Guest Keeper

Privacy policy

In force from 5 November 2026.

1. General

This policy describes how NULLBIT d.o.o. processes personal data in Guest Keeper, an app for building digital guides for the guests of holiday accommodation (guestkeeper.nullbit.cloud and app.guestkeeper.nullbit.cloud). It forms part of the Terms of use. The Croatian version prevails.

2. Controller and contact

NULLBIT d.o.o., Dravska ulica 17, 48000 Koprivnica, Republika Hrvatska, OIB 64593408110, registration number 05127700, court register 010112210.

Send requests about personal data to hello@nullbit.hr or by post to the registered address.

3. Who this policy covers

  • Host (User) – the person who opens an account, builds guides and pays the subscription, and the team members a host invites.
  • Guest – a person who opens a published guide, scans a QR code or signs up for a host's offers.

NULLBIT d.o.o. is the controller of host and team data. For guest data a host collects through a guide (offer sign-ups, the subscriber list, campaigns) the host is the controller and NULLBIT d.o.o. processes it as the host's processor. Guests exercise their rights for that data with the host; a request that reaches us is forwarded to the host.

4. The data we process

Host and team data:

  • email address, name, phone and WhatsApp number if you enter them, profile photo;
  • password (stored only as a cryptographic hash) or your Google sign-in identity, if you choose it;
  • billing details: company name, VAT number and address, if you enter them;
  • interface language and notification settings;
  • the content you enter: properties, units, guide texts, photos, team contacts, Wi-Fi details, campaigns.

Subscription data: plan, status, billing period, Stripe customer and subscription identifiers, and the card brand, last four digits and expiry as reported by Stripe. We never see or store card data.

Guest data:

  • on signing up for offers: email address, name if given, the consent text, time, IP address and language at sign-up, the source (link or QR code) and unsubscribe status;
  • when using a guide: anonymised statistics – guide and section opens, QR scans, language – tied to a pseudonymous visitor identifier, with no name or email address.

Technical data: server logs (IP address, time, requested path) and the cookies in section 11.

5. Purposes and legal bases

  • Contract (Art. 6(1)(b) GDPR): running the account, building and publishing guides, translating guides, sending the campaigns a host starts, billing, and transactional email (address confirmation, invitations, password reset).
  • Legal obligation (Art. 6(1)(c)): invoicing and keeping accounting records.
  • Legitimate interest (Art. 6(1)(f)): security, preventing abuse, fixing errors, support, and the guide statistics a host sees.
  • Guest consent (Art. 6(1)(a)): receiving a host's offers and news; consent can be withdrawn at any time through the unsubscribe link in every message.

We make no automated decisions within the meaning of Art. 22 GDPR.

6. Processor obligations

For guest data, NULLBIT d.o.o. as processor: processes it only on the host's instructions and for the service; keeps everyone with access bound to confidentiality; applies the measures of Art. 32 GDPR; uses the sub-processors in section 7 under the host's general written authorisation, with notice of changes; helps the host answer guests' requests; and deletes guest data when the service ends, except what the law requires us to keep. This section is the processing agreement under Art. 28(3) GDPR.

7. Recipients and sub-processors

We do not sell personal data. We give it to public authorities only where the law requires. Our sub-processors:

  • Hetzner Online GmbH (Germany) – servers and database;
  • Stripe Payments Europe, Ltd. (Ireland) – subscription payments; card data goes directly to Stripe;
  • Abacus.AI, Inc. (USA), RouteLLM – automatic translation of guide texts; only text the host wrote is sent, no guest data;
  • komoot GmbH (Germany), Photon – looking up a property's address; only the typed address is sent;
  • Google Ireland Limited – only if a host signs in with a Google account;
  • Twilio SendGrid (Twilio Inc., USA) – sending transactional messages and campaigns.

8. Transfers outside the EEA

Data is stored on servers in the European Union. Translation through Abacus.AI and email delivery through SendGrid transfer data to the USA under standard contractual clauses or the EU-US Data Privacy Framework adequacy decision, depending on which the recipient applies.

9. Retention

  • Account data and guide content are kept while the account exists.
  • Guests on a subscriber list are kept until the host removes them or the account ends; after unsubscribing, the address is kept only as a record not to write to that guest again.
  • Team invitations are valid for a limited time and cannot be used after it.
  • Invoices and accounting records are kept for the periods Croatian accounting law sets, also after an account ends.

10. Security

Traffic is encrypted (HTTPS with HSTS), passwords are stored only as a cryptographic hash, database rules limit each account to its own records, and the sign-in cookie is not readable by scripts. No system can be guaranteed absolutely secure; breaches are handled under Arts. 33 and 34 GDPR.

11. Cookies

Guest Keeper uses only its own, necessary cookies. It uses no third-party analytics or advertising cookies.

  • gk_refresh – keeps a host signed in; not readable by scripts;
  • gk_session – marks that a sign-in exists, so signed-in pages open correctly;
  • gk_oauth_state – short-lived, only while signing in with Google;
  • gk_host – marks a signed-in host's browser so their visits to their own guide are not counted; up to one year;
  • gk_qr – marks that a guest opened the guide by scanning a QR code, for an accurate sign-up source; one hour.

12. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection (Arts. 15–22 GDPR) and may withdraw consent. Write to hello@nullbit.hr; we answer within one month, which may exceptionally be extended by two more. Guests contact the host about data the host collects.

You may complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr.

13. Minors

Only adults may open a host account. Hosts offer sign-up to adult guests and are responsible for collecting guest data lawfully.

14. Changes and final provisions

The current text is published on this page. Hosts are told of material changes (a new purpose or a new sub-processor) in advance by email or in the app. The GDPR and the Croatian Act on the Implementation of the GDPR apply.