Privacy Policy

for the website staygrid.cloud and the “StayGrid” app for iOS and Android · Last updated: 25 October 2026 · Deutsche Fassung. If the two versions differ, the German version prevails.

1. Controller

We have not appointed a data protection officer because the requirements of Art. 37 GDPR and § 38 BDSG are not met. Please send any privacy questions to the address above.

2. Two roles: app provider and service provider to the hotel

StayGrid is software for accommodation businesses. The app is intended for their staff. Accounts are created by the hotel; there is no sign-up inside the app.

• As provider of the app and the website we are the controller for what is needed to provide and securely operate them: sign-in, sessions, abuse prevention and delivering the website (sections 3 to 6).
• For the content you work with in StayGrid (reservations, guests, registration forms, invoices, cash book, cleaning schedule, your user account and working time), the hotel you work for is the controller. We process this data only on its behalf and according to its instructions (Art. 28 GDPR). Requests about this data are best addressed to the hotel; we support it in answering them.

This content may include health data: if the hotel offers an exemption from the tourist tax on the registration form, for example for severe disability, and a guest selects it, that is special-category data under Art. 9 GDPR. It is stored on behalf of the hotel like the rest of the registration form, visible in the app only to authorised staff, and deleted together with the registration form.

3. What the app processes

Sign-in and session

To sign in, you send your email address or user name and your password. We store the password only as a cryptographic hash. After signing in, the app receives a random session token. It is kept on your phone in the Keychain (iOS) or encrypted with a key from the Android Keystore, and it is excluded from device backups.

For each session our server stores: the user account, start and last activity, the IP address at sign-in and the device and operating system identifier sent by the app (user agent, at most 300 characters). This lets you and the hotel see signed-in devices and sign them out.

A session ends when you sign out, when the hotel ends it, after 30 days without use, and at the latest after 180 days. It is deleted seven days later.

We count failed sign-in attempts per account and origin to prevent password guessing. These counters are deleted seven days after the last failed attempt.

Legal basis: Art. 6(1)(b) GDPR (providing the app you use) and Art. 6(1)(f) (our legitimate interest in secure operation).

Passkeys

Instead of a password, you can sign in with a passkey. For this we store only its public key with its identifier, the name you give it, and when it was created and last used. Your fingerprint or face is checked solely by your device; this data never leaves it and we do not receive it. If you remove the passkey, we delete the stored key as well. Legal basis: Art. 6(1)(b) GDPR.

Protection against misuse

For security-relevant actions we store a security event with the full IP address of the request: changes to bank details and payment accounts, to roles and support access, to API access, webhooks and channel connections, as well as exports, sign-ins from a new device, a failed password confirmation and unusually large data retrievals. The event records who did what and when; details such as an IBAN appear only shortened, guest names never. The purpose is to detect, prevent and, where necessary, report misuse and attacks, and to block attacking addresses. A truncated address is not sufficient for this.

After 180 days we truncate the address to its network (IPv4 to /24, IPv6 to /48) so that it can no longer be linked to a connection; the event itself is deleted after two years. The application log and a counter of requests per access hold the full address for 30 days.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the security of the service and of the guest data processed in it.

Face ID, Touch ID and fingerprint

The app locks when it starts and after five minutes in the background, and it can be unlocked with your phone’s screen lock. The check is performed solely by the operating system. The app only learns whether it succeeded; neither the app nor we receive any biometric data.

Camera: scanning business cards

When you trigger it, the app photographs a business card to suggest a company’s name and address. Text recognition runs on the device: Apple Vision on iOS, Google ML Kit on Android, each with a bundled model. The photo is not sent to us and is not stored by the app. Only what you accept into the form and save reaches the server. You can revoke camera access at any time in your phone’s settings.

Photos you deliberately take or select for upload, such as a receipt in the cash book, are different: that single image is sent to the server and stored on behalf of the hotel. The app only sees the image you pick, not your photo library.

Note on Android: Under Google’s terms, Google ML Kit sends device information (manufacturer, model, OS version), app information (package name, version), a random installation identifier and performance and usage metrics of the text recognition to Google in order to operate and improve the service. Images and recognised text are not sent. The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to the USA is possible and covered by the adequacy decision for the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR; our interest is text recognition that works without uploading the photo.

