Privacy Policy

Last updated: 2026-08-22

What we collect

Account data: your email, first name, last name, and date of birth. If you sign in with Google, we also receive your name from your Google profile.
Hotel staff data: which hotel(s) you belong to, your role (owner, admin, reception, or housekeeping), and a record of every room-status change you make (who, what, when, written automatically by the database, not by the app, so it can't be edited afterward).
Guest data, entered by hotel staff during check-in: a guest's name, and optionally an ID card number and a photo of the ID card, expected check-out time, and payment amounts. Guest ID data is only ever visible to that hotel's reception staff and above, never to housekeeping.
Guest-submitted data: if a guest scans their room's QR code, any food/service order or message they send is stored against that room, with no account or login involved.
Usage data: basic, aggregated page-visit and performance metrics via Vercel Analytics and Speed Insights, this does not include anything you type into forms.

To operate the service: authenticate you, show you the right hotel's data, and let your team coordinate room status and guest check-in/out in real time.
Guest ID data is collected because hotels are commonly required to record it for local guest-registration requirements, it is entered and controlled by the hotel, not by us.
Payment amounts recorded here are bookkeeping entries the hotel enters, this app does not process payments, store card numbers, or connect to a payment processor.

Row-level security in the database, not just app-code checks, enforces every rule below, so it holds even against a direct API request.
Housekeeping: sees room statuses for their hotel. Never sees guest names, ID data, payments, or financial reports.
Reception: everything housekeeping sees, plus guest check-in/out, guest ID data, and payments for their hotel.
Admin/Owner: everything reception sees, plus finance, staff activity, and hotel/room/menu management.
Nobody outside your hotel's own staff can see your hotel's data, hotels are fully isolated from each other.
Guest ID photos are stored in a private file bucket, never publicly accessible, and only ever served through a short-lived, permission-checked link.

Supabase (database, authentication, and file storage), our data processor, hosted in the ap-southeast-1 (Singapore) region.
Vercel (application hosting, analytics, performance monitoring).
Google (only if you choose to sign in with Google).
Cloudflare Turnstile (bot protection on sign-up, does not track you for advertising).
None of these are used to sell your data or serve you ads.

Account data: kept while your account exists.
The room-status audit log: kept indefinitely as an operational and legal record for the hotel, it's written by the database itself and can't be edited or deleted through the app, by design, so no one (including an owner) can alter what actually happened.
Guest ID data and photos: kept per the hotel's own retention practice, which should follow applicable local guest-registration rules; deletable on request except where the hotel is legally required to retain it.

Access: ask what personal data we hold about you.
Rectification: ask us to correct inaccurate data.
Erasure: ask us to delete your data, subject to what the hotel or we are legally required to keep (e.g. the audit log, or guest-registration records).
Portability: ask for a copy of your data in a portable format.
Objection / withdraw consent: object to certain processing, or withdraw consent where consent is the basis for it.
To exercise any of these, contact the hotel you're staff at (for guest data they entered) or the operator of this service directly using the contact details below.

For a request about your own account data, or a question about this policy, contact the person who manages your hotel's account, or reach the operator through the contact details provided on this site.