Security and data

Your bookings, your guests’ details, and your payments matter. Here is exactly how Shushko handles them.

Where your data is stored

Your booking data, your guests’ details, and the content of your website are stored in the European Union, on infrastructure operated by Amazon Web Services. Domains you register through Shushko are registered through a provider based in the European Union.

Some of the providers we work with operate outside the EEA — our payment processor, our live chat provider, our analytics and advertising providers, our maps and sign-in provider, and our network security provider among them. Where that happens, the transfer is covered by the safeguards set out in our Privacy policy.

How your data is protected

Everything you send to and from Shushko travels over an encrypted HTTPS connection. Data is encrypted at rest in our database, and particularly sensitive fields — including guest identity document numbers, where the compliance features require them — carry an additional layer of field-level encryption.

Access to production systems is restricted to authorized personnel using individually assigned, permission-scoped credentials.

Payments

Shushko never sees or stores your guests’ card details. All card processing is handled by Stripe, certified as a PCI Service Provider Level 1 — the highest level in the payment card industry.

When a guest books through your site, the money goes directly to you. You are the merchant of record for your own bookings. Shushko does not sit between you and your revenue.

How you sign in

Shushko does not use passwords. You sign in with a single-use code sent to your email address, or with your Google account.

That means there is no password for us to store, none for anyone to steal, and no risk carried over from a password you have reused somewhere else. If you sign in with Google, we never see your Google password. Google only confirms who you are.

Your email account or your Google account is the key to Shushko. We recommend turning on two-factor authentication there.

Your domain stays under your control

If you register a domain through Shushko, you are recorded as the registrant, not us.

That means the registration remains under your control. You can move the domain to another provider, subject to any applicable transfer restrictions. Ask us for the transfer code and we will send it within five days. If you ever stop using Shushko, the domain remains under your control — point it wherever you like.

You control your guests’ data

You are the data controller for your guests’ data, and Shushko processes it on your behalf. You decide why and how that data is used, and we handle it according to your instructions.

Our Data processing agreement sets this out formally, including the security measures we commit to and how we handle the providers we work with.

Backups

Production data is backed up continuously, with point-in-time recovery covering the previous 35 days. Backups are stored within the EU.

Who else touches your data

Running Shushko means working with a small number of trusted providers — for hosting, payments, email delivery, live chat, analytics, advertising, maps, sign-in, domain registration, and network security. Where a provider acts as our processor, it is contractually bound by appropriate data protection obligations. Some providers may act as independent controllers for specific processing, in which case their own privacy terms apply.

The full list of Sub-processors who handle Customer Data is published in Annex III of our Data processing agreement.

How long we keep your data

If your subscription ends, we keep your booking and payment records because you may still need them for tax and tourism-registration obligations. Those records may need to be retained for several years.

Guest identity document details are different. We delete those 12 months after the guest’s departure date, whether or not your account is still open, unless you have asked us to keep them longer and we have agreed.

Everything else is kept for at least 6 months after your subscription ends, and deleted within 12 months of your subscription ending. You can ask for your data back at any point during that period, or ask us to delete it sooner.

Reporting a security issue

If you think you have found a vulnerability in Shushko, email [email protected] and we will respond promptly. We appreciate responsible disclosure.