Privacy Policy

The data controller for personal data processed through the Service is Vabumi OÜ, a company registered in Estonia (registry code 17426329), with its registered office at Järvevana tee 9, 11314, Kesklinna linnaosa, Tallinn, Harju maakond, Estonia.

For any privacy question or to exercise your rights, contact us at [email protected].

We collect the following categories of personal data:

• Account data — name, work email, organisation, role, and authentication identifiers when you or your employer create an account.
• Operational data — the tasks, routines, notes, photos, voice memos, and other content you and your team enter to run your properties. This may incidentally include personal data about staff or guests that you choose to record.
• Usage data — log data, device and browser information, and product analytics about how the Service is used.
• Communications — messages you send us, demo bookings, and support requests.

We use personal data to:

• provide, operate, secure, and improve the Service;
• authenticate users and enforce per-tenant access controls;
• respond to enquiries, bookings, and support requests;
• send service-related and, where permitted, occasional product communications;
• comply with legal obligations and protect against misuse or fraud.

We rely on the following lawful bases:

• Contract — to deliver the Service to you or your organisation.
• Legitimate interests — to secure, maintain, and improve the Service and to communicate with prospective customers, balanced against your rights.
• Consent — for non-essential analytics or marketing where required; you may withdraw consent at any time.
• Legal obligation — where processing is required by law.

We do not sell personal data. We share it only with service providers who process it on our behalf under data-processing agreements, including:

• cloud hosting and database infrastructure (Supabase, Railway);
• payment processing (Stripe), for billing;
• analytics, error monitoring, and email delivery providers.

We may also disclose data where required by law or to protect our rights, and in connection with a merger, acquisition, or asset sale.

We aim to host and process personal data within the European Economic Area. Where a provider processes data outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

We keep personal data for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, accounting, or reporting obligations. Operational data is deleted or returned in line with your organisation’s agreement with us.

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data;
• restrict or object to certain processing;
• data portability;
• withdraw consent where processing is based on consent.

To exercise these rights, contact [email protected]. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority. Where we act as a processor on behalf of your organisation, please direct requests to that organisation.

We use technical and organisational measures including encryption in transit, tenant-level isolation (row-level security), access controls, and monitoring. No system is perfectly secure, but we work continuously to protect your data.

We use strictly necessary cookies to operate the Service (for example, to keep you signed in) and, where you consent, analytics cookies to understand product usage. You can control cookies through your browser settings.

The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from children.

We may update this policy from time to time. Material changes will be posted on this page with a revised “last updated” date.