Privacy Policy

1. Introduction

LobbyFlight ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our flight information display service.

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the service.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us when you:

• Create a hotel account
• Subscribe to our service
• Contact our support team
• Subscribe to our newsletter

This information may include:

• Hotel name and contact person name
• Email address
• Phone number
• Hotel address
• Payment information (processed securely by Stripe)

2.2 Usage Information

We automatically collect certain information when you use our service:

• Display device information (browser type, operating system)
• IP address
• Display uptime and performance metrics
• Error logs and diagnostic information
• Feature usage statistics

2.3 Flight Data

We process flight information (flight numbers, schedules, delays, gates) from aviation data providers to run the flight boards. For the Flight Concierge, flight data is linked to individual hotel guests; see section 2.4.

2.4 Guest Data (Flight Concierge)

When a hotel uses the Flight Concierge, it enters data about its guests so that their flights can be tracked and the guests can be notified. This may include:

• Guest name
• Room number
• Email address
• Preferred language
• Flight number and flight date
• Notes the hotel staff add to the guest’s trip (free text)
• Web push subscription, if the guest turns on notifications on the guest page
• Transport requests the guest makes (pickup time and address, number of passengers, optional note)
• When and how often the guest page was opened, and whether emails to the guest could be delivered

The hotel is the controller for this data. LobbyFlight processes it only on the hotel’s behalf and on its instructions, as a processor under Art. 28 GDPR. Guests should address requests about their data (access, correction, deletion) to the hotel; we support the hotel in answering them.

The details of this processing, including the sub-processors we use, are set out in our Data Processing Agreement. Data Processing Agreement

We use guest data only to track the guest’s flight, to send the guest status updates by email and web push, to show the guest’s personal companion page (including departure recommendations), and to forward transport requests the guest makes to the hotel’s transport partners.

3. How We Use Your Information

We use the collected information for the following purposes:

• Provide and maintain our flight display service
• Process your subscription and payments
• Send you technical notices and support messages
• Respond to your comments and questions
• Monitor and analyze usage patterns to improve our service
• Detect and prevent technical issues
• Comply with legal obligations

4. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following situations:

• Service Providers: With service providers who process data on our behalf: Vercel (hosting, file storage and, only with your consent, cookieless web analytics), Supabase (database), Stripe (payment processing), Resend (email delivery), Upstash via Vercel KV (caching and rate limiting), Anthropic (automatic translation of info-slide texts, only when a hotel uses it), Brevo (newsletter, only if you subscribe), Google, PostHog and Meta (website analytics and advertising measurement, only with your consent; see our Cookie Policy), and the push services of the guest’s browser vendor (delivery of web push notifications). The flight and weather data providers (AviationStack, AeroDataBox via RapidAPI, OpenWeatherMap) and Google Maps Platform (travel times for departure recommendations) receive only flight numbers, dates, airport codes or locations, never guest names or contact details. See our GDPR page for locations and safeguards.
• Transport Partners (Flight Concierge): When a guest requests a taxi or shuttle through the guest page, we send the guest’s name, room number, flight and requested pickup time to the transport partner the hotel has chosen. Transport partners are selected by the hotel and are not our processors.
• Legal Requirements: If required to do so by law or in response to valid requests by public authorities
• Business Transfers: In connection with any merger, sale of company assets, or acquisition
• Protection of Rights: To protect the rights, property, or safety of LobbyFlight, our users, or others

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for data in transit
• Encrypted storage of sensitive information
• Regular security audits and updates
• Limited access to personal information on a need-to-know basis
• Secure payment processing through PCI-compliant providers

6. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this privacy policy. When we no longer need your information, we will securely delete or anonymize it.

Specific retention periods:

• Account information: Until account deletion
• Payment records: 7 years for tax purposes
• Support communications: 2 years
• Analytics data: 1 year
• Guest data (Flight Concierge): deleted 30 days after the tracked flight is completed or cancelled, together with its transport requests, status history and push subscriptions; unused guest invitations are deleted 30 days after the invitation link expires. When a hotel closes its account, all of its data is deleted 30 days after the closure.

7. Your Rights (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights:

• Access: Request a copy of your personal information
• Rectification: Request correction of inaccurate information
• Erasure: Request deletion of your personal information
• Restriction: Request restriction of processing
• Portability: Request transfer of your data to another service
• Objection: Object to our processing of your personal information

To exercise these rights, please contact us at info@lobbyflight.com. We will respond to your request within 30 days.

8. Cookies and Tracking Technologies

We use cookies and similar technologies (such as local storage) to:

• Maintain user sessions
• Remember user preferences
• Analyze usage patterns
• Improve our service
• Measure our advertising (only with your consent)

Types of cookies we use:

• Essential Cookies: Sign-in, security, your cookie choice and your language; always active
• Analytics Cookies: Google Analytics, PostHog and Vercel Web Analytics; only with your consent
• Functional Cookies: Optional convenience features; we currently use none
• Marketing Cookies: Meta Pixel, Meta Conversions API and Google Ads, to measure our advertising; only with your consent

Analytics and marketing technologies are loaded only after you allow them in our cookie banner. You can change or withdraw your consent at any time with the "Cookie settings" button in our Cookie Policy, which also lists every cookie with its provider, purpose and duration. You can also block cookies in your browser; signing in to the portal then no longer works.

9. Children's Privacy

Our service is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, in particular the USA. For such transfers we rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses approved by the European Commission.

11. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Effective Date" at the top. For material changes, we will notify you via email or through a notice on our service.

12. Contact Information

If you have questions or concerns about this privacy policy, please contact us at: