ExtraWelcome Privacy Policy
This policy explains what personal data ExtraWelcome collects, why we collect it, who we share it with, and what you can do about it. It covers hosts, guests, and anyone who visits our site.
1. Who we are
ExtraWelcome is operated by Overflowing Void Limited, a company registered in England and Wales (company number 16574513), registered office 124 City Road, London, EC1V 2NX, trading as ExtraWelcome. We are the controller of the personal data described in this policy.
If you have a question about this policy, or you want to exercise any of the rights in section 7, email hello@extrawelcome.co.uk.
2. What we collect and why
Hosts
If you create a host account we collect your email address, your display name, the identifier of the Stripe account your payouts settle to, and any additional notification addresses you add so that order emails reach the right people.
Our lawful basis is performing our contract with you: we cannot run your store, route your payouts, or tell you about an order without this data.
Guests
If you buy an extra we collect your name and email address, which reach us from Stripe Checkout after you have paid; the contents and amounts of your order; and your stay date and booking reference where those are provided.
We never see or store your card details - payment is handled by Stripe.
Our lawful basis is performing the host's contract with you, together with our legitimate interest in operating the platform, keeping accurate order records, and holding the evidence needed if a purchase is later disputed.
Store visitors
When you open a host's store link we record anonymous, cookieless page analytics (Vercel Analytics), and aggregate store funnel events - counts of things like a store being viewed or an extra being added to a cart - which contain no personal data and cannot be traced back to you.
Our lawful basis is our legitimate interest in understanding how the product is used so that we can improve it. Because this data does not identify you, the impact on your privacy is minimal.
Attribution and analytics on our own site
On our own marketing and host pages we set a first-party cookie named
ew_source that records how a host found us - for example the campaign or the
referring site - so that the signup can be attributed correctly. We also run
DataFast analytics on those marketing and host pages only; it never runs on a
guest store page or a checkout page.
Our lawful basis is our legitimate interest in measuring what brings hosts to the product, so that we spend our effort where it works.
3. Who processes data for us
We use a small number of service providers who process personal data on our instructions, under a contract that limits what they may do with it:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database and host login | London, UK |
| Vercel | Hosting and cookieless analytics | EU and US infrastructure |
| Stripe | Payments | Global (your card data never reaches us) |
| Resend | Transactional email | US |
| DataFast | Site analytics (marketing and host pages) | EU |
We also use operational alerting tools that carry no guest personal data. Where a provider processes data outside the UK, the transfer is covered by UK-approved safeguards (the UK IDTA or Addendum to the EU Standard Contractual Clauses) in that provider's data processing agreement.
We do not sell personal data, and we do not share it for advertising.
4. Hosts receive guest data
When you buy an extra, your host receives your name, email and order details so they can fulfil it. For that data your host is an independent controller, responsible for handling it lawfully - see the Host Agreement.
5. How long we keep data
Order and audit records: six years, for tax and dispute-evidence purposes.
Host account data: deleted or anonymised after account closure, except records we must keep - which in practice means the order and audit records above, since those have to survive for their own retention period.
Funnel events contain no personal data, so there is nothing in them to delete.
6. Cookies
Essential cookies keep hosts signed in (Supabase auth). A first-party
ew_source cookie records signup attribution. DataFast analytics runs on
marketing and host pages only. Vercel Analytics is cookieless. We do not use
advertising cookies.
7. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- rectification of data that is inaccurate or incomplete;
- erasure of your data, where we have no overriding reason to keep it;
- restriction of how we process your data while a question about it is resolved;
- portability - to receive the data you gave us in a machine-readable form, or have it sent to another provider;
- objection to processing we carry out on the basis of legitimate interests, including the analytics and attribution described above.
Email hello@extrawelcome.co.uk to exercise them. We will respond within one month, though we may extend this by up to two further months for complex or numerous requests - we will tell you if so.
If you are not satisfied with how we have handled your data or your request, you can complain to the Information Commissioner's Office (ico.org.uk).
8. Changes
We will post changes here and update the version and effective date above.
Version 2026-07-29 - effective 2026-08-01.