Privacy Notice

This Privacy Notice explains how SpeedInn processes personal data when you visit our websites, create a business account, use the web or mobile applications, contact support, or use the SpeedInn platform to manage guest records.

1. Who we are

SpeedInn is the controller for account, billing, and website data. For guest identity data uploaded by a hospitality operator, that operator is typically the controller and SpeedInn acts as a processor under its documented instructions. The operator is responsible for identifying its lawful basis, deciding which guest data is required, and providing any guest-facing privacy information required by law.

2. Data we process

• Account data: name, email, password hashes, workspace membership, billing identifiers.
• Guest/operational data: document images, extracted identity fields, identity-document and stay details, operator corrections, review decisions, and related audit metadata.
• Technical data: IP address, device/browser metadata, logs, and security events.
• Support and communications: messages, readable support reference, delivery status, and the minimum information needed to respond.

We receive account and support data from you, guest data from the accommodation operator, and technical data from the device, browser, and infrastructure used to deliver the Service. We do not intentionally collect identity images from public website visitors.

3. Purposes and legal bases

• provide the Service, authenticate users, and maintain workspaces (contract);
• bill subscriptions and usage (contract / legal obligation);
• secure the platform and prevent abuse (legitimate interests / legal obligation);
• provide support and essential service communications (contract / legitimate interests);
• comply with applicable law and respond to valid lawful requests (legal obligation).

4. Document images and extraction

Document images are processed to extract candidate fields. They remain in private storage only until the absolute deletion deadline of one hour after completed upload and may be viewed by authorised workspace users until that deadline. Approval, navigation, or a new download link cannot extend it. Temporary links expire sooner and are issued only after an authorisation check.

Extracted fields are candidates until an authorised operator reviews and approves them. SpeedInn does not determine whether a document is authentic and does not make a solely automated decision that produces legal or similarly significant effects about a guest.

5. Guest records and retention

Operational guest, identity-document, and stay data is retained for a maximum of twelve calendar months after the guest record is first created. The workspace shows the exact deadline and provides advance warnings and export controls. At expiry, records are deleted or anonymised through an automated, reconciled process.

A narrowly scoped record may be restricted from deletion only where the accommodation operator documents an applicable legal hold. Compliance artifacts, mandatory accounting records, minimal deletion evidence, and encrypted backups have separate, documented lifecycles and do not silently renew the operational guest record.

6. Sharing and subprocessors

We use vetted service providers for infrastructure, private object storage, email delivery, payments, security, and configured extraction. Providers receive only the data needed for their purpose and are subject to contractual and technical safeguards. Current provider information is available on our Technology Providers page. We do not sell personal data or use guest identity data for advertising.

We may disclose data where required by valid law, to protect the Service and its users, or as part of a corporate transaction subject to appropriate confidentiality and continuity safeguards.

7. International transfers

Where data is transferred outside the EEA/UK, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

8. Other retention

Account data is retained while the business account is active and for the limited period needed for security, disputes, and legal obligations afterwards. Export files expire by default after 24 hours. Security and audit metadata may be retained longer where it excludes raw identity values and is needed to demonstrate access, deletion, or incident handling. Backup copies expire according to the documented backup schedule; restored data is checked against pending deletions before it becomes available.

9. Export, erasure, and workspace deletion

Workspace owners can request a guest-data export and can manage guest erasure subject to a documented legal hold. Workspace deletion is initiated only from the authenticated web app after password reauthentication, a single-use email challenge, and a final confirmation. Access is frozen and the purge runs as a staged process. The mobile app does not schedule workspace deletion.

10. Your rights

Depending on your location, you may have rights to access, rectify, erase, restrict, or object to processing, data portability, and to lodge a complaint. Guest requests should normally be directed first to the accommodation operator that collected the data. You may also contact privacy@speedinn.app or your local supervisory authority. We may need to verify identity and authority before acting on a request.

11. Security

We apply technical and organisational measures appropriate to the risk, including tenant isolation, access controls, encryption, private storage, short-lived links, audit trails, data minimisation, deletion reconciliation, and incident procedures. No method of transmission or storage is perfectly secure, so customers must also protect their accounts and devices.

12. Changes and contact

We version this notice and update the date above when material terms change. Where required, we will provide notice in the Service or request a new acknowledgement. Privacy questions: privacy@speedinn.app.