Privacy policy

Who we are and our role

Roomtray is software for hotels: guests order food and services from a QR code in the room, and the hotel team handles the orders.

For the accounts of hotel owners, managers and staff we are the controller.

For guest orders we act as a processor on behalf of the hotel under Article 28 GDPR. The hotel is the controller and decides what data it collects from guests. The data processing agreement is part of our terms of service and is accepted at registration.

What data we process

• Hotel team accounts: name, email address, password (stored only as a hash), interface language, two-factor settings, login times and the IP address of logins.
• Guest orders: room number, ordered items, comment, order time, menu language, number of persons and the guest surname if the hotel asks for it.
• Check-in verification, if the hotel turns it on: the surname that reception enters at check-in, and the check-in and check-out time of the room.
• Spam protection: a hashed device identifier and a hashed IP address. We keep the hash, not the address itself.
• Menu statistics for the hotel: QR scans, menu and dish views, cart steps and orders, with the room, the menu language and the time. Each record carries only a short code that changes every day, so guests can be counted but not followed from day to day. No IP address, no browser details, no personal data. Records are deleted after 400 days.
• Telegram: the chat ID and name of the staff chat that the hotel connects.
• Website statistics, only with your consent: see the section on cookies and statistics.

Guests do not create accounts. We do not ask guests for an email address, phone number or payment card.

Why we process it

• To provide the service to the hotel under the contract (Article 6(1)(b) GDPR).
• For security, spam protection and the activity log, based on our legitimate interest in a safe service (Article 6(1)(f) GDPR).
• For website statistics, based on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
• For invoices and accounting, because the law requires it (Article 6(1)(c) GDPR).

We do not sell data, do not show advertising and do not use guest data for any purpose of our own.

Where and how long we keep it

All data is stored on servers in data centres in the European Union. Backups are encrypted and also stay in the EU.

Guest orders are anonymized automatically after 90 days by default: the surname, comment and device hashes are removed, while items and amounts stay for the hotel reports. The hotel can shorten or extend this period in its settings.

Hotel accounts are deleted within 30 days after the contract ends. Invoices are kept for 7 years as required by Austrian tax law.

Cookies and statistics

Guest menus, the staff order board and the admin panels use no third-party analytics. The guest menu counts visits anonymously on our own servers (see above) without any extra cookie. They set only the cookies needed to work: the session, the device, the cart and the chosen language.

This website and the login and registration pages use Google Analytics 4, but only after you agree in the cookie banner. Until then no analytics script is loaded and no statistics cookie is set. We use Consent Mode v2 with all advertising signals turned off, and we do not use the data for advertising.

Your choice is stored in your browser (localStorage) and can be changed at any time with the "Cookie settings" link at the bottom of every page. If you withdraw consent, we delete the Google Analytics cookies (_ga, _ga_*).

We also count visits to this website ourselves, on our own servers and without cookies: the page, where you came from, country, device type, browser, time on the page, scrolling and clicks. Nothing is stored in your browser and your IP address is not saved, so no consent is needed. Visits can only be told apart within one day by an anonymous code that changes every day. The legal basis is our legitimate interest in knowing which pages are useful (Article 6(1)(f) GDPR). These records are deleted after 90 days.

This website also stores one cookie with your chosen language (rf_lang) for one year.

Service providers

• Hosting and backups: data centres in the EU.
• Email delivery for login codes and invitations: a provider in the EU.
• Google Analytics 4 (Google Ireland Limited): only on this website and the login and registration pages, and only with consent. Google may transfer data to the USA under the EU-US Data Privacy Framework.
• Telegram: only if the hotel connects it. Notifications to staff contain the room number and the order. Telegram may process data outside the EU, so the hotel decides whether to use it.
• Machine translation of the menu: receives menu texts only, never guest data.

We will send the current list of providers on request.

Your rights

You have the right to access, correct and delete your data, to restrict or object to processing and to receive your data in a portable format.

Guests should contact the hotel first, because the hotel is the controller of order data. We help the hotel answer every request within 30 days.

You can also complain to a data protection authority, in Austria the Datenschutzbehörde, or the authority in your country.

Security

All connections use TLS. Passwords are stored as hashes. Owners and managers must use two-factor login. Every hotel sees only its own data, and important actions are written to an activity log.

Changes to this policy

If we change this policy in a way that matters, we inform hotels by email at least 30 days in advance. Questions: [email protected].