At Apartop we handle your data with care. This policy explains what data we collect, what we use it for and what rights you have. For any questions, write to us at hola@apartop.com.
GLENLAKE SOFT SL · CIF B13872437 · Calle Haya 9, Portal 1, 5.º A, 41927 Mairena del Aljarafe (Sevilla), España
Data controller
The data controller is GLENLAKE SOFT SL (Apartop, apartop.com), tax ID B13872437, Calle Haya 9, Portal 1, 5.º A, 41927 Mairena del Aljarafe (Sevilla), España. Contact: hola@apartop.com.
This applies to the data in your Apartop account. Guest data is decided by each host: see «If you are a guest».
If you are a guest
Who processes your data
Your host (the owner or the agency that manages the property) is the controller of your guest data. GLENLAKE SOFT SL (Apartop) processes it on their behalf, as data processor, and only to provide them with the service.
What data
The online check-in details (name, ID document, date of birth, nationality, address, phone, email and signature) and anything you write from your guide.
What for
To comply with the law of the property's country on guest registration and to give you the information about your stay. Each country asks for its own data:
- Spain: In Spain the law (RD 933/2021) requires travelers to be registered and their details to be reported to the Ministry of the Interior (SES.HOSPEDAJES) within 24 hours.
- France: In France foreign guests fill in the individual police form; the accommodation keeps it and only hands it over to the police or gendarmerie if they ask for it.
- Italy: In Italy the law (art. 109 TULPS) requires guests' details to be reported to the police (Alloggiati Web, Questura) within 24 hours of arrival.
- United Kingdom: In the United Kingdom the accommodation keeps a guest register (Immigration (Hotel Records) Order 1972) and only shows it to the police if they ask for it.
- Germany: In Germany foreign guests sign the registration form (Meldeschein); the accommodation keeps it and only shows it to the authorities if they ask for it.
- Brazil: In Brazil guests' details are recorded in the National Guest Registration Form (FNRH) of the Ministry of Tourism.
- Thailand: In Thailand the accommodation reports foreign guests' stay to the Immigration Bureau (TM.30 notification) within 24 hours.
- Türkiye: In Turkey the accommodation reports guests' details to the police or the gendarmerie (KBS).
Who we share it with
Only with the providers Apartop needs to work (Supabase, Cloudflare, Resend, Stripe and Google Drive if your host uses it) and with the authorities when required by law. We do not sell your data or use it for advertising.
How long
Your check-in data is deleted automatically when the period of the property's country ends, counted from your check-out:
- Spain: 3 years
- France: 6 months
- Italy: 3 years
- United Kingdom: 1 year
- Germany: 1 year
- Brazil: 3 years
- Thailand: 1 year
- Türkiye: 3 years
- Other countries: 3 years
Your rights
You can ask to access, correct, delete, restrict or object to the use of your data, or take it with you, by writing to your host or to hola@apartop.com. You can also complain to the Spanish Data Protection Agency (aepd.es).
What data we process
- Your account data: name and email. If you sign in with Google, your Google name, email and profile picture.
- Data about your properties: addresses, listings, calendars and bookings you add.
- Your guests' data collected during online check-in, to comply with the legal obligation to register guests.
- Invoices and documents you upload to the app.
- Payment data for your subscription, handled by Stripe. Apartop does not store your card details.
What we use it for
- To give you access to your account and provide the service you subscribe to.
- To send you service emails: confirmations, check-in notifications and billing.
- To comply with legal obligations, such as guest registration or tax obligations.
- To charge the subscription.
We don't sell your data or use it for advertising.
Google sign-in and Google Drive
If you sign in with Google, we only receive your name, email and profile picture to create your account. If you connect Google Drive, Apartop only accesses the files the app itself creates in your Drive (scope drive.file) to store your documents there.
Apartop's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don't transfer that data to third parties except to provide the service, we don't use it for advertising and nobody reads it unless you authorize it or the law requires it.
Who we share it with
Only with the providers needed for Apartop to work:
- Supabase: database and user accounts.
- Cloudflare: website hosting.
- Stripe: subscription payments.
- Resend: email delivery.
- Google: sign-in and Google Drive, if you use it.
- The AI assistant you connect (for example Anthropic with Claude or OpenAI with ChatGPT), only if you connect it and only with what you ask it for.
We will also disclose it to the authorities when required by law.
AI assistants (Claude, ChatGPT and others)
You can connect your Apartop account to an AI assistant to query it or ask for changes. This only happens if you connect it and give permission on Apartop's screen, and only for the account you choose.
- What the assistant sees: the data it looks up to answer you (apartments, bookings, availability, cleanings and, if your user has those permissions, amounts, guest data and traveler reports). It never sees ID documents, passwords or payment details.
- That data is sent to the provider of the assistant you chose, which handles it under its own privacy policy and your account settings with that service. Apartop sends them nothing else.
- Changes (blocking dates, assigning cleanings, sending template messages or resending check-in) are always prepared first and only carried out when you confirm them. The assistant cannot delete anything, pay, or send reports to SES.
- We keep a log of every query and change (who, which assistant, which tool, a summary of the data requested and the result) for one year, visible in Settings › AI assistants. For access tokens we only store their fingerprint (hash), and they expire.
- You can disconnect an assistant at any time in Settings › AI assistants; access stops immediately.
How long we keep it
For as long as your account is open. When you close it we delete them, except for anything the law requires us to keep for longer. Guest data is deleted automatically when the legal retention period of the property's country ends.
- Guests' identity data (document, photo, signature): deleted automatically when the guest-register retention period of the property's country ends, counted from check-out (in Spain, 3 years: RD 933/2021). The periods for each country are under «If you are a guest».
- Account change history (who changed what and when): 180 days. It never stores passwords or credentials, only that they were changed.
- Support messages: while the account exists, so we can help you.
- If you delete the account (Settings › Privacy and data) you have 14 days to change your mind; after that we delete everything. Files you stored in your Google Drive stay in your Drive. Invoices and traveler reports the law requires you to keep (4-6 years and 3 years) are your responsibility: download them first with “Download all my data”.
Your rights
You can download all your data or delete your account yourself in Settings › Privacy and data. You can request access to your data, its correction or deletion, restrict or object to its use, and take it with you by writing to hola@apartop.com. If you're not satisfied with our response, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).
Changes
If we change this policy we will publish it on this page and, if the change is significant, we will notify you by email.