reported — we then do not ask for a tax ID or IBAN.
  • VAT ID check: If a host provides a VAT ID, we check it with the European Commission's VAT Information Exchange System (VIES) and with the BZSt — in the qualified check together with company name and address. The result determines how we tax our fee.
  • Short-term rentals (Regulation (EU) 2024/1028): For stays at properties in areas with a registration requirement, after check-out we send the competent authority, through the member state's single digital entry point (in Germany at the Bundesnetzagentur), per stay: the property's address and registration number, the link to the listing, check-in and check-out, the number of guests and the booker's country of residence ("unknown" for fellow travellers) — without names. If a reported stay changes or is cancelled, we report that as well. We keep a record of what we sent for as long as the related booking records.
  • Retention: We keep invoices, payment and booking records as required by commercial and tax law (Section 147 AO, Section 257 HGB, Section 14b UStG), up to ten years depending on the record.
  • Requests from authorities: On a legally founded order (e.g. under Art. 10 DSA or the Code of Criminal Procedure) we disclose data to courts and authorities, and only the data ordered.

The legal basis in each case is the legal obligation (Art. 6(1)(c) GDPR).

12. Messages, support and translation

  • Messages: Guests, hosts and fellow travellers can write to each other, also in groups. We store messages so that both sides keep their history — until three years after the end of the year in which the stay ended (or the last message was written, if that was later), that is for as long as claims from the booking may still arise; then we delete the history. Chats with support are likewise deleted three years after the end of the year in which they were closed. Images in messages are stored without metadata and encrypted, and deleted after 90 days unless they are part of a report (section 13).
  • Support: If you write to us through the help centre or by email, we store your email address, the subject, the message and attachments (encrypted). We pre-sort the urgency of a request automatically by keywords; it is always handled by a person. We delete requests three years after they are closed.
  • Automatic translation: If you speak a different language from the other side, we translate messages, support requests and listing texts by machine. For this we send the text — without names or contact details — to DeepL SE (Maarweg 165, 50825 Cologne, Germany) or to translation software we run ourselves (LibreTranslate). You can show the original text at any time.

The legal basis is the user agreement (Art. 6(1)(b) GDPR) and our legitimate interest in guests and hosts understanding each other and in requests being answered quickly (Art. 6(1)(f) GDPR).

13. Reports, moderation and blocking

Anyone can report messages, listings and reviews that break the law or our Terms of Use (Art. 16 DSA).

  • What we secure: When a message is reported, we freeze the reported message and up to ten messages before and after it (with senders), so that we can judge the context. We keep reported images for 90 days, and for 180 days where violence, sexual content or danger to children is suspected.
  • Decision: A person decides on a report. The person concerned receives a statement of reasons and can appeal (Art. 17, 20 DSA). Access to the secured content is logged.
  • Retention: We delete reports and secured content two years after the decision, so that repeated misuse can be recognised (Art. 23 DSA).
  • Blocking: If you block someone, we store this so that they can no longer write to you.

The legal basis is the legal obligation under the DSA (Art. 6(1)(c) GDPR) and our legitimate interest in a safe platform (Art. 6(1)(f) GDPR).

14. Notifications

We notify you by email, in the app and by push notification about bookings, payments, messages, support requests and the verification of your identity. You choose in the settings which channels you want for which kind of notification.

  • Push notifications are sent only if you have allowed them on your device. For this we store a device token and send it, together with the title and text of the notification — for chat messages the sender's name and the beginning of the message — to Firebase Cloud Messaging (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), and on iPhones also to Apple's push service (Apple Distribution International Ltd., Ireland). Both also process data in the USA (section 18). We do not use Firebase Analytics.
  • Notifications in your account are deleted after twelve months.
  • Reminders about your search are advertising and are sent only with your consent: they are switched off until you switch them on in the settings under "Reminders about your search". We then remind you once the next day of a place you searched for without booking (in the app and, if you wish, by push). We keep when you switched them on and off as proof for three years beyond the withdrawal. You can switch them off again at any time; this does not affect what was sent until then.

The legal basis is the user agreement (Art. 6(1)(b) GDPR), your permission on the device for push notifications, and your consent (Art. 6(1)(a) GDPR) for the reminders about your search.

15. Search, maps and location

  • Search history: We store your searches (place, dates, guests, filters) with your account or — without signing in — with your session, to show you your recent searches and to send the reminders from section 14. We delete them after 180 days and with your account.
  • "Near me": Only if you tap it on the website and allow it in your browser does the browser request your location. We use it for that one search and do not store it. The app does not request your location.
  • Maps on the website: Your browser loads map tiles directly from the servers of the OpenStreetMap Foundation (United Kingdom), which receives your IP address. On listing pages the map loads only when you open it.
  • Maps in the app: On iPhone the app shows the approximate location with Apple Maps; Apple receives the coordinates of the map section. On Android and in the search map view, the app loads the map tiles from OpenStreetMap; the map software itself is part of the app.
  • Place names for the map: To show the name of a map section, our server asks Nominatim for it — with the coordinates, without your IP address.

The legal basis is the user agreement (Art. 6(1)(b) GDPR), your consent (Art. 6(1)(a) GDPR) for the location request, and our legitimate interest (Art. 6(1)(f) GDPR) for the search history. For the United Kingdom there is an adequacy decision of the European Commission.

16. Change log for security

We log changes to accounts, listings, bookings, payments, tax details and identity checks: what was changed (old and new value), when, by whom, from which IP address and with which browser. Passwords, two-factor secrets, tax ID, IBAN and the date of birth from the ID check are excluded. The log cannot be altered afterwards.

