Privacy policy

Sälengodset — version 2.6 — last updated 11 September 2026

This policy explains how we process your personal data when you visit salengodset.se, chat with our booking assistant, book accommodation with us or use the guest portal.

1. Who is responsible?

Sälengodset Rekreation AB, company registration number 556736-4095, PO Box 2063, 663 12 Hammarö. info@salengodset.se, 070-573 48 10.

If accommodation is booked and invoiced by Sälengodset Mountain Luxe AB, company registration number 559510-1642, PO Box 2063, 663 12 Hammarö, info@salengodset.se, 070-573 48 10, that company is the data controller responsible for the invoicing and accounting for that specific booking. In all other respects, the same procedures and the same system apply.

Accommodation arranged by us. For some properties, Sälengodset acts as an intermediary: the tenancy agreement is entered into directly between you and the property owner, who is the landlord. Responsibility is then divided according to who determines the purpose and the means. Sälengodset is responsible for the booking system, the guest portal, the AI assistants, the website and all guest communication. The invoicing company is responsible for invoicing, payment and bookkeeping. The property owner is solely responsible for their own use of the booking details. Which company issues the invoice, and whether the accommodation is booked through an intermediary, is stated on your booking confirmation and your invoice.

2. When you visit salengodset.se

The website is built using WordPress and is hosted by Kinsta. The web server maintains an access log containing the IP address, time and page accessed, which is used for security and troubleshooting purposes.

2.1 Cookies

We use Complianz to manage your consent. The website is set up to require active consent: non-essential cookies, and scripts that require consent — such as Google Analytics and Google Maps — will not be loaded at all until you have approved them. Essential cookies, and processing that does not require consent, may be used without your consent. You can change or withdraw your choice at any time.

2.2 Visitor statistics

Google Tag Manager and Google Analytics 4 are used to collect visitor statistics and are only loaded once you have given your consent. Your IP address is processed temporarily by Google, amongst other things to determine your approximate location, but is not recorded or stored by GA4.

Google Search Console shows how the page appears in search results. We do not receive any information about individual visitors via Search Console.

Legal basis: your consent (Article 6(1)(a)) for Google Analytics and other non-essential cookies. For the operational log, our legitimate interest in keeping the website secure and functioning (Article 6(1)(f)).

2.3 Embedded content

Some pages contain maps from Google Maps. These are only loaded once you have given your consent. If there is an embedded video, it is displayed as a thumbnail, and the player itself is only loaded from Google’s servers when you click on it — Google can then see your IP address and set its own cookies. Our links to Instagram and Facebook are standard links; no content from those sites is loaded onto this website.

2.4 Contact form and newsletter subscription

If you provide your name, email address and a message, we will use them to reply to you. If you sign up for the newsletter, your email address will be sent to Brevo.

Legal basis: our legitimate interest in responding to your enquiry (Art. 6(1)(f)), or pre-contractual measures where the enquiry relates to a future booking (Art. 6(1)(b)). For newsletter subscriptions, your consent (Article 6(1)(a)).

3. The booking assistant on the website

At salengodset.se, there is an AI-powered booking assistant that answers questions about our properties, available dates and prices, and can accept booking enquiries.

Whenever you chat, your messages, the assistant’s replies and a conversation ID are processed. If you rate a reply or click through to make a booking, a hashed version of your IP address (SHA-256) and information about your web browser are also processed. We never store your IP address in plain text.

If you submit an enquiry, we will process your name, email address, telephone number, preferred dates, party size and any specific requests. A contact record and a case thread will then be created in our booking system, and the entire chat conversation will be saved in the thread so that the person replying to you can see the context.

The assistant is powered by Google Gemini. We use the service through a Google project with an active billing account, which means that Google’s terms and conditions for paid services apply. Google does not, therefore, use our prompts or responses to improve its products, and processes them in accordance with Google’s Data Processing Agreement. However, Google logs prompts and responses for a limited period, solely for the purpose of detecting and preventing unauthorised use, maintaining the security of the service and complying with legal requirements. Furthermore, as we are established within the EEA, these terms and conditions apply regardless of the payment tier.

The assistant is a tool. The answers may contain errors and do not constitute a binding offer. Please do not enter your personal identity number, card details or health information in the chat.

Legal basis: pre-contractual measures (Article 6(1)(b)) when you request a booking; otherwise, legitimate interests (Article 6(1)(f)).

4. When you book

We process your name, address, email address and telephone number; arrival and departure dates; accommodation; number of guests and the composition of your party; details of any pets; additional services; payment details and payment history; your communications with us; and any special requests you make.

If you provide information about allergies, disabilities or health so that we can tailor your stay, we will process this information solely for that purpose and only with your explicit consent (Art. 9(2)(a)). You are never obliged to provide such information.

Legal basis: performance of a contract (Article 6(1)(b)) and a legal obligation relating to accounting (Article 6(1)(c)).

5. The Guest Portal

Each booking includes a guest portal containing information about the property, the door code, Wi-Fi, check-in details and additional services. Use of the portal is also governed by the terms and conditions for the guest portal.

We process your name and contact details, your one-time code login (the code is valid for ten minutes and is not stored in a readable format after use), the time and IP address when you accepted the terms and conditions, as well as which version you accepted, your queries to the property’s AI assistant and the replies you receive (the assistant is powered by Google Gemini under the same terms as described in section 3), digital check-in, bookings and messages, as well as which fellow travellers you have invited.

