Privacy notice
Last updated: 8 October 2026.
Who we are
Gary O'Donoghue, trading as BurroHost ("we"), is responsible for the personal data described here. Contact: hello@burrohost.com. This notice covers burrohost.com (formerly burrohost.top), our sales and billing contacts, and our business customers' staff who use our tools. It does not cover the customers of our clients (for example a spa's guests): for them our client is responsible and we act as its processor.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email, phone, business name when you contact us | Reply, quote, set up services | Steps before a contract; legitimate interest |
| Business contact, billing address, invoices, payment status; card token held by Stripe (we never see card numbers) | Billing, tax and accounting records | Contract; legal obligation |
| Staff user names and emails for our booking, social and billing tools; login and security logs | Run and secure the service | Contract; legitimate interest |
| Technical logs (IP address, browser, pages) | Security and fault finding | Legitimate interest |
| Emails and messages you send us | Support and records | Contract; legitimate interest |
We do not sell personal data or use it for profiling. Any marketing email to business contacts is sent only where the law allows, with an unsubscribe link.
Who we share it with
Our sub-processors (see Sub-processors): Hetzner (hosting, Germany), Stripe and PayPal (payments), and Meta/WhatsApp where you message us there. Professional advisers and authorities where the law requires.
International transfers
Our systems are hosted in Germany. Stripe and PayPal may process data in the United States under standard contractual clauses.
How long we keep it
Enquiry and business contact data: 24 months after last contact. Invoices and billing records: 6 years after the end of the financial year. Security logs: 90 days.
Your rights
You can ask to access, correct, delete, restrict or export your data, object to its use, or withdraw consent, by emailing hello@burrohost.com. We reply within 30 days. You may complain to Ireland's Data Protection Commission (dataprotection.ie) or your local data protection authority, including in St Kitts and Nevis.
Cookies
burrohost.com sets no advertising or analytics cookies. We count visits anonymously with Umami, a self-hosted analytics tool. It uses no cookies and stores no personal data.
Security
HTTPS, access controls, a password vault and encrypted backups. If a breach affects you we will tell you, and the authority where required.
Changes
We post updates here with the date.