Skip to content

ELUNIA legal documents

Privacy Policy

Version:
2026-08-20
Effective date:
20 August 2026

1. Scope

This Policy explains how the operator of ELUNIA processes personal data for its hospitality SaaS platform. The operator’s full legal name, registered address, company/VAT number and dedicated privacy email have not yet been confirmed and must be finalized before production operation. Until then, enquiries may be submitted through the contact page.

2. Data-protection roles

For account, business administration, security, billing and direct Customer-relationship data, ELUNIA generally acts as a controller and determines the purposes and means of processing.

For guest data entered by a hospitality business or collected through a survey on its behalf, that business is generally the controller and ELUNIA is its processor/service provider. The business determines the lawful basis, purposes, survey content, recipients and actions toward the guest. ELUNIA may independently process limited related data for security, fraud prevention, legal compliance and protection of the service.

3. Personal data we process

Customer and user data

  • Name, email, hashed password and verification status.
  • Organization, properties, team memberships, roles and property-access assignments.
  • Business and billing details, address, country, tax number, plan, subscription, invoices and entitlement-usage telemetry.
  • Language, date and application preferences, legal acceptances and governance/audit records.

Guest data supplied by Customers

  • Name, email, phone number, country, language and notes.
  • Property, optional unit, stay source/reference, check-in/check-out dates and stay status.
  • Survey answers, ratings, free-text feedback, issue categories, severity, assignments, notes, recovery actions and outcomes.
  • Survey invitations, transactional communication history, delivery status and suppression records.

Technical and security data

  • IP address where recorded through requests, rate limiting, webhooks or security controls.
  • Session and CSRF identifiers, timestamps, application/queue logs, available browser request metadata and audit/security events.

We do not request card numbers or CVC; those are provided directly to the configured payment provider.

4. Purposes

  • Account creation, authentication, verification, password reset and team administration.
  • Providing organizations, properties, guests, stays, surveys and recovery workflows.
  • Sending transactional email such as verification, reset, invitations, survey invitations/reminders and operational alerts.
  • Deterministic analytics, recurring-issue reporting, exports and management digests.
  • Optional AI assistance when enabled.
  • Billing, subscription management and invoices.
  • Support, security, abuse/fraud prevention, debugging, compliance and legal claims.

5. Legal bases

For activities where ELUNIA is controller, we rely as applicable on performance of a contract, legal obligations, legitimate interests in security, operation, support and fraud prevention, or consent where expressly requested and appropriate. Hospitality Customers are responsible for determining and documenting the lawful basis for guest processing performed on their behalf.

6. AI processing

When a Customer enables an AI feature, selected content may be sent to the configured provider for survey translation, case summaries, suggested response drafts or insights. Available minimization and de-identification controls are applied before sending. Output is stored as reviewable assistance and does not execute autonomous decisions or recovery. No production AI subprocessor is named here until approved; it will be identified in the maintained subprocessor register.

7. Sharing, subprocessors and transfers

We may use hosting/infrastructure, transactional email, payment, operational-monitoring and optional AI providers only as needed to deliver the service. We do not sell personal data. A separate maintained subprocessor register must be published before production operation, identifying provider, purpose, location and transfer mechanism.

Where data is transferred outside the EEA, appropriate safeguards such as an adequacy decision or Standard Contractual Clauses and supplementary measures will be used where required.

8. Cookies and local state

The current application uses only technically necessary session and security cookies/identifiers for sign-in, CSRF protection, security, and preserving language or current-organization state. No analytics or advertising cookie was detected and no cookie consent-management platform is currently used. If optional analytics or marketing cookies are introduced, this Policy and consent controls will be updated before they are enabled.

9. Retention

  • Active accounts: operational data is retained while needed to provide the service and follow Customer instructions.
  • Trial/subscription expiry: retained for up to 90 days and may then be deleted or anonymized.
  • Backups: may remain for up to 30 additional days through normal rotation.
  • Closure/deletion: handled through account controls and verified requests, subject to active legal holds.
  • Billing, tax, security and audit: retained as needed for legal, accounting, fraud-prevention, security or claims purposes.

Detailed periods for each log and accounting-record category have not yet been approved. They will be formalized in a retention schedule without limiting rights or legal duties.

10. Security

We use reasonable technical and organizational measures including password hashing, email verification, CSRF protection, rate limits, role and explicit tenant/property authorization, append-only audit evidence, signed/idempotent webhooks, secret minimization and production-readiness checks. No system is completely secure, and we do not claim ISO 27001, SOC 2 or PCI certification.

11. Rights

Subject to the GDPR and circumstances, individuals may have rights of access, correction, deletion, restriction, portability, objection, withdrawal of consent and complaint to a competent supervisory authority. Rights are not absolute and identity verification may be required.

Guests should generally contact the hospitality business acting as controller first. ELUNIA assists Customers through controlled privacy requests, exports and anonymization where applicable; we do not promise automatic fulfillment of every request.

12. Changes and contact

Material changes will be published with a new version and effective date. Where required, ELUNIA may request renewed acceptance before continued use. Questions or requests may be submitted through the contact page. The operator identity and competent supervisory-authority details will be added once confirmed before production operation.