Privacy policy: Stay Direct

Last updated: 15 October 2026 (retention details added)

This policy explains what data the Wix app “Stay Direct” (the app), published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we, us), processes when it is installed on a Wix site. It adds to the privacy policy for Kayabyte apps for Wix, which also applies.

What the app does

The app lets a site owner rent out properties (cabins, apartments, rooms) through a booking widget on their site. Guests choose dates and pay through the site’s Wix checkout.

Roles

The site owner is the controller for their guests’ data. Kayabyte acts as a processor that handles the data only to run the bookings the site owner offers. Wix.com Ltd. hosts the site, its checkout and its orders. Cloudflare, Inc. hosts the app’s booking service and its database and is a sub-processor.

Data the app stores

• Properties and settings the site owner enters: names, descriptions, photo links, prices, seasons and booking rules.

• Bookings: dates, number of guests, the guest’s name, email address, phone number (optional) and message to the host (optional), the price, deposit and balance, the booking status and the Wix order number.

• Calendars: links to the site owner’s other calendars (for example Airbnb or Booking.com) and the dates those calendars block, with the event name they give (such as “Reserved”).

• The site’s name, address, currency and time zone, read from Wix.

• Visitor key: while a checkout is held, a one-way keyed hash of the visitor’s network address, used only to limit how many stays one visitor can hold at once. It can’t be turned back into the address and is removed when the hold ends.

Data the app does not handle

Payments go through the site’s Wix checkout. We never receive card or bank details. The booking widget shows visitors only which nights are free, never who booked.

Logs

The booking service writes technical log lines (the app instance ID, the request path, the outcome and, for errors, a short message). Logs contain no guest names or contact details and are kept by Cloudflare for a short time.

Retention and deletion

• Checkouts that were never paid are deleted 30 days after they lapse.
• Guest names, emails, phone numbers and messages on past stays are erased two years after check-out. The dates and amounts stay, so the site owner keeps a record.
• When the app is removed from a site, all of that site’s data (properties, bookings, calendar links and blocked dates) is deleted right away, and at the latest within 30 days. Site owners can ask for earlier deletion, or deletion of a single guest’s data, at support@kayabyte.dev.

Cookies, tracking and third parties

The app sets no cookies on the site and uses no analytics, advertising or tracking services. Data is shared only with Wix and Cloudflare, as described above. The app fetches the calendar links the site owner adds, from the services that host them.

Your rights

Guests should contact the site owner about their booking data. For questions about this policy, or to exercise rights under the GDPR, contact support@kayabyte.dev.

Changes

We will update this page if the app’s data handling changes. The date at the top shows the latest version.