Privacy Policy
This policy explains how NOSHI (“we”, “us”) handles personal data. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). It has three parts: A for visitors of our website and for the hotels using Nuitina, B for the data of hotel guests (where we work on behalf of the hotel), and C for your rights.
Part A: our website and hotel accounts
1. Who is responsible
NOSHI, Limmatquai 12, 8001 Zürich, Switzerland, info@nuitina.com. We are responsible for the data described in part A.
2. Visiting nuitina.com
Our server records technical access data: IP address, date and time, the page requested, and the browser’s details. We use it to deliver and secure the site, and keep it for a limited time. The website uses no advertising or analytics cookies, no tracking pixels and no external fonts. Fonts and scripts are delivered from our own server. The live demo of the booking page loads only after you click “Try it live”; it comes from booking.nuitina.com.
3. Hotel accounts
When a hotel signs up, we process: the name of the property, the name, e-mail address and password of each user, their role and language, the time of the last login, and the settings the hotel makes. Passwords are stored only as a salted hash, never in plain text. We use this data to provide and secure the account, to send service e-mails (welcome, trial reminders, security) and to invoice. Legal basis: performing the contract, our legitimate interest in running a secure service, and legal duties.
Cookies in the app: a session cookie (booking_session, up to 30 days) that keeps you signed in, and a language cookie (booking_lang, one year). Both are strictly necessary. We use no tracking cookies.
4. Contacting us and invoices
If you write to us we use your message and address to answer you. Invoicing data is kept for the period required by law (in Switzerland generally ten years).
5. Who receives data
Our hosting provider (virtual server), our e-mail provider, and Anthropic for the optional translation helper (only the texts a hotel asks to translate). We do not sell personal data. Our hosting provider’s name and the location of the server are available on request.
Part B: guest data (data processing terms)
6. Roles
The hotel is the controller of its guests’ data. We process it on the hotel’s behalf (we are the “processor”) and only to provide Nuitina, following the hotel’s documented instructions, which are the settings and actions the hotel makes in the app. We do not use guest data for our own purposes. The hotel is responsible for informing its guests, for having a legal basis, and for its own privacy notice towards guests.
7. What data, whose
Guests, and people who ask a hotel for a booking, and the hotel’s team members. Data: name, e-mail, telephone, address, country, language, company name; where the hotel uses the registration form: date of birth, nationality and ID number; booking details (dates, rooms, prices, wishes, notes); payment records (amount, method, reference, never card numbers); the IP address from which an online booking was made; mail logs; and the hotel’s internal notes.
8. Sub-processors
- Hosting provider: the virtual server on which Nuitina and its database run.
- E-mail provider: delivery of e-mails to guests and the hotel, unless the hotel connects its own mailbox.
- Anthropic: only for the optional translation helper, and only with texts the hotel writes about its house, not guest data.
Stripe and PayPal are not our sub-processors. A hotel connects its own account, guests pay into it, and the provider acts under its own terms with the hotel. When a guest pays, we send the provider the amount, the booking number and the guest’s e-mail address to create the payment page.
We will inform hotels of changes to sub-processors in advance, and a hotel may object for good reason.
9. Security
Traffic is encrypted (HTTPS). Passwords are hashed. Payment credentials and mailbox passwords that a hotel stores are encrypted at rest. Access is limited to what is needed, each hotel sees only its own data, and we make regular backups (kept for 30 days). No system is perfectly secure; we work to keep ours so, and we tell the hotel without undue delay if we learn of a breach that affects its data.
10. Storage, return and deletion
We keep guest data while the hotel’s account exists. The hotel can correct guest records and export report data as CSV in the app, and can ask us at any time for a full export or for the deletion of data, which we carry out within 30 days. After the contract ends we keep data as described in section 14 of the Terms of Service, then delete it, and we delete earlier on the hotel’s request, except where the law requires us to keep it. Backups are overwritten within 30 days.
11. Help and audits
We help the hotel answer requests from guests and authorities, within reason. Hotels may ask us for information that shows we meet these terms.
12. Transfers abroad
If a provider (for example Anthropic, Stripe or PayPal) processes data outside Switzerland and the EEA, this happens only under adequate safeguards such as the standard contractual clauses or an adequacy decision.
Part C: your rights
13. What you can ask for
You may ask for access to your data, correction, deletion, restriction, a copy in a common format, and you may object to processing based on our legitimate interests. Write to info@nuitina.com. If your data is guest data, the hotel you booked with is responsible and decides; we will pass your request on or help the hotel.
You may complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country.
14. Changes
We may update this policy. The date at the top shows the current version.