Privacy Notice

Last updated: June 11, 2026

1. Who we are

highkey ("we", "us", "our") provides the Villa Costing service. We act as the data controller for personal data processed in connection with the service.

2. Personal data we collect

• Account data: name, email address, login credentials.
• Usage data: villas, bookings, expenses and other content you input.
• Support communications you send us.
• Technical data: IP address, device identifiers, browser type, log data.
• Cookies and similar technologies (see Section 9).

3. Purposes and legal bases

• Providing the service and your account (contract performance).
• Customer support (contract performance / legitimate interests).
• Security, fraud prevention and abuse detection (legitimate interests / legal obligation).
• Product improvement and analytics (legitimate interests).
• Marketing communications, where permitted (consent or legitimate interests).

4. Data sharing

We share personal data with:

• Service providers and subprocessors (hosting, analytics, email, customer support tooling).
• Paddle.com Market Ltd., our Merchant of Record, for sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers (legal, accounting, insurance).
• Authorities where required by law.

5. International transfers

Where personal data is transferred outside the UK / EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

6. Retention

We retain personal data for as long as your account is active and as needed to provide the service. When no longer needed, data is deleted or anonymised, subject to legal retention obligations.

7. Your rights

Depending on your jurisdiction, you may have rights to access, rectify, erase, restrict, port or object to processing of your personal data, and to withdraw consent. You may also lodge a complaint with your local supervisory authority. We aim to respond within one month.

8. Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls and least-privilege practices, to protect personal data.

9. Cookies

We use strictly necessary cookies to operate the service (e.g. authentication) and may use analytics cookies to understand usage. You can manage cookie preferences through your browser settings.

10. Contact

For privacy questions or to exercise your rights, contact us at the email address listed on our website.