Privacy Policy

1. Data Controller

RoomAtlas ("we", "us", "our") is the data controller for personal data collected through this website and the RoomAtlas application. The service is operated by nJoylab, a company registered in Italy — VAT number: IT12822520966. For privacy-related enquiries, contact us at privacy at roomatlas dot app.

2. Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, and password hash when you register.
• Organisation data: company name, billing address, and VAT number for paid subscriptions.
• Usage data: booking records, room usage logs, and feature interactions within the application.
• Technical data: IP address, browser type, device identifiers, and access timestamps collected automatically by our infrastructure.
• Communication data: messages you send to our support team.

We do not collect sensitive personal data (e.g. health, financial, or biometric information).

3. How We Use Your Data

We use your personal data to:

• Provide, maintain, and improve the Service.
• Process payments and manage your subscription.
• Send transactional emails (booking confirmations, account alerts, invoices).
• Respond to support requests.
• Detect and prevent fraud or abuse.
• Comply with legal obligations.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

4. Legal Basis for Processing (GDPR)

Where the GDPR applies, we process your data on the following legal bases:

• Contract performance: processing necessary to deliver the Service under the subscription agreement.
• Legitimate interests: service security, fraud prevention, and product improvement.
• Legal obligation: compliance with tax, accounting, and regulatory requirements.
• Consent: for optional marketing communications, which you may withdraw at any time.

5. Data Retention

We retain account data for the duration of your subscription plus 30 days after termination, to allow data export. Billing records are retained for 10 years as required by Italian tax law. Anonymised usage analytics may be retained indefinitely.

6. Third-Party Services

We use a limited number of carefully vetted sub-processors to operate the Service, including:

• Stripe, Inc. — payment processing, billing, and invoicing. Stripe processes payment card data, billing information, and generates electronic invoices on our behalf.
• Cloud infrastructure providers — hosting and storage of application data.
• Cloudflare, Inc. — DNS, content delivery network (CDN), DDoS protection, and web security. Cloudflare processes IP addresses and traffic metadata for the Service and all tenant subdomains (<tenant>.roomatlas.app).

These parties process data only on our instructions and under data processing agreements that comply with GDPR requirements. A current list of sub-processors is available on request.

7. International Data Transfers

Your data is primarily processed within the European Economic Area (EEA). Payment data processed by Stripe may be transferred to and processed in the United States. Traffic data processed by Cloudflare may also be transferred to the United States or other countries where Cloudflare operates. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework.

8. Your Rights

Under applicable data protection law, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), where legally permitted.
• Restrict or object to certain processing activities.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email privacy at roomatlas dot app. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

9. Cookies

The RoomAtlas marketing site uses a minimal set of cookies strictly necessary for functionality (e.g. language preference). The application uses session cookies required for authentication. We do not use advertising or third-party tracking cookies.

10. Security

We implement industry-standard technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest, and access controls. However, no system is completely secure and we cannot guarantee absolute security.

11. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the Service. The date at the top of this page reflects the most recent revision.

13. Contact

For any privacy-related questions or requests, contact us at privacy at roomatlas dot app.