Polityka prywatności

Version 1.0 · Last updated: 23 October 2026

This Privacy Policy explains how Zekorei Guest House (“we”, “us”, “our”) collects, uses, stores and protects personal data when you visit zekorei.amsiz.com (the “Website”), create an account, sign in with Google, request or manage a booking, or enable push notifications.

By using the Website you acknowledge this Policy. If you do not agree with it, please do not use the account, sign-in or notification features.

1. Who is responsible for your data

The data controller is Zekorei Guest House, a guest house located at 3 Mkurnali Street, 4600 Kutaisi, Georgia.

2. Personal data we collect

2.1. Account and sign-in data

To create and use an account we process your email address, first name, last name and phone number (the name and phone are optional and are filled in by you), the account creation date and your interface language.

When you sign in by email, we generate a one-time six-digit code. The pending sign-in record contains your email address, a hash of the code, its issue and expiry times, the number of attempts and a log of recent sends; the code itself is never stored. The record expires after 10 minutes. A successful sign-in creates a session that is stored on our server and linked to the zk_session cookie for 30 days.

2.2. Google Sign-In

If you choose “Continue with Google”, Google returns your Google account identifier, email address, email verification status, and basic profile information (such as your name and profile picture). We use and store only your verified email address and the Google account identifier; we do not store your profile picture, and we do not receive your Google password. We do not request or access Gmail, Google Drive, Google Calendar or any other Google service content.

We do not store Google access or refresh tokens: they are used once during sign-in and then discarded.

2.3. Booking data

When you request a booking we process the name, email address and phone number you provide, the guest account identifier (if you are signed in), check-in and check-out dates, the number of adults and children and their ages, the selected room and rate, the calculated price and currency, the cancellation policy, the time of the request, the booking status, and any other details you send us in connection with your stay.

We use your email address to send the booking confirmation and, if necessary, messages about your stay. Transactional emails are delivered through our email service provider.

2.4. Push notifications

If you enable push notifications, your browser creates a subscription that includes a push endpoint, public encryption keys, your browser and device user agent, the subscription language, its expiration time and timestamps. We use these data only to deliver the notifications you asked for.

2.5. Technical and security data

Our servers automatically process the IP address, user agent, requested URL, timestamps and similar technical information contained in standard web server logs. We also record security events such as failed sign-in attempts and rate-limit hits. This information is used to deliver the Website, keep it secure, prevent abuse and diagnose faults.

3. Cookies and similar technologies

We use a small number of strictly necessary cookies and no advertising or cross-site tracking cookies.

• zk_session — keeps you signed in. HttpOnly, Secure, SameSite=Lax, expires after 30 days.
• zk_auth — allows the Website to show whether you are signed in. Not HttpOnly, Secure, SameSite=Lax, expires after 30 days.
• zk_google_state — protects Google Sign-In against cross-site request forgery. HttpOnly, Secure, expires after 10 minutes.
• Cloudflare Turnstile — verifies that a sign-in request comes from a real browser and may set its own cookies or process your IP address and user agent for that purpose.

You can delete or block cookies in your browser settings. If you block the cookies above, signing in and managing bookings will not work.

For analytics we use a self-hosted Umami instance, which records page views, referrers and basic device information to produce usage statistics. It does not use advertising identifiers or build advertising profiles.

4. Why we use your data

• Providing your account and sign-in — to perform the service you requested and to keep your account secure.
• Processing bookings — to prepare, confirm and manage your stay, and to send related transactional emails.
• Push notifications — on the basis of your consent, which you can withdraw at any time in your browser or device settings.
• Security and abuse prevention — our legitimate interest in protecting the Website, our guests and our systems (rate limiting, fraud prevention, log analysis).
• Analytics and improvement — our legitimate interest in understanding how the Website is used, based on aggregated statistics.
• Legal obligations — when we are required to keep or disclose information by applicable law.

We do not use your personal data for automated decision-making that produces legal effects, and we do not send marketing emails without your separate consent.

5. When we share data

We do not sell your personal data and we do not share it for advertising. We share limited data only with service providers that help us operate the Website, and only as far as necessary:

• Google LLC — when you choose Google Sign-In, authentication is performed by Google under Google’s own privacy policy.
• Brevo — our transactional email provider, which delivers sign-in codes and booking confirmations.
• Cloudflare — the Turnstile bot-protection service used on the sign-in form.
• Browser push services (for example Google, Mozilla, Apple or Microsoft) — to deliver notifications that you have enabled.
• Amsiz — provides the hosting and technical infrastructure for the Website.
• Telegram — if you use the on-site web chat, your messages are delivered through Telegram.
• Google Fonts and OpenStreetMap — web fonts and the embedded map are loaded from their servers, which receive your IP address. You can block them in your browser if you prefer.
• Public authorities — when disclosure is required by law or necessary to establish, exercise or defend legal claims.

6. International transfers

We are based in Georgia. Some of our service providers process data in the European Union, the United States or other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses and adequacy decisions, and we share only the data necessary for the relevant service.

7. How long we keep data

• One-time sign-in codes and pending sign-in records — 10 minutes.
• Google Sign-In state records — 10 minutes.
• Account sessions — 30 days from sign-in, without automatic extension.
• Account data — until you ask us to delete your account, unless a longer period is required for bookings or by law.
• Booking records — for as long as needed to provide your stay and to comply with accounting, tax and other legal requirements.
• Push subscriptions — until you disable notifications, the subscription expires, or the account is deleted.
• Server logs and security records — for a limited period necessary for security, troubleshooting and legal compliance.

8. How we protect your data

We use HTTPS, HttpOnly and Secure cookies, hashed one-time codes, rate limiting and restricted access to our systems. Google tokens are not stored. Only people who need the data to operate the guest house and the Website can access it. No method of transmission or storage is completely secure; if you believe your data has been compromised, please contact us immediately.

9. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data, including your account;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent for push notifications at any time;
• lodge a complaint with the Personal Data Protection Service of Georgia (pdps.ge) or with the supervisory authority in your country.

To exercise these rights, email zekorei@amsiz.com. We may ask you to confirm that you control the email address associated with the account. We respond within 30 days, or within the period required by law. Deleting your account does not automatically delete booking records that we must keep for legal or accounting purposes.

10. Children

The Website and the account features are intended for adults. We do not knowingly collect personal data from children under 18. If you believe that a child has provided us with personal data, please contact us and we will delete it.

11. Google API Services User Data Policy

Google user data is used only to authenticate you and to create or access your account on this Website. We do not sell Google user data, do not use it for advertising, do not use it to train generalized artificial intelligence or machine learning models, and do not allow humans to read it except where necessary for security, legal compliance or with your explicit consent.

12. Changes to this Policy

We may update this Policy from time to time. The current version is always published on this page with its version number and date. If a change materially affects your rights, we will additionally notify you by email or with a notice on the Website.

13. Contact us

Questions about this Policy or your personal data can be sent to zekorei@amsiz.com or by phone at +995 555 3160 22.

See also our Warunki korzystania z usługi.