Privacy Policy
As of October 7, 20261. Controller
The controller responsible for data processing on Banaki is Kogge Digitalagentur, owner Morris Mehnert, Memellandstraße 2, 24537 Neumünster, moin@kogge.digital, +49 4321 7574160. Further details are given in the Imprint.
2. What data we process and why
We process your data to enable bookings between guests and hosts, to keep the platform running, and to meet our legal obligations. The following sections list every service we use, together with its purpose, legal basis and retention period.
3. Account data and bookings
When you register, we collect your name, e-mail address and the information required for a booking. The legal basis is performance of the usage contract with Banaki (Article 6(1)(b) GDPR). Account data remains stored for as long as your account exists, and is deleted afterwards in accordance with the retention periods under commercial and tax law.
4. Payment processing via Stripe
For payment processing we use Stripe Payments Europe, Ltd. (Dublin, Ireland). Stripe processes your payment data to settle the booking and to make payouts to hosts (Stripe Connect Express). The legal basis is performance of the contract (Article 6(1)(b) GDPR). Stripe sets its own cookies for fraud prevention; see the Cookie Policy.
5. Google Analytics
If you consent, Google Analytics (Google Ireland Limited) measures the use of banaki.app, so we can understand which regions and offers are in demand. The legal basis is your consent (Article 6(1)(a) GDPR, Section 25 TDDDG). Without consent, the service does not load. The data is stored for 24 months, and you can withdraw your consent at any time via "Cookie settings" in the footer.
6. Google Maps
Maps on listings and in search results are only loaded if you consent or actively click "Load map". The provider is Google Ireland Limited. The legal basis is your consent (Article 6(1)(a) GDPR). Without consent, the map remains replaced by a placeholder. Depending on the platform's settings, an OpenStreetMap map appears instead of the Google map; more on this in Section 8.
7. Google Places (location search)
When you type in the location search, we send your input to the Google Places API to show you matching location suggestions. No cookie is set in the process. The legal basis is our legitimate interest in a functioning search (Article 6(1)(f) GDPR), together with your deliberate input. This transmission does not fall under Section 25 TDDDG, because nothing is stored on your device. If the map runs on OpenStreetMap or Google does not respond, the location suggestions come instead from the Photon service via our server, see Section 9.
8. OpenStreetMap map
Banaki shows maps in search, on every listing and when a host sets the position while creating a listing. Depending on the platform's settings, the map comes from Google Maps or from OpenStreetMap data. There are three operating modes: Google only, Google with automatic fallback to OpenStreetMap (if Google does not respond), or OpenStreetMap only. Everything about Google Maps is in Section 6. This section covers the OpenStreetMap map.
What happens. The map library (MapLibre GL JS) sits on Banaki's server and is loaded from there. Your browser loads the map tiles directly from the OpenFreeMap tile server (tiles.openfreemap.org). In doing so, the provider technically has to receive your IP address, the requested map section, date and time, and the browser identifier (user agent).
OpenFreeMap is operated by Hyperknot Software Kft., Hungary. According to the provider's privacy policy, the service uses no cookies and no tracking. It keeps logs without IP addresses (browser type, referring page, timestamp, operating system). Error logs may contain the IP address and the requested address. The provider deletes all logs after 7 days, and logs on security incidents after 30 days at most. By its own account, the provider may use a content delivery network from Cloudflare, Inc. (USA) for delivery. By its own account, Cloudflare relies on the EU-US Data Privacy Framework (Article 45 GDPR) for transfers to the USA.
No cookies are set and nothing is stored on your device, apart from the tiles in the normal browser cache.
When. The map only loads once you have consented in the "External media" category, just like Google Maps. Until then you see a placeholder, and no request goes to a tile server. You can withdraw your consent at any time via "Cookie settings" in the footer. The map then disappears without a reload.
Legal basis. Your consent (Article 6(1)(a) GDPR). We ask for it as a precaution, because loading the map transmits your IP address to a third party. Withdrawal takes effect for the future (Article 7(3) GDPR).
Without a map. Search and booking also work without a map. Listings then show the location and address details as text.
9. Location suggestions via Photon
When you type a place in search or while creating a listing, Banaki suggests matching places. If the map runs on OpenStreetMap or Google is unavailable, the suggestions do not come from Google but via our own server:
- Your browser only contacts Banaki's server (address /api/ortssuche). It does not talk to a third party.
- Our server queries the location search service Photon. We use the public instance photon.komoot.io of komoot GmbH, Kienberger Allee 4, 12529 Schönefeld, Germany (Amtsgericht Cottbus, HRB 19363 CB). Since March 2025, komoot has belonged to Bending Spoons S.p.A. (Italy).
- The server only sends the typed text and the language. We do not pass on your IP address or other details from your browser (headers, user agent). To komoot, every request looks as if it came from Banaki's server.
What we store. We keep results for 24 hours in the server's working memory, so identical requests do not go out again. A restart empties the memory. The server briefly uses your IP address in working memory to limit abuse (at most 60 requests per minute and IP address). We write neither the text nor the IP address to a log of our own. For access to our server, Section 15 (Hosting) applies as it does to all other access.
What komoot learns. The typed text, the language and the IP address of our server. The provider has not published how komoot logs the public instance. According to the project description, Photon is independent of komoot's other services. The provider has likewise not published where the servers of the public instance are located. The provider is based in Germany. We therefore cannot rule out a transfer to a third country, but only the place text and the language are transmitted, no information about you.
Legal basis. Legitimate interest in a functioning location search and in limiting abuse (Article 6(1)(f) GDPR). Consent is not required, because no data from you goes to third parties and nothing is stored on or read from your device (Section 25 TDDDG does not apply). You can object (Article 21 GDPR) by not using the location search or by contacting moin@kogge.digital. The location search is voluntary, you can also use the map or pick regions from the list.
10. Location resolution via Nominatim
If Google returns no match for a place, for example from the AI-assisted search or an address in a listing, our server queries the geocoding service Nominatim of the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). Only the place name is transmitted. Your IP address and other details about you do not go along. The Foundation sees the IP address of our server.
The basis is our legitimate interest in a functioning location search (Article 6(1)(f) GDPR). For the United Kingdom, an adequacy decision of the EU Commission exists (Article 45 GDPR), which the Commission extended in December 2025 until 27 December 2031. The Foundation's privacy policy is available at osmfoundation.org/wiki/Privacy_Policy.
11. Google reCAPTCHA
The contact form is protected against automated abuse by Google reCAPTCHA (Google Ireland Limited). The service only loads once you expressly consent to it on the form. The legal basis is your consent (Article 6(1)(a) GDPR, Section 25 TDDDG).
12. Sign in with Google
You can sign in using your Google account. In doing so, Google Ireland Limited transmits your name and e-mail address to Banaki. The legal basis is performance of the contract (Article 6(1)(b) GDPR); the service is only activated if you use it.
13. Images via Cloudinary
We deliver images of accommodation via Cloudinary. In doing so, your IP address is transmitted to Cloudinary. The legal basis is our legitimate interest in fast image delivery (Article 6(1)(f) GDPR). A data processing agreement is in place with Cloudinary.
14. Error logging via Sentry
Errors on our server are logged via Sentry to help us fix disruptions. This runs exclusively server-side; no script is loaded in your browser. The legal basis is our legitimate interest in a functioning operation (Article 6(1)(f) GDPR).
15. Hosting
Banaki is hosted by Hetzner Online GmbH (Germany). The legal basis is our legitimate interest in stable operation (Article 6(1)(f) GDPR). A data processing agreement is in place with Hetzner.
16. E-mail delivery
We send system messages such as booking confirmations via emailit. The legal basis is performance of the contract (Article 6(1)(b) GDPR).
17. Messages between guest and host
Messages within a booking run through a direct connection to our server (Socket.io), without the involvement of third parties. The legal basis is performance of the contract (Article 6(1)(b) GDPR).
18. Availability and listing data via Campnerd
For hosts who also manage their accommodation through a channel manager, Banaki exchanges availability and listing data with Campnerd. The legal basis is performance of the contract with the host (Article 6(1)(b) GDPR).
19. Tax information for hosts (DAC7 / PStTG)
As a reporting platform operator, we collect from hosts their name, address, tax number or tax identification number, VAT ID, where applicable their commercial register number and date of birth, as well as, for each listing, the address and the number of rental days. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR in conjunction with the Platform Tax Transparency Act). We report this data once a year to the Federal Central Tax Office and store it for ten years (Section 24 PStTG).
20. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest (Articles 15 to 21 GDPR). You can withdraw any consent given at any time with effect for the future. To do so, contact moin@kogge.digital. You can also lodge a complaint with a data protection supervisory authority; the competent authority is the Unabhängige Landeszentrum für Datenschutz Schleswig-Holstein.
