Privacy Policy

1. Data Controller & Data Processor Relationship

CloudReef operates under a dual-role model:

Data Processor: When handling guest personal data (names, identity documents, contact information, booking details), CloudReef acts as a data processor on behalf of the property operator (the data controller). We process this data solely according to the property operator's instructions and applicable service agreements.

Data Controller: For staff account data (names, email addresses, roles, authentication credentials), CloudReef acts as the data controller, determining the purposes and means of processing.

Data Processing Agreements (DPAs) are available upon request for all property operators.

2. Categories of Personal Data Collected

2.1 Staff Account Data

• Full name, email address, assigned role (owner, manager, front desk, kitchen, housekeeping, server, viewer)
• Authentication identifiers (Supabase Auth UID, session tokens)
• Activity status (active/inactive)
• Last login timestamps

2.2 Guest Data (Processed on Behalf of Property Operators)

• Full name, email address, phone number
• Nationality, identity document type and number
• Physical address
• Booking details: check-in/check-out dates, room assignment, booking reference, booking source (direct, OTA)
• Payment status and billing records
• Order history (food & beverage, activities)
• Communication records (conversations, messages)

2.3 Operational Data

• Menu configurations, inventory records, room status
• Invoice records and payment transaction references
• Activity schedules and bookings
• QR code assignments

2.4 Technical Data

• Browser user agent strings, page URLs visited within the platform
• Error logs (message, stack trace, source, severity level)
• Platform interaction patterns for performance optimization
• IP addresses (collected by infrastructure providers, not stored by CloudReef application layer)

3. Legal Basis for Processing

4. Data Processing Activities

4.1 Reservation Management

Guest booking data is received from property operators (manually entered or synced via channel manager integration) and stored in the CloudReef database. Each booking record is associated with a specific property and isolated at the database level via Row Level Security policies.

4.2 Point of Sale & Kitchen Display

Food and beverage orders are processed in real-time using Supabase Realtime channels. Order data includes menu items, quantities, room/table assignment, and payment status. Orders are linked to guest profiles when a booking association exists.

4.3 Guest Communication

The platform facilitates communication between property staff and guests through an integrated messaging system. Messages are stored in the database and associated with specific conversations, bookings, and guest profiles.

4.4 Error Tracking & Diagnostics

Client-side and server-side errors are automatically captured and logged for platform stability monitoring. Error logs include: error message (truncated to 2,000 characters), stack trace (truncated to 5,000 characters), error source classification, page URL at time of error, and browser user agent. Error logs are deduplicated within a 5-second window to prevent log flooding. A pattern-matching system classifies known errors and suggests automated remediation actions.

4.5 File Storage

Property operators may upload images (menu item photos, property assets) to the platform. Files are processed (resized, compressed to JPEG format) before storage and served via authenticated CDN endpoints.

5. Data Storage & Infrastructure

Data Residency: Primary database is hosted in the European Union (AWS Frankfurt region). Edge caching through Cloudflare and Vercel does not persistently store personal data outside the primary region.

6. Data Retention

Upon contract termination, all property data is permanently deleted within 30 calendar days upon written request.

7. Data Sharing & Sub-Processors

CloudReef does not sell, rent, or trade personal data. Data is shared only with the following sub-processors, strictly for platform operation:

Property operators are notified of any changes to this sub-processor list at least 30 days in advance.

8. Data Subject Rights

Under GDPR, CCPA, and applicable data protection legislation, individuals have the following rights:

• Right of Access - Request a copy of personal data held about them
• Right to Rectification - Request correction of inaccurate personal data
• Right to Erasure ("Right to Be Forgotten") - Request deletion of personal data where no legal basis for continued processing exists
• Right to Restriction - Request limitation of processing in specific circumstances
• Right to Data Portability - Receive personal data in a structured, machine-readable format (JSON)
• Right to Object - Object to processing based on legitimate interest
• Right to Withdraw Consent - Where consent is the basis for processing

For Guest Data: Requests should be directed to the property operator (data controller) in the first instance. The property operator may then instruct CloudReef to fulfill the request.

For Staff Data: Requests should be directed to [email protected]. We respond to all requests within 30 calendar days.

Supervisory Authority: You have the right to lodge a complaint with your local data protection supervisory authority.

9. International Data Transfers

When personal data is transferred outside the European Economic Area (EEA), CloudReef ensures adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Sub-processor certifications (SOC 2, ISO 27001)
• Data Processing Agreements with all sub-processors

10. Children's Data

CloudReef does not knowingly collect personal data from children under 16 years of age. Guest records for minors are the responsibility of the property operator and must be associated with an adult guardian's booking.

11. Updates to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated to property operators via email at least 30 days before taking effect. The "Last Updated" date at the top of this policy reflects the most recent revision.

12. Contact