Privacy

This website is run by Mindcraft OÜ (registry code 12242799), Tiskrevälja tn 36-1, 13516 Tallinn, Estonia. We decide what happens to the information described here, which under the GDPR makes us the controller of it.

For anything at all to do with your data, write to kaido.ulejev@mindcraft.ee or call +372 5696 8272. A person answers — there is no form to fight with.

Three things put information in front of us. You start two of them yourself; the third is the web server doing its job.

• When you send an enquiry — your name and email address, plus anything else you choose to add: a phone number, which apartment you are asking about, and your message.
• When you ask about dates — your email address, the apartment, the dates you picked and the number of guests.
• Whenever you visit — the server records the request in its access log — IP address, page, time — the way every web server has since the 1990s. We do not read those logs to learn about you and we do not tie them to anything else. They exist so the site can be kept running and abuse can be spotted.

One extra use of the IP address, which we would rather spell out than leave you to assume: when the form is submitted we count how many messages arrive from the same address within an hour, so it cannot be turned into a spam relay. That count sits in memory for an hour and we write it nowhere.

We also count visits, through Vercel Web Analytics. It sets no cookie and stores nothing in your browser: a repeat view within the same day is recognised from a code made out of your IP address and browser type, and that code is thrown away and remade every 24 hours. It tells us how many people looked at which apartment and which site they arrived from. It cannot tell us who you are, and it cannot follow you to any other website.

We do not ask for payment details anywhere on this site, and nothing here is capable of taking them.

Estonian law requires every accommodation provider to register its guests. Under the Tourism Act (Turismiseadus § 24) we record your name, date of birth, citizenship, country of residence, the dates of your stay, the purpose of your trip, and the number of children under 18 travelling with you. Children staying with a parent are counted, not registered individually. If you are not a citizen of Estonia, the EEA or Switzerland and do not live here, we also record the type, number and issuing country of your travel document. We keep that record for two years. We have to produce it if the authorities ask. This one is not ours to waive: it applies to us exactly as it applies to every hotel in the country.

We also keep the invoice for your stay, because accounting law requires that too.

• To answer you and arrange your stay — because you asked us to, as a step towards booking (GDPR Art. 6(1)(b)).
• To register guests and keep accounts — because Estonian law obliges us to (Art. 6(1)(c)).
• To keep the site up and the form usable — our legitimate interest in a website that still works tomorrow (Art. 6(1)(f)). This covers the access logs and the spam counter, nothing more.

None of this rests on consent, so there is no consent box you need to worry about having ticked. The confirmation on the enquiry form is there so you know we will reply to you — not to manufacture a legal basis. You can still object, and ask us to delete anything we are not legally required to keep. See Your rights below.

• The enquiry form — needs a name, an email address and a message. Without them we cannot reply to you — that is the whole consequence. Nothing else on the site stops working, and you are welcome to phone instead.
• Everything optional — your phone number, which apartment you mention, the guest count — leave any of it blank and it costs you nothing.
• Guest registration is different — the law requires it, so if you will not give us those details we cannot lawfully let you stay. That is not us being difficult; it is the same at every hotel in Estonia.

As few people as we can manage.

• Our email provider — enquiries reach us as ordinary email, delivered through Plus Five Five, Inc., trading as Resend (United States), which handles them on our behalf under a data processing agreement.
• Our hosting provider — the company that runs the server keeps the access logs described above, on our behalf and under contract. We do not keep our own copy of them.
• Vercel Web Analytics — the visit counts described above are processed by Vercel Inc. (United States) on our behalf. They receive no name, no email address and nothing you typed into a form — only that a page was opened.
• Our booking calendar — the dates each apartment is taken are mirrored into two private Google calendars, so that whoever is cleaning and handing over the keys can see what is happening. Where you booked directly with us, that entry carries your name beside the apartment and the dates; bookings that reach us through Airbnb or Booking.com appear there without a name. Google holds those calendars on our behalf. They are private to us — not published, not shared with guests.

That is the entire list. We do not sell your data, we do not hand it to advertisers, and we do not pass it to Airbnb, Booking.com or any other platform. A booking made here is a booking made with us — that is rather the point of the site.

This site sets no cookies and stores nothing at all in your browser. That is why you were never shown a cookie banner — there is genuinely nothing to consent to.

We do measure how busy the site is, and we would rather say so here than let you find out elsewhere — see What we collect above. It runs without a cookie and without any lasting identifier, so it can tell us that four people opened the Sea-View Loft yesterday and cannot tell us anything about who they were.

What is genuinely absent: Google Analytics, advertising pixels, and any profile built about you. Nothing here follows you off this site, and we neither buy nor sell audience data.

Two details, so the claim is complete rather than merely flattering:

• Fonts — served from our own server, never fetched from Google.
• The map — on each apartment page loads its tiles straight from OpenStreetMap. To send those images, the OpenStreetMap Foundation receives your IP address and browser type — as any site you visit does. We pass them nothing else, and they are not acting on our behalf. Their notice: osmfoundation.org/wiki/Privacy_Policy.

• Enquiries that do not lead to a booking — we clear these out once a year. Ask us before that comes round and yours goes immediately.
• Enquiries that do lead to a booking — kept with the booking record.
• Booking calendar entries — a cancelled booking disappears from the calendar on its own, at the next sync. An entry for a stay that actually happened stays there until we clear it out along with the booking record.
• Guest registration records — two years, as the Tourism Act requires.
• Invoices and accounting records — seven years from the end of the financial year, as the Accounting Act requires.
• Server access logs — however long our hosting provider keeps them, which is days rather than months. We hold no copy of our own.
• The spam counter — one hour.
• The analytics code that recognises a repeat visit — 24 hours, then discarded and rebuilt from scratch. The visit counts themselves are kept as totals, with nothing in them that points back to a person.

Our email provider, Plus Five Five, Inc., trading as Resend, processes data in the United States. That transfer rests on the European Commission’s Standard Contractual Clauses, and Resend is certified under the EU–U.S. Data Privacy Framework. Where any other provider we use — Vercel for hosting and visit counts, Google for the booking calendar — processes data outside the European Economic Area, we rely on the same safeguards.

• In transit — the site runs over HTTPS, so what you type into the form is encrypted on its way to us.
• No payment data — we take none on this site, so there is none here to lose.
• Access — enquiries and booking records are seen by the family who run the apartments. The only companies holding any part of them are the ones named in Who else sees it, each acting on our behalf and under contract.
• Keys and calendar links — held on the server and never sent to your browser.

One caveat we would rather state than let you discover: ordinary email is not encrypted end to end. Please do not send us passport scans or card numbers by email unprompted — when we need your registration details, we will tell you how to get them to us.

You can ask us to give you a copy of what we hold about you, correct anything wrong, delete it, restrict or object to how we use it, or send it to you in a portable form.

Write to kaido.ulejev@mindcraft.ee, or call +372 5696 8272, and we will answer within one month.

Two honest limits: we cannot delete a guest registration record before its two years are up, or an invoice before its seven, because the law requires us to keep them. Everything else we can and will remove on request.

We do not make automated decisions about you and we do not profile you.

Tell us first — kaido.ulejev@mindcraft.ee — and we will try to put it right. You also have the right to complain to the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn · info@aki.ee · +372 5620 2341 · aki.ee

If we change how any of this works — a booking system that takes payments, a different host, anything that touches your data — we will update this page and change the date at the top. We will not quietly broaden what we do with information you gave us under the terms above.