moveandstay
Policy

Privacy

This policy explains what Moveandstay collects, why, who it goes to and what you can ask us to do about it. It describes what the site actually does — not a general statement of intent.

Moveandstay is operated by Sabaai Concept Co., Ltd., Bangkok, Thailand. Write to contact@moveandstay.com about anything on this page, including a request to see or delete your data.

Last updated 24 September 2026.

The short version

  • We never sell personal data, and we do not share it for anyone else's advertising.
  • Browsing the directory needs no account and we ask for nothing.
  • When you send an enquiry, we pass your details to the property you asked about — that is the entire point of sending it.
  • We email property operators about their own listing. Every message can be unsubscribed in one click, and we honour it everywhere.
  • We use a Meta (Facebook) advertising pixel for advertising measurement — but only if you say yes. It does not load until you do, and declining costs you nothing. See §7.

1. What we collect

When you send an enquiry. Your name and email, and — only if you provide them — your phone number, company, the city and type of space you need, how many people or desks, your dates, your budget and your message.

When you claim or manage a property. Your email address, and whatever you then publish on the listing: photos, descriptions, rates, FAQs and the contact destination for enquiries. A published listing is public by design.

When you buy Premium. The payment itself is handled by Stripe. We never see or store your card number — we keep only the subscription's status and identifiers.

Automatically. Your IP address is read on form submissions and used to rate-limit abuse. It is not used to build a profile of you.

About properties, from public sources. Most listings started as information collected from publicly available sources — a property's name, address, description, photos and published contact address. Where that contact address belongs to an individual rather than a business, it is personal data, and §9 applies to it in full.

2. Why we use it, and on what basis

What we doWhyLawful basis (where GDPR applies)
Pass your enquiry to the propertyIt is what you asked us to doPerformance of a contract / your request
Email you about that enquiryTo introduce you and the propertyPerformance of a contract / your request
Rate-limit and spam-check submissionsTo keep the enquiry network usableLegitimate interests
Invite an operator to claim their listingSo they can correct it and receive requestsLegitimate interests (opt-out in every message)
Run owner accounts and PremiumTo provide the productPerformance of a contract
Measure advertising with the Meta PixelTo understand which campaigns workConsent, asked before it loads — see §7

3. What happens to an enquiry

An enquiry is an introduction, not a booking. We take no reservations and no commission, and we cannot confirm availability.

Your details go to the property you asked about, or — if you did not name one — to a small number of properties matching what you described, so they can respond. Premium properties receive the full details immediately; other properties receive matching opportunities over the following 24 hours. Which properties those are depends on your requirements, not on anything else we know about you.

Once a property has your details, it holds them as an independent business under its own privacy practices. We cannot delete a message on that property's behalf, and we do not claim to.

4. Enquiries sent by AI assistants

Moveandstay has a keyed API that lets an approved AI assistant search the directory and send an enquiry on somebody's behalf. If you asked an assistant to find you a serviced apartment, your details may reach us this way.

  • The assistant must assert that you agreed to have your details passed to properties. An enquiry without that assertion is refused and nothing is stored.
  • It arrives in the same pipeline as a website enquiry and is treated identically from that point on.
  • It is labelled by its source, so we can tell you which assistant sent it if you ask.
  • The API cannot read any property's contact details, and it cannot create, edit or claim listings.

We rely on the assistant to have asked you. If you believe one sent your details without your agreement, write to contact@moveandstay.com and we will delete the enquiry and tell you which key it came from.

5. Who else sees it

Companies that process data on our behalf, under contract, and for no purpose of their own:

WhoWhat for
SupabaseThe database, and sign-in for owner and admin accounts
VercelHosting and delivery of the website
ResendSending email — enquiry notifications, claim invitations, account mail
StripePremium subscription payments
CloudflareTurnstile, the check that tells a person from a bot on our forms
SentryError reporting, so faults are visible and get fixed
MetaThe advertising pixel described in §7

These providers operate internationally, so your data may be processed outside your country, including outside the EEA and the UK. We also disclose data where the law requires it. We do not sell personal data, and we do not share it for third-party advertising beyond the pixel described in §7.

6. Email to property operators

If your property is listed and unclaimed, we may write to the contact address published for it, to tell you the page exists and invite you to claim it.

  • At most three messages, then we stop whether or not you reply.
  • Every message carries a one-click unsubscribe.
  • An unsubscribe is honoured across every kind of mail we send, not just the campaign it came from — the send path checks the suppression list before contacting anybody.
  • Bounces and complaints are suppressed automatically.

To have a listing corrected or removed entirely, write to contact@moveandstay.com. You do not have to claim it first, and you do not have to explain why.

7. Cookies and the Meta Pixel

Essential cookies. If you sign in as a property owner or an administrator, we set a cookie that keeps you signed in. Without it the account cannot work. Browsing the directory signed-out sets no cookie of ours.

The Meta Pixel. We use Meta's advertising pixel to measure our advertising. It reports your visit to Meta, which processes that data under its own terms and may combine it with an account you hold with them.

It does not load until you allow it. The first time you visit, we ask. Until you answer, and permanently if you decline, the pixel's script is never added to the page — so no request reaches Meta and no pixel cookie is set. Declining is one click, in the same place and the same size as accepting, and nothing on this site works differently afterwards.

You can change your mind at any time, in either direction, using the control at the bottom of this page. Withdrawing consent stops the pixel from the next page view onwards; it cannot recall data Meta has already received, and we do not claim otherwise.

Your choice is stored in your browser, on the browser you made it on. Clearing your site data clears the choice too, and we will ask again.

If you browse with JavaScript turned off, the pixel cannot run and we cannot ask you — so nothing loads. We removed the no-JavaScript tracking fallback the site used to carry, because it fired without any way to check your choice.

8. How long we keep it

Enquiries are kept while they are useful to the introduction they created and for a reasonable period afterwards, so we can answer questions about what was sent and to whom. Account and subscription records are kept while the account exists and as long afterwards as tax and accounting rules require. Suppression records — the list of people who asked not to be emailed — are kept indefinitely and deliberately: it is the only way to keep honouring an opt-out.

We would rather be straight with you than quote a number we do not enforce: deletion is currently performed on request rather than by an automatic schedule. Ask us and we will do it.

9. Your rights

Depending on where you live — and in the EEA and UK in particular — you can ask for a copy of what we hold, ask us to correct or delete it, object to a use, ask us to restrict one, or ask for your data in a portable form. Where we rely on consent, you can withdraw it at any time.

Write to contact@moveandstay.com. It is read by a person. We will not ask you to justify the request, and we will not charge you for it. If you are in the EEA or the UK you also have the right to complain to your local data protection authority.

10. Children

Moveandstay is a service for business and relocation accommodation and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.

11. Changes

When this policy changes, the date at the top changes with it. Material changes will be signalled on the site rather than made quietly.