We need it to investigate misuse and account takeovers and to demonstrate that we process data properly (Art. 5(2), Art. 32 GDPR). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR), and for bookings and payments also the tax-law obligation to keep records traceable (Art. 6(1)(c) GDPR). We delete entries after three years; entries on bookings, payments and billing are kept as long as the related records must be retained.

17. Recipients

Only the staff who need your data for their task can see it. Beyond that, data is received by:

Recipient Purpose Location
Server4You GmbH Server, email (processor) Germany
Stripe Payments Europe, Ltd. Payments, payout accounts, invoices to hosts Ireland, also USA
Google Ireland Limited (Firebase Cloud Messaging) Push notifications Ireland, also USA
Apple Distribution International Ltd. Push notifications and maps on iPhones Ireland, also USA
DeepL SE Automatic translation Germany
OpenStreetMap Foundation Coordinates for addresses, map tiles United Kingdom
German Federal Central Tax Office (BZSt) DAC7 report, VAT ID check Germany
European Commission (VIES) VAT ID check Belgium
Short-term rental authorities (through the single digital entry point, in Germany the Bundesnetzagentur) Report per stay under Regulation (EU) 2024/1028 (section 11) EU
Guest or host What the booking needs (section 9) —

Stripe (for verifying hosts' identity and for fraud prevention), Apple and Google (as operators of the app stores from which you download the app) act as controllers in their own right. We do not sell data and do not pass it on for advertising.

18. Transfers outside the EU

Stripe, Google and Apple also process data in the USA. All three are certified under the EU-US Data Privacy Framework; to that extent the European Commission's adequacy decision of 10 July 2023 applies to the USA (Art. 45 GDPR). Standard contractual clauses of the European Commission have also been agreed (Art. 46(2)(c) GDPR). For the United Kingdom (OpenStreetMap Foundation) a separate adequacy decision applies.

19. How long we keep data

We delete data as soon as we no longer need it for its purpose and no retention obligation applies. At a glance:

Data Retention
Server error logs 14 days
Session with IP address and browser 2 hours after the last activity
Images in messages 90 days (up to 180 days if reported)
Search history 180 days, at the latest with the account
Data export for download 7 days
Notifications in your account 12 months
Reports and secured content 2 years after the decision
Messages 3 years after the end of the year in which the stay ended or the last message was written
Support requests 3 years after closing
Change log 3 years; for bookings and payments as long as the records
Image of the identity document until the check is decided
Account, profile, result of the ID check with date of birth until the account is deleted
Records of consents and objections 3 years after withdrawal or account deletion
DAC7 details 10 years after the end of the reporting period
Invoices, booking and payment records up to 10 years (Section 147 AO, Section 257 HGB)

20. Deleting your account

You can delete your account yourself at any time — in the app under Profile, on the website under Settings → Privacy. Your listings go offline immediately. The account remains for 30 days; if you sign in during this time, you can cancel the deletion. As long as a booking is running or upcoming or a payout is outstanding, deletion is not yet possible.

After 30 days we delete: name, email address, phone number, profile details and picture, identity documents, sign-in data, passkeys, devices, wishlists, search history, notifications, blocks, your provider identification, your listing photos (except one cover picture each, so that former guests recognise their booking) and your customer account with Stripe including saved payment methods.

Kept, because others have a legitimate interest in it or the law requires it:

  • reviews and message histories (the latter until their period ends, section 12), so that the other side keeps its booking history — your name is replaced there by "Gelöschter Nutzer" (deleted user);
  • invoices, booking and payment records and DAC7 details for the statutory retention period (section 19). Invoices carry the name and address that applied when they were issued; the law requires this;
  • support requests, reports, records of consent and the change log for the periods stated in section 19.

You can register again with the same email address. Details, and the way without access to your account, are at Delete account; you can have single pieces of data removed through Delete data.

21. Your rights

You have the right

  • to access your data (Art. 15 GDPR) — you can download a copy of your data yourself in the privacy settings,
  • to have incorrect data rectified (Art. 16),
  • to have data erased (Art. 17) or its processing restricted (Art. 18),
  • to receive or transfer your data in a common format (Art. 20),
  • to withdraw consent at any time with effect for the future (Art. 7(3)),
  • to lodge a complaint with a supervisory authority (Art. 77) — for example the authority competent for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can withdraw a consent — for example to the reminders about your search (section 14) — at any time without giving reasons (Art. 7(3) GDPR).

An email to hallo@quartavo.com is enough. We reply within one month.

22. Automated decisions

We make no decisions based solely on automated processing that significantly affect you (Art. 22 GDPR). Only processes whose rules are fixed and known to you run automatically: the lapse of unpaid requests, the assignment of your fee to a tax rule based on your place of establishment and VAT ID, and the legally required withholding of payouts when DAC7 details are missing despite two reminders (section 11). The order of search results is random or follows the sorting you choose.

23. Do you have to provide data?

Without a name, email address and identity verification we cannot offer you an account or a booking; hosts must also provide the DAC7 details because the law requires them. All profile details beyond your name are voluntary.

Only persons aged 18 or over may open an account and use Quartavo (§ 3 of the terms). We process data of fellow travellers, including children, only insofar as the person booking provides it (section 9).

24. Changes

If the platform or the law changes, we adapt this policy. The current version is always on this page, with the date it was last updated. The Terms of Use and the Legal notice apply in addition.