Last updated: September 13, 2026
1. Who We Are
Montenegro.com ("we", "us", "our") is a vacation rental marketplace operated by Axora Group LLC, 412 Olive Ave 238, Huntington Beach, CA 92648, United States. We act as the data controller for personal data collected through our Platform.
1a. When the Host is the controller and we are the processor
One category of data works differently. Montenegrin law requires an accommodation provider to register their guests with the authorities and to account for the tourist (sojourn) tax. Where you provide identity-document details through a Host's guest-registration link, the Host is the data controller for that data and we act as their processor: we collect, store and present it on the Host's documented instructions, we do not use it for our own purposes, and we delete or return it as their agreement with us requires. Our processing terms with Hosts, including sub-processors and security measures, form an annex to the Host Agreement. For everything else described in this policy, we are the controller.
Contact: privacy@montenegro.com
2. What Data We Collect
2.1 Account Information
- Full name, email address, phone number
- Profile photo (optional)
- Password (stored encrypted, never in plain text)
2.2 Identity Verification (Hosts)
- Government-issued ID (passport, driving licence)
- Video verification recording
- Address verification documents
2.3 Payment Information
- Payment card details are collected and processed by Stripe, Inc. We do not store full card numbers on our servers.
- Billing address
- Host payout details (bank account information for Stripe Connect or Wise transfers)
2.4 Booking and Stay Data
- Check-in and check-out dates
- Number of guests
- Special requests and communication with Hosts
- Reviews and ratings
2.5 Technical Data
- IP address, browser type, operating system
- Pages visited, time spent, referral source
- Device identifiers
- Cookies (see our Cookie Policy)
3. How We Use Your Data
We process your personal data for the following purposes:
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Account creation and management | Performance of contract |
| Processing bookings and payments | Performance of contract |
| Identity verification (KYC) | Legal obligation / Legitimate interest |
| Sending booking confirmations and alerts | Performance of contract |
| Preventing fraud and ensuring safety | Legitimate interest |
| Improving the Platform and user experience | Legitimate interest |
| Marketing communications (with consent) | Consent |
| Responding to legal requests | Legal obligation |
4. Data Sharing
We share your personal data with:
- Hosts / Guests: Name, profile photo, and booking details are shared between parties to facilitate stays.
- Stripe, Inc.: Payment processing. Stripe's privacy policy applies to payment data.
- Wise (TransferWise): Host payout processing.
- Email service providers: For transactional and marketing emails.
- Analytics providers: Anonymised usage data for Platform improvement.
- Law enforcement: When required by law or to protect safety.
We do not sell your personal data to third parties for advertising purposes.
4a. Our Social Media Accounts and Publishing Tool
Our staff use an internal publishing tool, hosted by us at social.montenegro.com, to schedule and publish Montenegro.com's own content to our accounts on Facebook, Instagram, Threads, TikTok and YouTube. The tool is not offered to Guests, Hosts or any other third party.
When a staff member connects one of our accounts, we receive through that platform's official API: access tokens, the account name and profile picture, and statistics (such as views, reach and engagement) for the posts we publish. We use this data only to publish our own content and measure how it performs. We do not sell it, share it with third parties or use it for advertising, and we do not collect data about other people's accounts through these APIs.
Access tokens and platform data are kept only while the account stays connected. Statistics received through the APIs are refreshed or deleted at least every 30 days, and all data received from a platform is deleted within 30 days after the account is disconnected or access is revoked. To request deletion, follow our data deletion instructions.
YouTube. The tool uses YouTube API Services. By connecting a YouTube account, you agree to be bound by the YouTube Terms of Service. How Google handles data is described in the Google Privacy Policy. Montenegro.com's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke the tool's access at any time on the Google security settings page.
Meta and TikTok. Data received from Meta (Facebook, Instagram, Threads) and TikTok is handled under the same rules, and access can be removed at any time in each platform's app permission settings.
5. International Data Transfers
Your data may be processed in the European Economic Area (EEA) and in the United States (through our service providers Stripe and Wise). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.
6. Data Retention
- Account data: Retained while your account is active and for 3 years after deletion.
- Booking records: Retained for 7 years for tax and legal compliance.
- KYC documents: Retained for 5 years after account closure as required by anti-money laundering regulations.
- Reviews: Retained indefinitely as they form part of the public trust system. You may request anonymisation.
- Technical logs: Deleted after 90 days.
7. Your Rights (GDPR)
Under the General Data Protection Regulation, you have the following rights:
- Right of access: Request a copy of your personal data.
- Right to rectification: Correct inaccurate or incomplete data.
- Right to erasure: Request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
- Right to restrict processing: Limit how we use your data.
- Right to data portability: Receive your data in a structured, machine-readable format.
- Right to object: Object to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, email privacy@montenegro.com. We will respond within 30 days.
8. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit (TLS 1.3) and at rest
- Access controls and authentication requirements
- Regular security audits
- Secure coding practices (OWASP guidelines)
9. Children
The Platform is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify registered users of material changes via email and update the "Last updated" date above.
11. Supervisory Authority
If you are not satisfied with our handling of your personal data, you have the right to lodge a complaint with the Agency for Personal Data Protection and Free Access to Information of Montenegro (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama).
12. Contact
For privacy-related inquiries, contact us at privacy@montenegro.com.