This Privacy Policy explains how we process personal data when you visit luvihub.com, sign up for news about LuViHub, register a company account and use LuViHub, or contact us. The Croatian version is binding.
1Who is responsible
LuVi Solutions j.d.o.o., [street and number], [postcode] [city], Croatia, OIB [OIB]
E-mail: team@luvihub.com
We have not appointed a data protection officer, as we are not required to. For all questions about data protection please write to team@luvihub.com.
2Guests of accommodation using LuViHub
If you are a guest (you booked, checked in online, signed a guest register sheet, opened an access link or wrote to a host), your data is processed by the accommodation provider (host). The host is responsible for this data (controller) and uses LuViHub as a service; we process the data only on the host's behalf and according to its instructions (Data Processing Agreement).
Please contact the host for information about how your data is used and to exercise your rights. If you contact us, we forward your request to the host without delay.
3Visiting luvihub.com and the LuViHub pages
Server logs. When you open our pages, the server automatically records: IP address, date and time, the page requested, the referring page, browser and operating system, and status codes. We use this data to deliver the pages, to keep them secure and to find errors (legal basis: legitimate interest, Art. 6(1)(f) GDPR). The logs are deleted after 14 days, unless a security incident must be investigated.
Cookies and local storage. We use only cookies that are strictly necessary for the service (exemption from consent under Article 100(4) of the Croatian Electronic Communications Act / Article 5(3) of the ePrivacy Directive):
| Name / purpose | Where | Duration |
|---|---|---|
| Login session (JWT) | LuViHub app after login | session / until logout, at most the configured login period |
| Second login step (two-factor) | login | a few minutes |
| Guest portal session | guest pages of a booking | until logout or expiry of the booking access |
| Device binding of an access link | door / parking access pages | until the access ends |
Your choices (e.g. language, country, collapsed panels) are stored in your browser's local storage and are not sent to us. We use no analytics, advertising or tracking tools and no social media plugins.
Fonts and icons are loaded from our own server; no data is sent to Google or other font services.
Maps. Booking pages can show a map of the accommodation's location. The map is provided by Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and is loaded only when you click "Show map". Google then receives your IP address and may set cookies and transfer data to the USA (EU–U.S. Data Privacy Framework). Legal basis: your consent by clicking (Art. 6(1)(a) GDPR). See policies.google.com/privacy.
4News about the launch (notify list)
If you enter your e-mail address under "Notify me at launch", we store your e-mail address, the language and the time of your consent, and send you news about the launch of LuViHub (legal basis: consent, Art. 6(1)(a) GDPR). You can withdraw your consent at any time by e-mail to team@luvihub.com or through the link in our e-mails; we then delete your address. Otherwise we delete it at the latest 12 months after the launch.
5Company account and use of LuViHub
Registration and account. Company name, your name, e-mail address, password (stored only as a hash), whether you register as a business or as a private person, and the acceptance of our Terms of Service (version, time, IP address, browser) — to conclude and perform the contract and to prove the acceptance (Art. 6(1)(b) and (f) GDPR).
Users of the company. Name, e-mail address, phone number (optional), role and assigned units of the persons the company admin invites — to provide the service to the company (Art. 6(1)(b) and (f) GDPR).
Use of the service. Settings, entries and activity records (e.g. who changed a guest register sheet, who sent a message), and security data (login attempts, IP addresses in security logs) — to provide the service, keep it secure and prevent misuse (Art. 6(1)(b) and (f) GDPR).
Billing. Billing name, address, OIB / VAT number, billing e-mail, packages and invoices. Card payments are processed by Stripe (see section 7); we only receive and store the card brand, the last four digits and the expiry date — to bill the service (Art. 6(1)(b) GDPR) and to keep accounting records (Art. 6(1)(c) GDPR).
E-mails from LuViHub. Account confirmation, invoices, payment reminders, changes to the terms, security and service messages — part of the contract (Art. 6(1)(b) GDPR). We do not send advertising to company accounts without consent.
AI functions. If the company uses AI functions (Plus AI), the content needed for the request (e.g. a guest message) is processed by our AI provider; it is not used to train AI models. For guest data, the host is the controller (section 2).
6Contacting us
If you write to us (e.g. support request by e-mail), we process your message and contact details to answer it (Art. 6(1)(b) or (f) GDPR) and keep the correspondence as long as needed for the request, and at most 3 years after the end of the contract, unless longer retention is required by law.
7Recipients
We use service providers who process data on our behalf and are bound by contract:
| Provider | Purpose | Location / transfer |
|---|---|---|
| Kamatera Inc. (data centre Frankfurt) | servers, storage, backups | Germany (EU) |
| Hetzner Online GmbH | encrypted copy of the backups (storage only) | Germany (EU) |
| GoDaddy (Go Daddy Operating Company, LLC) | e-mail mailbox and sending of e-mails | USA / EU — EU–U.S. Data Privacy Framework / Standard Contractual Clauses |
| Stripe Payments Europe Ltd., Dublin | card payments for subscriptions | EU; USA (Stripe, Inc.) — Data Privacy Framework / Standard Contractual Clauses |
| Anthropic PBC | AI functions, only if used | USA — Standard Contractual Clauses |
Stripe also processes payment data as an independent controller for its legal obligations (e.g. fraud prevention, anti-money-laundering). We disclose data to authorities and courts only where we are legally obliged to. We do not sell personal data.
8Transfers outside the EU
Where a provider processes data outside the European Economic Area, we transfer it only under the conditions of Chapter V GDPR — on the basis of an adequacy decision of the European Commission (e.g. EU–U.S. Data Privacy Framework for certified companies) or the Standard Contractual Clauses of the European Commission. You can request a copy from team@luvihub.com.
9How long we keep data
- Account and usage data: for the duration of the contract and 180 days after it ends (export period), then deleted.
- Invoices and accounting records: 11 years (Croatian Accounting Act).
- Acceptance of the terms: for the duration of the contract and up to 5 years after its end (limitation period), to prove the contract.
- Server logs: 14 days; application logs: up to 30 days; backups: 30 days.
- Notify list: until withdrawal, at the latest 12 months after the launch.
10Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interest (Art. 21), and to withdraw consent at any time with effect for the future (Art. 7(3)). Write to team@luvihub.com; we answer within one month.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. You can also contact the authority in your country of residence.
11Obligation to provide data, automated decisions
Data marked as required in the registration and billing forms is needed to conclude and perform the contract; without it we cannot provide LuViHub. We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
12Security
We protect personal data with technical and organisational measures, in particular encrypted connections (HTTPS), separate databases per company, role-based access, passwords stored only as hashes, two-factor authentication for system administration, and daily backups.
13Changes
We may update this Privacy Policy when our services or the law change. The current version is always available at luvihub.com and in the app; the version and date are shown at the top.