Files

When you open an invoice or an export, the app places the file in the app’s cache and hands it to your phone’s preview or share sheet. Only the most recently opened file is kept there; it is replaced the next time. What you pass on via the share sheet is up to you.

Readable copy during network outages

So that work can continue during a network outage, the app keeps a read-only copy of the arrivals list, the in-house list and the room status for yesterday, today and the coming days on the device. It removes older days by itself and deletes the copy entirely when you sign out or the session expires.

Updates

The app downloads new versions of its interface from our server at app.staygrid.cloud and verifies their signature before switching. This involves only the usual data of a request (IP address, device identifier); there is no separate identifier or statistic for it.

Notifications

On Android, the staff app can show notifications such as “Schedule changed”, “Room vacant” or “Rework needed”. This only happens if you switch it on in the app and your phone allows it. Notifications are delivered via Google’s Firebase Cloud Messaging. For this, Google receives an identifier of your device for this app and the title and text of each notification. The text names only a room number or a date, never a guest. Unlike browser notifications, it is not end-to-end encrypted on its way through Google. We store the identifier with your session and delete it when you sign out, switch notifications off or the session expires. Firebase Analytics is disabled. The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to the USA is possible and covered by the adequacy decision for the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR (you switching it on), revocable by switching it off in the app or in your phone’s settings. Notifications are not yet available on iOS; if they are added, we will update this policy beforehand.

What the app does not do

• No advertising, no tracking, no third-party analytics or crash reporting
• No access to location, contacts, microphone, calendar or your photo library as a whole
• No sharing or selling of data to third parties
• No payment card data and no copies of ID documents, not even on behalf of the hotel

App Store and Google Play

When you download the app, Apple or Google process data under their own responsibility, such as your account and the download. If you have agreed in your phone’s settings, Apple and Google provide us with aggregated statistics and crash reports that do not identify you. See the privacy notices of Apple and Google for details.

4. Servers and service providers

The app and the web application communicate only with our server at app.staygrid.cloud, encrypted with TLS. Our logs contain no search terms; they hold the IP address for 30 days (see “Protection against misuse” in section 3). We use the following service providers, each under a data processing agreement:

5. The website staygrid.cloud

This site runs on a server we operate ourselves, located in a data centre of IONOS SE, Montabaur, Germany, which acts as our processor. It is separate from the StayGrid application. When you visit, the server processes your IP address and your browser’s request data (requested address, time, status code, user agent and, where sent, the referring page), because it cannot deliver the page or detect attacks otherwise (Art. 6(1)(f) GDPR). These access logs are deleted after seven days. The site sets no cookies, loads no fonts, scripts or images from third-party servers and uses no analytics. If you email us, we use your details to reply (Art. 6(1)(b) or (f) GDPR) and delete them once the matter is closed and no retention obligation applies.

6. Retention

• Sessions: until seven days after they end (see section 3)
• Website access logs: seven days (see section 5)
• Failed sign-in counters: seven days after the last failed attempt
• Security events: full IP address for 180 days, then truncated; the event itself for two years (see section 3)
• Application log and request counters: 30 days
• Passkeys: until you remove the passkey or the account is deleted
• User account: as long as the hotel keeps it
• Content processed on behalf of the hotel: according to its instructions and statutory periods, e.g. ten years for invoices under § 147 of the German Fiscal Code
• Data on the phone: until you sign out or delete the app

7. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). Write to datenschutz@staygrid.cloud. If your request concerns data we process on behalf of a hotel, we forward it to the hotel.

You may also lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

8. Deleting your account

Your user account belongs to the hotel that created it. To have it deleted, contact the hotel or datenschutz@staygrid.cloud; we will take care of it together with the hotel. To remove the data on your phone, sign out or delete the app.

9. Security

All transmission is encrypted. Data of different hotels is separated in the database by row-level security policies, ID document numbers are stored encrypted, and backups leave the server only in encrypted form.

10. Children

The app is a work tool and is not directed at children.

11. Changes

If what the app processes changes, we will update this policy beforehand. The version published here applies.