Privacy Policy

1. Who is responsible for your data

The data controller is the operator of BedTap, based in Malta (“BedTap”, “we”, “us”). You can reach us at hi@bedtap.com.

2. What data we collect

The data depends on how you use the Service.

Account holders: owners, managers and cleaners

• Account and contact data: name, e-mail address, phone number, role, language and time-zone settings, and a password (stored only in hashed form).
• Job and clock-in data (cleaners): the jobs assigned to you, clock-in and clock-out times, checklist answers, notes, and the precise location of your device at the moment you clock in. We read your location once, only while the app is open and only when you start a job. We do not track your location in the background.
• Job photos: before and after photos you take or upload for a job. They may show the inside of a property.
• Payroll records: hours worked, hourly rate, amounts due and paid, payment confirmations or disputes you submit, and the payout details you or the owner provide (for example a bank account or payment-service identifier).
• Push notification tokens: a device token issued by Apple or Google (or a push service acting for them) so we can send you notifications such as a new job or a recorded payment. You decide whether to allow notifications.
• Device and log data: app version, device type and operating system, IP address, request logs and error reports, used to keep the Service secure and working.

Guests

• Stay data: a guest does not need an account. The property owner provides the booking details (such as your name, contact details, stay dates and language). You see the parts relevant to your stay, such as arrival information, the entry code, Wi-Fi and local tips, through a private link the owner sends you. Anyone who has that link can open the guide, so please do not share it.
• Guide usage: technical data needed to show the guide and protect it from abuse, such as IP address and basic usage events.

We do not use advertising trackers, we do not sell personal data, and the app does not use your data for advertising.

3. Why we use it and our legal bases

• To provide the Service (create and run accounts, assign and record cleaning jobs, verify that a cleaner was at the property, calculate and record payroll, show guests their stay information, send notifications). Legal basis: performance of a contract with you or with the property owner who gave you access.
• To check job quality, including an automated AI check of job photos. Legal basis: legitimate interest in making sure work was done and documented.
• To keep the Service secure, prevent fraud and abuse, fix errors and improve reliability. Legal basis: legitimate interest.
• To keep accounting and tax records. Legal basis: legal obligation.
• To send service messages (for example account, schedule and payment e-mails). Legal basis: contract or legitimate interest.
• Push notifications are sent only after you allow them in your device settings. Legal basis: consent, which you can withdraw at any time in your device settings.

We do not make decisions with legal or similarly significant effect about you solely by automated means. The AI photo check supports a person’s review.

4. Who we share data with

We share data only as needed to run the Service. The property owner or manager who gave you access can see the data relevant to the work (for example jobs, clock-in times and location, photos and payroll). Guests do not see staff data.

We use service providers (processors) acting on our instructions, in these categories:

• cloud hosting and database providers;
• e-mail delivery providers;
• an AI image-analysis provider used for the job-photo check;
• push-notification services run by Apple and Google.

We may also disclose data where the law requires it, to protect our rights or users’ safety, or in a business transfer, always with appropriate safeguards.

5. International transfers

Some of our providers may process data outside the European Economic Area. Where that happens we rely on a recognised safeguard, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with additional measures where needed.

6. How long we keep data

• Accounting and payroll records are kept for the period required by Maltese accounting and tax law (currently generally six years), even if the account is deleted. Where possible we remove or anonymise your name and contact details in those records.
• All other account data (profile, job photos, clock-in locations, push tokens) is kept until your account is deleted. See how to request deletion.
• Guest stay data and guide links are kept by the property owner as long as needed for the stay and the owner’s legal duties, and the private guide link stops working after it expires.
• Server logs are kept for a short period only, for security and troubleshooting.

7. Your rights

Under the EU General Data Protection Regulation (GDPR) you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased (“right to be forgotten”), subject to the legal retention duties above;
• restrict how we use your data;
• receive your data in a portable format;
• object to processing based on legitimate interest;
• withdraw consent at any time where we rely on it.

To exercise a right, e-mail hi@bedtap.com. We may need to verify your identity first and will reply within one month. You also have the right to complain to the supervisory authority: the Information and Data Protection Commissioner of Malta (IDPC), idpc.org.mt.

8. Security

We protect data with measures such as encrypted connections (HTTPS), hashed passwords, sign-in tokens stored in the secure storage of your device (Keychain on iOS, Keystore on Android), short-lived access tokens, access limited to the people who need it, private (unguessable) guest links, and rate limiting. No system is perfectly secure. If a breach affects your rights, we will notify you and the authority as the law requires.

9. Children

The Service is for business use and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

10. Changes to this policy

We may update this policy. The date at the top shows the latest version. For material changes we will give notice in the Service or by e-mail.

11. Contact

Questions about this policy or your data: hi@bedtap.com. For help with the app see our support page.