roomkey24Suite
Legal

Privacy Policy

Last updated: 3 June 2026

This Policy explains what personal data we process when you use the Roomkey24 Suite, why we process it, who we share it with, and the rights you have under the GDPR, UK GDPR and equivalent laws.

1. Data controller

For account, billing and website data, the controller is RoomKey24 LLC, State of Wyoming, USA. Contact: privacy@roomkey24.com. For guest and employee data uploaded into a customer workspace, the customer organisation is the controller and we act as processor — see the DPA.

2. Processors and sub-processors

We rely on the following processors to operate the Service:

  • Supabase — managed Postgres database, authentication, file storage. Region: EU.
  • Stripe, Inc. — payments, invoices, subscription management.
  • Google LLC (Google OAuth) — optional Google sign-in.
  • Google LLC (Gemini 2.5 Flash / Flash-Lite) — document OCR, classification, transcription.
  • OpenAI, L.L.C. (GPT-5.6) — RMS revenue-advisor chat only.
  • Cloudflare, Inc. — edge hosting and DDoS protection for the application.

The current sub-processor list is also reproduced in the DPA.

3. What we collect, per module

Account & billing

  • Email, name, hashed password (or Google OAuth identifier), organisation name, role.
  • Stripe customer ID, subscription state, invoices. Card data is held by Stripe, not by us.

PMS (Property Management)

  • Guest names, contact details, booking dates, room assignments, special requests.
  • Channel manager identifiers (Channex/Beds24/AvantStay) and rate/availability data.

Teams

  • Employee profile data: name, role, contact, contract details.
  • Sensitive employee PII: tax IDs and national IDs, encrypted at rest with PGP symmetric encryption via pgcrypto (pgp_sym_encrypt) using a server-only key.
  • Time-clock entries, schedules, holiday balances, payroll calculations.
  • Compliance documents (certificates, ID proofs) stored in private file storage.

Mailroom

  • Inbound HR/payroll documents (payslips, tax notices, certificates) ingested via a dedicated email address per organisation.
  • Document contents are sent to Gemini for OCR and classification.

Finance

  • Invoice line items, customer/supplier records, bank-statement transactions you upload for reconciliation.

Academy

  • Course progress, quiz scores, certificates, mandatory-training assignments.

Facility

  • Asset inventory, maintenance work orders, vendor contacts, compliance schedules and photos.

4. Lawful bases (GDPR Art. 6)

  • Contract — account creation, providing paid modules, processing payments.
  • Legitimate interests — security logging, fraud prevention, product analytics on aggregated usage.
  • Legal obligation — retaining invoicing records for tax purposes.
  • Consent — non-essential cookies, optional marketing emails.
  • Processor (Art. 28) — guest/employee data is processed on behalf of the customer organisation under the DPA.

5. Retention

  • Account data: while your organisation exists, then 90 days after closure (30-day read-only + 60-day deletion window).
  • Invoices and tax records: 10 years (US/EU statutory).
  • Compliance documents (Teams/Facility): for the duration of the legal retention period applicable to each document type, or until you delete them.
  • Encrypted employee tax/national IDs: deleted with the employee record; access is audited in a sensitive-access log.
  • Mailroom documents: retained until the customer deletes them or the workspace is closed.
  • Backups: rolled off within 35 days.

6. Where we send data

Application hosting and database storage are in the EU. AI requests, Stripe payments and Google OAuth involve transfers to the United States. Those transfers rely on the EU Standard Contractual Clauses (2021/914) and, where applicable, the EU-US Data Privacy Framework adequacy.

7. Security

  • TLS in transit; AES-256 at rest for backups.
  • Sensitive employee PII (tax/national IDs) is individually encrypted column-level with PGP symmetric encryption via pgcrypto, using a server-only key.
  • Channel-manager API keys and secrets are encrypted with AES-256-GCM (WebCrypto) on the server before storage.
  • Row-level security on every multi-tenant table.
  • Role-based permissions; service-role keys are never exposed to the browser.
  • Audit log on sensitive PII reveals.

8. Your GDPR rights

You have the right to:

  • Access the personal data we hold about you;
  • Rectify inaccurate data;
  • Erase data we no longer need to keep ("right to be forgotten");
  • Portability — receive your data in a machine-readable format;
  • Restrict or object to certain processing;
  • Lodge a complaint with your national supervisory authority (e.g. Garante in IT, AEPD in ES, CNIL in FR, ICO in UK).

Exercise any of these rights by emailing privacy@roomkey24.com. We respond within 30 days. For data held in a customer workspace, contact the workspace owner first; we will assist them in responding.

9. Data Protection Officer / EU representative

DPO contact: dpo@roomkey24.com. An EU representative under Art. 27 GDPR is available on request via the same address.

10. Cookies

See the dedicated Cookie Policy for the full list of cookies and how to change your preferences.

11. Changes

We will update this Policy when our processing changes. Material changes are announced in-app or by email at least 14 days in advance.