Privacy notice

1. Who is responsible

The controller is NeoVerse Management LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.

For any privacy question, reach us at [email protected] or +1 (929) 358-7214.

2. What this notice covers

It covers the product website leisuros.com, sign-up at leisuros.com/start, the demo businesses at demo.leisuros.com and the other demo addresses, and the accounts of businesses that use LeisurOS.

It does not cover the data of guests who book or buy from a business. The respective business is responsible for that data; we only process it on the business’s behalf (see Terms, Annex 1). Please direct questions about it to the business.

3. Visiting the website, servers and security

When you open one of our pages, the servers process technically necessary data: your IP address, date and time, the requested address, browser and device type, and the page you came from. We need it to deliver the pages and to fend off attacks (Art. 6(1)(f) GDPR). We do not combine this data with other data and do not build profiles.

To prevent abuse we briefly count requests per IP address in memory. On the sign-up form we store the IP address only as an irreversible hash, to limit the number of sign-ups per sender.

Our servers are operated by Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany, in data centres in Germany.

All requests pass through the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare protects the pages against attacks, delivers them faster and processes your IP address in particular for this purpose (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.

4. Cookies and local storage

We only set cookies that are needed for the site to work or that you trigger yourself by making a choice. No consent is required for these (Section 25(2) TDDDG, Art. 6(1)(f) GDPR):

• leisuros_language — remembers the language you chose on the product website, for 12 months. The same value is also kept in your browser’s local storage.
• tenant_admin_session — keeps you signed in to the LeisurOS back office, including in the demo. It ends when you sign out or when the configured duration is reached.
• Cloudflare may set a technically necessary cookie to protect against attacks (for example __cf_bm).

We do not use analytics or advertising cookies, tracking pixels, tracking of any kind, or third-party fonts and scripts.

5. Sign-up (14-day trial)

For sign-up we ask for the name of your business, its industry, the country and your email address; we take the language from the page. We use this to send you a confirmation link and to set up your business (Art. 6(1)(b) GDPR).

We store the link only as a hash; it is valid for 48 hours. Sign-ups that are not confirmed are deleted automatically after 30 days. Once you confirm, the details become part of your customer account.

We limit the number of sign-ups per email address and per sender to prevent abuse (Art. 6(1)(f) GDPR).

6. Your customer account and the back office

If your business uses LeisurOS, we process the account data (name, email address, role and location access), sign-in data (the password only as a hash and, if you choose, a second factor from an authenticator app) and a log of important actions. We need this to perform the contract and to protect the accounts (Art. 6(1)(b) and (f) GDPR).

Database and sign-in are operated by Supabase, Inc., USA, in a data centre in Frankfurt am Main, Germany.

We keep this data for as long as the contract runs and delete it afterwards once no statutory retention obligation applies.

7. Emails

We send confirmation links, invitations and notifications through the email service Resend (USA). Resend processes the recipient address and the content of the message for this purpose (Art. 6(1)(b) GDPR).

8. Demo

In the demo you try LeisurOS with fictitious businesses. When you enter it, we set the sign-in cookie described in section 4. Contact details of the fictitious guests stay hidden in the demo.

Please do not enter real personal data in the demo. Everything you create there — bookings, receipts, notes — is deleted automatically at regular intervals. If you use a real email address for a test booking, a confirmation may be sent to that address.

9. Contacting us by email

If you write to us, we process your details to reply (Art. 6(1)(b) or (f) GDPR). Our mailbox is operated by Migadu (Switzerland). We delete the message once the request is settled and no retention obligation applies.

10. Transfers to third countries

We are a company based in the USA. Our servers and database are located in Germany. Where data reaches the USA, for example Cloudflare, Supabase or Resend, we rely on the EU-US Data Privacy Framework if the recipient is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 45 and 46 GDPR). For data from Switzerland the same applies under the Swiss Federal Act on Data Protection (Swiss-US Data Privacy Framework or recognised standard clauses).

11. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests (Art. 15 to 21 GDPR). Please write to [email protected].

You may also lodge a complaint with a data protection supervisory authority; in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC).

We need the requested details for sign-up; without them we cannot set up a business. Simply visiting the website requires no details at all.

12. Security

All connections are encrypted (TLS). Credentials for third-party services that businesses store with us are encrypted (AES-256-GCM); confirmation links and invitation codes are stored only as hashes. Each business sees only its own data.

13. Changes

If our services or the legal situation change, we update this notice. The version published here applies.