Privacy Policy
Last updated: March 27, 2026
1. Data Controller
The data controller responsible for processing your personal data is:
MinibarFlow
Switzerland
Email: contact@minibarflow.com
This policy applies to the MinibarFlow mobile application, website (minibarflow.com), and all related services. It explains how we collect, use, store, and protect your personal data in compliance with the EU General Data Protection Regulation (GDPR/RGPD) and the Swiss Federal Act on Data Protection (nLPD/nDSG), in force since September 1, 2023.
2. Data We Collect
2.1 Account Data
When your hotel registers for MinibarFlow, we collect:
- User name and email address
- Hotel name and property configuration (rooms, buildings, floors)
- User role (Manager, Supervisor, Employee)
Legal basis (GDPR Art. 6(1)(b)): Performance of the service contract between MinibarFlow and your hotel.
2.2 Operational Data
Through normal use of the application, we process:
- Minibar stock levels and product information
- Room check records and shift activity logs
- Trolley loading and reconciliation data
- Consumption and restocking records
- Before/after photos (when the photo verification feature is enabled)
Legal basis (GDPR Art. 6(1)(b)): Performance of the service contract. This data is necessary to operate the minibar management service.
2.3 Guest Data
Hotels may enter guest names and dietary preferences into MinibarFlow for billing and room personalization purposes. This data is provided by the hotel (not directly by the guest). In the context of this processing, the hotel acts as the data controller and MinibarFlow acts as a data processor on the hotel's behalf.
Legal basis (GDPR Art. 6(1)(f)): Legitimate interest of the hotel for accurate guest billing and service personalization.
Automatic anonymization: Guest names are automatically anonymized 30 days after the room check is completed. After anonymization, consumption data is retained for reporting purposes but can no longer be linked to any individual guest.
2.4 Technical and Device Data
To ensure the application functions correctly, we collect:
- Device type, operating system, and app version
- Crash reports and performance metrics (via Firebase Crashlytics and Performance Monitoring)
- Push notification tokens (device identifiers used to deliver notifications)
Legal basis (GDPR Art. 6(1)(f)): Legitimate interest in maintaining service reliability and fixing bugs.
2.5 Website Data
When you visit minibarflow.com, we may collect standard server logs (IP address, pages visited, browser type, referring URL). We do not use advertising cookies or third-party tracking scripts. We do not use Google Analytics.
Legal basis (GDPR Art. 6(1)(f)): Legitimate interest in website security and performance.
3. How We Use Your Data
We use your personal data exclusively to:
- Provide and operate the MinibarFlow application
- Generate reports and analytics for your hotel
- Deliver push notifications about shift events, alerts, and system updates
- Diagnose technical issues and improve the application
- Communicate with you about your account and the service
We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes. We do not use your data for profiling or automated decision-making.
4. Data Storage and Cross-Border Transfers
4.1 Storage Location
Your data is stored on Firebase (Google Cloud) servers located in Europe. All data is encrypted at rest and in transit using industry-standard encryption (TLS 1.2+, AES-256).
The MinibarFlow app also stores data locally on your device for offline functionality. This local data is synced securely with our servers when connectivity is restored.
4.2 Cross-Border Transfers
While our primary data storage is in Europe, some of our service providers are based in the United States. Google LLC (parent company of Firebase) may access data from the US for support and maintenance purposes.
Safeguards in place:
- Google LLC is certified under the EU-US Data Privacy Framework (DPF) and the Swiss-US Data Privacy Framework
- We have signed Google's Cloud Data Processing Addendum (CDPA), which includes EU Standard Contractual Clauses (SCCs)
- Data is encrypted at rest and in transit
For transfers to other countries, we rely on adequacy decisions by the European Commission or the Swiss Federal Council, or on Standard Contractual Clauses where no adequacy decision exists.