Fellow travellers. If you have made a booking, you can invite fellow travellers. If you have been invited, we have received your details from the person who made the booking — that is where your email address or mobile number comes from. We use them to send you the invitation and grant you access to the portal. The data will be deleted 30 days after departure. You may request that we remove your access and your data at any time, provided we do not need to retain them for security or legal reasons, and this will not affect the booking. You otherwise have the same rights as everyone else.

Legal basis: our legitimate interest in managing fellow travellers’ access to the accommodation and the guest portal (Article 6(1)(f)). As the data has been provided to us by the person who made the booking, we are providing this information in accordance with Article 14 of the GDPR.

The portal is accessible from the time of invitation until 30 days after departure. The same applies to fellow travellers.

Legal basis: performance of a contract (Art. 6(1)(b)). For security logging and documentation of acceptance of terms and conditions: legitimate interests (Art. 6(1)(f)).

6. Door code and keys

For many of our properties, you’ll receive a door code via the guest portal. We record when the code has been made available and for which booking. The code is a key to someone else’s home — please only share it with your group and never publish it.

Legal basis: performance of a contract (Article 6(1)(b)) and our legitimate interest in protecting the accommodation (Article 6(1)(f)).

7. Newsletters and marketing

Newsletters are sent via Brevo once consent has been given. Each mailing contains an unsubscribe link, and unsubscribing never affects any existing bookings.

If you have booked with us, we may send you offers regarding upcoming seasons and our properties. You’ll be informed of this when you provide your email address during the booking process, and you can opt out straight away by ticking the box marked ”I do not wish to receive such emails”. You can also opt out of each individual email, and this will never affect your booking.

Legal basis: our legitimate interest in marketing our own, similar accommodation and services to you as a customer (Art. 6(1)(f)), in accordance with the exemption set out in Sections 19–20 of the Marketing Act. If, however, you have actively subscribed to our newsletter, the legal basis is your consent (Article 6(1)(a)), which you may withdraw at any time.

8. How long we save for

• Accounting records: up to and including the seventh year following the end of the calendar year in which the financial year ended (Accounting Act, Chapter 7, Section 2)
• Other booking details: 3 years after departure
• Health information: shall be deleted within 30 days of departure, unless they are required for a specific legal claim
• Access to the guest portal: departure plus 30 days
• Login details: 10 minutes
• A conversation with the home’s AI assistant: 6 months
• Conversation with the booking assistant without a request: 12 months
• Enquiries that have not resulted in a booking: 24 months
• Reviews and click statistics from the assistant: 24 months
• Contact form: 12 months
• Newsletter: until you unsubscribe

9. Who we share data with

We never sell your data. We share data with suppliers and partners who need it for the purposes set out below, and in some cases with the property owner. Where a supplier processes personal data solely on our behalf, a data processing agreement is in place.

Lovable (USA) operates and maintains the booking system and the guest portal. The database where your data is stored is hosted by Supabase on Amazon Web Services’ servers in Ireland (EU), which act as subcontractors to Lovable.

Other recipients: Google Gemini (AI assistants, EU/USA), Google Analytics, Tag Manager and Maps (statistics and maps, subject to consent, EU/USA), Brevo (email and SMS, France), Kinsta (web hosting for salengodset.se, EU data centres), Cloudflare (security and traffic management via Kinsta and Lovable, EU/USA), Telnyx (telephone and SMS, EU/US), Loopia (email, Sweden), PDFShift (PDF document generation, France) and the property owner in the case of brokered accommodation.

We also disclose information where required by law, or in order to assert a legal claim.

Transfer to a third country. Some suppliers may process data outside the EU/EEA, primarily in the US. The transfer takes place on the basis of the European Commission’s decision on an adequate level of protection (Data Privacy Framework) or standard contractual clauses under Article 46 of the GDPR. Please contact us at info@salengodset.se if you would like to know more about the safeguards used for a specific transfer, or to find out how you can access them.

10. How we protect your data

The systems are password-protected and access is restricted to those who need it. The database is protected by row-level access rules, ensuring that each guest can only view their own booking. Traffic is encrypted. Guests log in to the guest portal using a one-off code.

A personal data breach must be reported to the Data Protection Authority within 72 hours, unless it is unlikely to pose a risk to you. If the breach is likely to pose a high risk, we will inform you immediately.

11. Automated decision-making

We do not make any decisions about you that are based solely on automated processing and that have legal consequences for you or similarly affect you to a significant extent. The AI assistants provide answers and suggestions, but decisions regarding bookings, prices and refunds are made by a human.

12. Your rights

You have the right to find out what personal data we hold about you and to receive a copy of it; to have inaccurate data corrected; to have data erased; to restrict processing; to object to processing based on legitimate interests and, in all cases, to object to direct marketing; to transfer your data; and to withdraw your consent.

Please contact us at info@salengodset.se and we will reply within a month. We are unable to delete any data that we are required to retain under the Accounting Act.

You always have the right to lodge a complaint with the Swedish Data Protection Authority, PO Box 8114, 104 20 Stockholm, imy@imy.se.

13. Amendments

We update the policy whenever our operations or the law change. The current version is always available at salengodset.se, with the date shown at the top.