Privacy at Vyrobel

What we collect, why we hold it, where it lives and for how long — and, where a thing is not yet decided, that it is not yet decided.

1 · Who we are

Vyrobel is hotel-management software. When an accommodation operator uses Vyrobel to manage their guests, the operator is the controller of that guest data and Vyrobel is the processor acting on their instructions. For the operator's own account data — the people who sign in, their roles and their activity — Vyrobel is the controller.

Pending: the registered legal entity, its address and company number are to be confirmed by counsel and will appear here.

2 · What we collect

• Guest data — name, contact details, stay dates, reservation and folio records, and, where an operator uses online check-in, identity-document images.
• Operator, owner and staff data — name, work email, role, and activity in the product, including rostering and leave records.
• Payment references — we never see or store a card number. Card payments run through Stripe's hosted checkout and we hold only the resulting reference.
• Security and audit records — who changed what and when, including IP address and browser user-agent, held in append-only stores.
• Enquiries — anything you type into a contact form, and booking enquiries that were started but never completed.
• Sign-in identity — if you sign in with Google we store Google's stable account identifier and the email address on that account. We never receive your Google password.
• Browser storage — in addition to the cookies listed below, the app keeps a booking draft and a recent-search list in your browser's local storage.

3 · Why we hold it

To provide the product: to take and manage a booking, to run the front desk, to bill and account for it, to send the transactional messages a stay requires, and to keep the security record that tells an operator who did what. Guest marketing messages are sent only where a guest has given separate, recorded consent, and every one carries an unsubscribe.

Pending: the lawful basis for each category is to be set by counsel. We would rather leave this open than assert a basis we have not confirmed.

4 · Where it lives, and for how long

Vyrobel runs on shared hosting provided by Hostinger, and the database sits with it. We make no data-residency commitment yet — choosing a region is a decision that has not been taken, and we would rather say so than imply otherwise.

On encryption, precisely: traffic to the site is encrypted in transit (HTTPS, enforced). At rest, encryption is applied at the application level to specific sensitive columns — guest email addresses and phone numbers among them — and is not whole-disk or whole-database encryption. Guest names, stay dates and reservation details are not in that encrypted set.

Two retention rules are implemented and run daily: an erased guest's personal details are removed after a 14-day reversible window, and uploaded identity documents are purged after 30 days. That 30-day window is a product default, not a per-country legal period.

Pending, and stated plainly: most other categories have no retention rule yet. A period has to be chosen and then built, in that order, and we will not print a period the software does not enforce.

5 · Who else processes it

Today the product can transmit data to:

• Stripe — card payments and, for owner payouts, identity verification. Live card processing is not yet switched on.
• Hostinger (email) — transactional email: booking confirmations, account verification, password resets and invitations, sent from a vyrobel.com mailbox. It receives the recipient's address and the message itself. Not yet active: no email is currently being delivered from this system.
• Google — only if you choose to sign in with Google, and only your identifier, email and basic profile.
• Hostinger — hosting and storage.

Channel-manager and AI-assistant integrations exist in the product but are not connected, so no data reaches them.

Pending: each of the above needs a named entity, its processing location, a signed agreement under Article 28 and a transfer mechanism where processing happens outside the EEA. That work is not finished.

6 · Your rights, and which are self-service today

Rights differ by who you are, and we would rather be specific than uniform:

• Correction — available in the product to guests, owners and operator staff.
• Erasure — self-service for guests, with a 14-day reversible window. Owners and operator staff must ask us.
• Access and portability — self-service for owners and operator staff. A guest cannot yet export their own data; ask us and we will do it.
• Objection and restriction — no self-service mechanism exists yet; ask us.
• Account closure — closing an account withdraws access and makes the workspace read-only. It is not deletion, and we would rather name that difference than blur it.

7 · Cookies

Vyrobel sets 4 cookies. All of them are strictly necessary. There are no analytics cookies, no marketing cookies and no third-party cookies, and the site makes no third-party request of any kind. The table below is generated from the application's own catalogue, so it cannot drift from what is actually set.

8 · Contact

Write to sales@vyrobel.com for any privacy question or to exercise a right. A dedicated privacy address will be published here once counsel has settled the process.