Privacy Policy
This policy explains what personal data SMRTROOM collects, why, and what happens to it. SMRTROOM is operated by Arya Monte Company, Mainski put br. 62, 85310 Budva, Montenegro (PIB 3709752), info@smrtroom.com.
1. Two roles: your account data and your guests' data
- For the data about you as a user (your e-mail address, login, support requests, usage logs) we are the data controller.
- For the data about your guests that you enter into the application (names, stay dates, headcount, prices, notes), you are the data controller and we are your data processor. We process that data only on your instructions, as set out in the Data Processing Addendum.
2. What we collect
2.1 Account and hotel data
- E-mail address and a password hash (held by Google Firebase Authentication; we never see the password).
- Hotel profile: name, country, time zone, currency.
- API keys you create, with their label, creation and last-use time.
2.2 Operational data you enter (we process this for you)
- Rooms: numbers, types, capacity, bed layout, cleaning status, prices.
- Reservations: guest name, check-in/out dates, number of guests, price, booking reference and source, status, and free-text notes. Notes may contain whatever you type, including phone numbers, e-mail addresses or identity-document numbers. We recommend keeping such identifiers out of notes unless you are legally required to retain them.
- Expenses and income entries.
2.3 Technical and security data
- Audit log of changes to reservations and rooms (what changed, when, from which IP address and browser).
- Server logs and client-side error reports (error message, page URL, browser type). Error reports are deleted after 30 days.
- Support messages you send through the contact form (name, e-mail, message, page, hotel identifier).
- Browser storage (see Cookie Policy). We do not run advertising or analytics trackers.
3. Why we process it (legal bases)
- Performance of a contract (the Terms of Service): to run your account and the application.
- Legitimate interests: security, abuse prevention, audit trail, fixing errors, answering support requests.
- Legal obligations: where we must keep or disclose records by law.
- Your guests' data is processed on your instructions as processor; the legal basis is yours.
4. Where the data is stored and who helps us
We use the following sub-processors. All of them are bound by data-processing terms.
| Provider | Purpose | Location |
|---|---|---|
| Google LLC (Cloud Firestore, Cloud Storage) | Database and its daily backups | European Union (Belgium, europe-west1) |
| Google LLC (Firebase Authentication, Cloud Run / Cloud Functions) | Login, API hosting | United States (us-central1); Firebase Authentication is a global service |
| Vercel Inc. | Hosting of the website and web application | United States / global edge network |
| Telegram FZ-LLC | Notifying our support team of new contact-form messages (the message text is forwarded) | United Arab Emirates / EU |
The database and its backups stay in the European Union. The API and the website are served from the United States, so data is also transferred outside the European Economic Area and outside Montenegro. For Google and Vercel we rely on the EU Standard Contractual Clauses included in their data-processing terms and, where applicable, the EU-US Data Privacy Framework. We will update this list before adding a sub-processor; customers with a signed DPA are notified in advance.
5. How long we keep data
- Account and operational data: for as long as your account exists. After a verified deletion request, deleted within 30 days.
- Backups: daily copies are kept for a limited rolling period (currently up to 30 days) and then overwritten.
- Audit log: for as long as the hotel account exists.
- Client error reports: 30 days.
- Support messages: up to 24 months after the request is closed.
6. Security
- All traffic is encrypted in transit (TLS, HSTS). Data is encrypted at rest by Google Cloud.
- Each hotel's data is isolated by database security rules and by API keys that are bound to one hotel.
- Passwords are handled by Firebase Authentication; API keys are random 128-bit values that can be revoked individually.
- Daily automated database backups kept for 30 days, plus 7-day point-in-time recovery of the database.
No system is perfectly secure. If we learn of a personal-data breach affecting you, we will inform you without undue delay and, as your processor, within 72 hours of becoming aware of it.
7. Your rights
Depending on your country you may have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to complain to a supervisory authority. Write to info@smrtroom.com; we answer within 30 days. If you are a guest of a hotel that uses SMRTROOM, please contact that hotel: it is the controller of your data and we will support it in answering you.
8. Children
The Service is a business tool and is not directed at children under 16. We do not knowingly collect account data from them.
9. Changes
We will post updates on this page and change the date above. Material changes are also announced by e-mail or in the application.
10. Contact
Arya Monte Company · Mainski put br. 62, 85310 Budva, Montenegro · info@smrtroom.com