Privacy Policy

1. Who is the data controller

For the accounts and operational data of a given operator, that operator is the data controller and OneTapHost acts as a data processor on their behalf. For the running of the Service itself (creating accounts, security, notifications) OneTapHost is the controller. If you are a staff member, the manager who created your account is your first point of contact; you may also contact us at info@onetaphost.io.

2. What data we collect

• Account data: your name, email address, password (stored encrypted), and your role (manager or staff).
• Operational data you enter: properties and their details (address, Wi-Fi, access codes, notes), cleanings and schedules, staff time-off requests (days off, holidays, sick leave), and maintenance issues.
• Maintenance photos: images you attach to a maintenance issue (stored in a private, access-controlled store).
• Reservation data: when you connect a calendar (iCal) from a channel manager (e.g. Airbnb, Booking), we import reservation dates and, where provided, the guest name, to schedule cleanings.
• Property events: presses of the physical buttons in a property (e.g. check-in, check-out, cleaning started, ready) and the online/battery status of the gateway.
• Notification data: a push-notification token for your device and your chosen app language, used only to deliver alerts to you.
• Technical data: basic device and log information (device model, operating system, app version, timestamps) needed to run and secure the Service.

We do not use advertising identifiers, we do not run third-party advertising or cross-app tracking, and we do not sell your personal data.

3. How we use your data and our legal bases

• To provide the Service (accounts, cleanings, schedules, time-off, maintenance, property status) — performance of a contract.
• To send notifications you rely on (e.g. a button press, a maintenance assigned to you) — legitimate interest in operating the Service, or consent where your device requires it.
• To keep the Service secure and prevent abuse — legitimate interest.
• To provide support and communicate about the Service — legitimate interest / contract.
• To comply with legal obligations where applicable — legal obligation.

4. Device permissions

• Bluetooth is used only on your device to set up a property's gateway during installation. No personal data is transmitted over Bluetooth beyond what is needed for that local setup.
• Camera / Photos are used only if you choose to attach a photo to a maintenance issue.
• Notifications are used to deliver the alerts described above. You can change these permissions at any time in your device settings.

5. Who we share data with (sub-processors)

We use trusted service providers that process data on our behalf, under contract and only as needed to run the Service:

• Supabase — application database, authentication and file storage.
• OneSignal — delivery of push notifications.
• Google Firebase — real-time property events and status.
• Make.com — routing of button events to notifications.
• Resend — transactional and notification emails.
• Expo / EAS — building and distributing the mobile app.
• Apple — distribution of the iOS app (App Store / TestFlight).

Some of these providers may process data outside the European Economic Area (e.g. in the United States). Where that happens, the transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses and/or an adequacy decision.

6. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. When an account is closed, or on a valid erasure request, we delete or anonymise the associated personal data within a reasonable period, unless we must keep it to meet a legal obligation. Maintenance photos and operational records are kept while the related property/account is active.

7. Your rights (EEA/UK)

Subject to applicable law, you have the right to: access your data, rectify inaccurate data, erase your data, restrict or object to processing, request portability, and withdraw consent at any time (without affecting prior processing). To exercise any of these, email info@onetaphost.io. If you are a staff member, some requests may be handled together with your operator (who controls your operational data). You also have the right to lodge a complaint with your data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD) — https://www.cnpd.pt.

8. Security

We protect your data with encryption in transit, access controls (each account only sees its own organisation's data), private storage for files, and server-side rules that prevent cross-organisation access. No method of transmission or storage is 100% secure, but we work to protect your data appropriately.

9. Children

The Service is intended for business use by professional operators and their staff and is not directed to children. We do not knowingly collect personal data from children under 16.

10. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the "Last updated" date above. Material changes will be communicated through the Service where appropriate.

11. Contact

Questions or requests about this policy or your data: info@onetaphost.io — OneTapHost, operated by Gabriel Marques, Calçada Ladeira de Maceira 4, 6270-280 São Romão (Seia), Portugal.