5. Sub-Processors and Third-Party Services
MinibarFlow uses the following third-party services to operate. Each acts as a data processor or sub-processor:
| Service | Purpose | Data Processed | Location |
|---|---|---|---|
| Firebase / Google Cloud | Authentication, database, file storage, hosting | All application data | Europe (primary), US (support access) |
| Firebase Crashlytics | Crash reporting | Device info, crash logs | US (Google) |
| Firebase Performance Monitoring | App performance metrics | Device info, performance traces | US (Google) |
| Expo Push Service | Push notification delivery | Device push tokens, notification content | US |
| Apple APNs | iOS push notification delivery | Device tokens | US (Apple) |
| Google FCM | Android push notification delivery | Device tokens | US (Google) |
| Cal.com | Discovery call scheduling | Name, email, meeting time | EU / US |
Each service has its own privacy policy. We ensure all sub-processors provide adequate data protection guarantees through contractual agreements (DPAs) and/or certification under applicable data privacy frameworks.
6. Data Retention
We retain data only as long as necessary for the purposes described in this policy:
| Data Type | Retention Period | Justification |
|---|---|---|
| User accounts | Duration of contract + 2 years | Contract performance + statutory limitation periods |
| Hotel operational data | Duration of contract + 10 years | Swiss commercial record-keeping (Art. 958f CO) |
| Guest names | 30 days, then anonymized | Billing accuracy, then data minimization (GDPR Art. 5(1)(e)) |
| Billing / invoice data | 10 years | Swiss tax law (Art. 958f CO, Art. 70 VAT Act) |
| Crash reports | 90 days | Debugging and service stability |
| Performance metrics | 30 days | Service optimization |
| Scheduling data (Cal.com) | Duration of relationship + 1 year | Business follow-up |
Upon account termination, we delete all associated personal data within 30 days, except where a longer retention period is required by Swiss or EU law.
7. Your Rights
Under both the GDPR and the Swiss nLPD, you have the following rights regarding your personal data:
- Right of access (GDPR Art. 15, nLPD Art. 25) — Request a copy of your personal data
- Right to rectification (GDPR Art. 16, nLPD Art. 32) — Correct inaccurate or incomplete data
- Right to erasure (GDPR Art. 17, nLPD Art. 32) — Request deletion of your data ("right to be forgotten")
- Right to restriction of processing (GDPR Art. 18) — Limit how we use your data in certain circumstances
- Right to data portability (GDPR Art. 20, nLPD Art. 28) — Receive your data in a machine-readable format
- Right to object (GDPR Art. 21) — Object to processing based on legitimate interest
- Right to withdraw consent (GDPR Art. 7(3), nLPD Art. 6(6)) — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at contact@minibarflow.com. We will respond within 30 days.
7.1 Right to Lodge a Complaint
If you believe your data protection rights have been violated, you have the right to lodge a complaint with:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC/PFPDT) — edoeb.admin.ch
- EU: Your national data protection authority (see EDPB member list)
8. Cookies and Tracking
The MinibarFlow website (minibarflow.com) does not use advertising cookies, social media trackers, or third-party analytics tools. We use only essential technical cookies required for the website to function (e.g., session management).
The MinibarFlow mobile application collects technical data through Firebase Crashlytics and Performance Monitoring for debugging and service improvement purposes. This data collection is disclosed in Section 2.4 above.
9. Automated Decision-Making
MinibarFlow does not use automated decision-making or profiling as defined by GDPR Art. 22 or nLPD Art. 21. All decisions that affect users are made by human administrators.
10. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- Role-based access control within the application
- Firebase security rules restricting data access by user role
- Regular security reviews and code audits
- Automatic guest data anonymization after retention period
11. Data Breach Notification
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will:
- Notify the FDPIC (Swiss Federal Data Protection Commissioner) as soon as possible, in accordance with nLPD Art. 24
- Notify the relevant EU supervisory authority within 72 hours where required by GDPR Art. 33
- Inform affected individuals without undue delay if the breach is likely to result in a high risk to their rights (GDPR Art. 34, nLPD Art. 24(4))
12. Data Processing Agreement
When MinibarFlow processes personal data on behalf of a hotel (in particular guest data), MinibarFlow acts as a data processor and the hotel acts as the data controller. The relationship is governed by a Data Processing Agreement (DPA) in accordance with GDPR Art. 28 and nLPD Art. 9, which is provided to hotel customers as part of the service agreement.
13. Changes to This Policy
We may update this privacy policy from time to time. We will notify active users of significant changes via email at least 30 days before they take effect. The "last updated" date at the top reflects the most recent revision.
14. Contact
For any questions about this privacy policy, your personal data, or to exercise your rights, contact us at:
MinibarFlow
Email: contact@minibarflow.com