Privacy Policy
Last updated 28 August 2026
HubAmenity is an in-room consumption and inventory product for hotels, operated by HUB TECH SERVICOS ESPECIALIZADOS LTDA under the HubSuiteEU platform. This policy explains what data we handle, why, where it lives, and who can reach it.
Two things are true of this product by construction, not by policy:
- We do not receive guest personal data. Our Apaleo application is configured to omit all personal information, and our database has no column for a guest name, email address, phone number or identity document anywhere in its schema.
- We hold the minimum required to post a charge. Where a guest must be identified, we hold the reservation identifier issued by your property management system — nothing behind it.
Our two roles
As a processor. For the operational data of your property — consumption records, restocking, inventory, reservation identifiers, room numbers, folio postings — you are the controller and we act on your instructions. A separate data processing agreement under Article 28 GDPR governs this relationship and forms part of the contract and is provided at signature.
As a controller. For the accounts of the people who use HubAmenity — your managers and your housekeeping staff — we decide how that limited data is handled, and this policy applies directly.
What we hold
Manager accounts. Email address, authentication credentials held as a hash, language preference, and a record of sign-in events.
Housekeeping staff. A display name chosen by the property, and a four-digit access code held as a hash. There is no email address and no password for floor staff; this is deliberate, so that using the product does not require the property to collect more about its own employees than it already has.
Operational records. Each consumption or restocking entry holds the item, quantity, room, timestamp, the staff member who recorded it, an idempotency key created on the device, and — where a charge applies — the reservation identifier the charge was posted to.
Reservation context read from your PMS. Occupancy, cleanliness status, stay dates and the reservation identifier. Read and displayed; never stored beyond what an audit requires, and never written back.
Technical records. Request identifiers, error traces and timing information used to diagnose faults, retained for a limited period.
We do not use cookies for advertising, we do not embed third-party trackers in the product, and we do not sell or share data with anyone for their own purposes.
Why we hold it
To provide the product under our contract with your property; to post charges correctly and exactly once; to produce the Revenue Leakage Audit; to keep the service secure and diagnose faults; and to meet accounting and legal obligations. Where we rely on legitimate interests — principally security and fault diagnosis — we have assessed that interest against the rights of the people concerned.
Where the data lives, and who can reach it
Storage and processing take place in the European Union. Our database, authentication and background processing run on Supabase infrastructure in AWS eu-central-1 (Frankfurt, Germany). The manager dashboard and the housekeeping application are served from Vercel's Frankfurt region. Correspondence sent to our support and privacy addresses is held by mailbox.org in Berlin, Germany.
We state residency per component rather than as a single claim, because a provider that sends from the EU does not necessarily store in the EU — and the second question is the one that matters.
Access from outside the European Union. Hub Tech is established in Brazil, and our support and engineering personnel are located there. To provide support, diagnose faults and maintain the service, those personnel may access data stored in the European Union. Brazil is not covered by a European Commission adequacy decision, so this access is a transfer to a third country and is governed by Standard Contractual Clauses together with additional technical measures — principally that no guest personal data exists in the system to be accessed.
We state this plainly because where data is stored and who can reach it are different questions, and your data protection officer will ask the second one.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, background processing | AWS eu-central-1, Frankfurt, Germany |
| Vercel | Application hosting, delivery and DNS | Frankfurt region |
| Apaleo | Your property management system, at your instruction | European Union |
| mailbox.org | Support and institutional email correspondence | Berlin, Germany |
We do not currently operate an automated transactional email provider. When we do, this table will name it and state where it stores data, before it processes anything of yours.
An up-to-date list forms part of the contract and is provided at signature. We will inform properties before adding or replacing a sub-processor.
How long we keep it
Operational records are retained while your property uses the product and for the period your accounting obligations require, so that an audit remains reproducible after the fact. Technical records are retained for a short diagnostic window. When a property ends its contract, we delete or return operational data on request, subject to obligations that require us to keep it.
Security
Access to data is enforced at the database level, so that each property reaches only its own records. Credentials and access codes are stored as hashes and never in readable form. Our Apaleo application requests only the four permissions the product needs — reading reservations, reading property setup, and reading and managing folios — and no more. Transport is encrypted throughout.
Your rights
If your data is held by us, you may request access, correction, deletion, restriction of processing, portability, and you may object to processing based on legitimate interests. If you are a member of housekeeping or management staff, address your request to your property first, as they hold the relationship with us; we will assist them promptly. You may also lodge a complaint with your national data protection authority.
Changes
We will post any change to this policy on this page with a new date, and we will inform properties directly of any change that materially affects their data.
Contact
HUB TECH SERVICOS ESPECIALIZADOS LTDA
Caldas Novas, Goiás, Brazil
Email: privacy@hubamenity.com
For data processing agreements under Article 28 GDPR, write to the same address.