Privacy policy

1. Who is responsible

Brokeys (brokeys.app) is property management software (PMS) for holiday-rental owners. Owners can invite their house manager; agencies have no access to the app and only receive, through the API, the data of the villas the owner chooses to share with them.

Provider: Mirko Banno, sole trader (autónomo), tax ID Y3194712A, based in Ibiza (Balearic Islands), Spain. Privacy contact: info@brokeys.app.

This policy explains how personal data is handled on the brokeys.app website, in the web app and in the Android app, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

2. Two different roles

Controller: for the data of our customers (account holders and users) and of website visitors.

Processor: for the data our customers enter about their guests, clients, staff and owners (bookings, ID documents, messages). Those data belong to the customer (the owner), who is the controller; Brokeys processes them only to provide the service and on the customer’s instructions (art. 28 GDPR).

If you are a guest of a rental that uses Brokeys, exercise your rights with that rental. If you write to us, we will pass your request on.

3. What data we process

• Customers and users: name, email, phone, company, logo and brand colours, language; password (stored only as a hash by the authentication service) or Google sign-in; plan and billing data (card details are handled by Stripe, Brokeys does not store them); SES Hospedajes username, password and certificate (encrypted); API keys (only a hash is stored); support messages; technical usage and security logs.
• Guests (on the customer’s behalf): full name, ID type and number, support number, date of birth, nationality, sex, address, phone, email and relationship; the photo of the ID when the guest uploads it; booking data (dates, number of people, amounts and payments); WhatsApp messages and conversations with the concierge.
• Cleaning and maintenance staff (on the customer’s behalf): name, phone, email and role; the photos and checklist of each cleaning.
• Owners the customer shares a monthly statement with: the financial data in that statement.
• Website visitors: technical connection data (IP address, browser) in server logs. The demo (/demo) runs only in your browser with fictional data: it sends and stores nothing.

4. Why, and on what legal basis

• Providing the service you signed up for (account, bookings, calendar, messages, payments and support): performance of the contract (art. 6.1.b GDPR).
• Invoicing and tax and accounting duties: legal obligation (art. 6.1.c).
• Reporting bookings and travellers to SES Hospedajes (Spanish Ministry of the Interior) when the customer asks, or automatically for bookings if the customer switches that option on: the customer’s legal obligation under Royal Decree 933/2021; Brokeys acts as processor.
• Security, fraud prevention and technical improvement of the service: legitimate interest (art. 6.1.f).
• Marketing about Brokeys: only with your consent (art. 6.1.a), which you can withdraw at any time.

We do not sell data, show advertising or build commercial profiles.

5. Artificial intelligence

Some features use Google’s Gemini models, through Vertex AI in a Google Cloud region in the European Union (or the Gemini API while that setting is not active): reading the ID document to fill in the form, describing the villa from its photos, extracting house information and the concierge’s replies to guests. Only the data each feature needs is sent.

No automated decisions with legal effects are taken: extracted data can be reviewed, and a person always confirms the submission of the guest report to SES Hospedajes. Booking reports (holder’s name, dates and number of guests) are sent automatically only if the customer switches that option on in the settings.

6. Providers and recipients

Providers processing data on behalf of Brokeys, under GDPR-compliant contracts:

• Hostinger: Brokeys server with the database, authentication, files, backups and the automation (n8n) that sends the email notices (Frankfurt, EU).
• Google: app hosting (Google Cloud Run, Belgium, EU), Gemini models for AI features (Vertex AI, EU) and Google sign-in if you choose it.
• Stripe: payments, subscriptions and customer payouts (Stripe Connect).
• Meta (WhatsApp Business Platform): WhatsApp messages with guests.
• Email provider: service emails (account confirmation, password reset, notices).
• Supabase Inc.: backup copy of the database (servers in Frankfurt, EU).

Agencies the customer gives an API key to: they receive only the data of the villas the customer chooses (guest data only with a secret key); the customer decides on and is responsible for that disclosure.

Only if the customer turns them on: Nuki (smart-lock access codes), PriceLabs (dynamic pricing) and iCal calendars from Airbnb, Booking.com, Vrbo or Google (availability only; the calendar Brokeys exports contains no guest data).

Recipients required by law: the Spanish Ministry of the Interior (SES Hospedajes), the tax agency, courts and law enforcement when the law requires it.

7. International transfers

Data is hosted in the European Union. Some providers (Google, Stripe, Meta, Supabase) belong to US-based groups and may access data from outside the European Economic Area; such transfers rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

8. How long we keep data

• Customer account: while it is active. After closure it is deleted or anonymised, except billing data, kept for 6 years (art. 30 Spanish Commercial Code), and what is needed to handle possible claims while they can be brought.
• Guests and bookings: while the customer keeps them in the account. Traveller register data is deleted automatically 3 years after check-out (the period set by Royal Decree 933/2021), or earlier if the booking is cancelled. When the account is closed they are deleted, unless the customer instructs otherwise.
• ID photos: deleted automatically once SES Hospedajes accepts the registration, 30 days after check-out if it was never sent, or 7 days after a cancellation. The customer can delete them earlier at any time.
• Guests’ private links (form, guide and extras): stop working 7 days after check-out; cleaning staff links, 7 days after the cleaning date.
• Technical logs: a short period, generally no more than 90 days.

9. Security

Encrypted connections (HTTPS); database access control so each customer sees only their own data; SES Hospedajes credentials and smart-lock tokens encrypted in a vault; rate limits on public links; ID documents in private storage, reachable only through short-lived links; API keys stored as hashes; Brokeys staff access limited to what support requires.

10. Android app

The Android app offers the same features as the web app and is covered by this policy. Permissions it may ask for: camera, only when you tap to photograph a document or a cleaning; notifications, optional, for booking, message and ticket alerts.

The app contains no advertising, uses no advertising identifiers and shares no data for tracking.

11. Deleting your account

You can ask us to delete your Brokeys account and its data by writing to info@brokeys.app from the account’s email address, with the subject “Delete account”. We confirm within 30 days at the latest.

The account, villas, bookings, guest and staff data, messages and files are deleted. Only billing data is kept for the legal period (section 8).

12. Cookies and local storage

We use no advertising or analytics cookies. Your browser keeps only technical data that is needed: your signed-in session, language, light or dark theme and demo mode. Stripe may set technical fraud-prevention cookies needed for payments.

13. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent, by writing to info@brokeys.app. We may ask you to prove your identity. We reply within one month.

If you disagree with our reply, you can complain to the Spanish Data Protection Agency (www.aepd.es).

14. Minors

Brokeys is a service for adult professionals. Minors’ data is processed only when a customer registers it because the law requires it (traveller register).

15. Changes

Any change to this policy will be published here. If the change is significant, we will let you know by email or in the app.