Privacy policy

Last updated: 2 November 2026 · applies to platform version 0.3

KioskOS is a self check-in platform for accommodation providers: the kiosk at the front desk, the KioskOS Staff mobile app and the admin panel. This page describes which data these components process, why, on which legal basis and for how long.

Who is responsible

The platform is developed and operated by Torcip SRL, tax ID 49862521, Trade Register no. J2024002471231, registered office in Sat Roșu, Chiajna commune, Ilfov county, Romania.

• Guest data (reservations, check-in, ID document, payments): the controller is the property you stay at. Torcip SRL is a processor: it processes the data only on the property's behalf and instructions.
• Staff accounts and diagnostic data: the controller is Torcip SRL.

Torcip SRL has not appointed a data protection officer (DPO), as it is not required to. For any question or request about personal data: support@torcip.com.

Staff accounts

For front-desk staff, owners and administrators (KioskOS Staff app and admin panel):

• email address, name, role and the properties the account can access;
• the password, only as a hash (it cannot be read);
• the secret for two-factor authentication (authenticator app, TOTP) and the recovery codes;
• devices marked “Remember this device”: only a hash of the token, never the token;
• if you use “Continue with Google” or “Continue with Apple”: your account identifier at Google / Apple (sub), the email the provider reported when the method was linked (Apple may give a “private relay” address) and when it was last used. For Apple, we exchange the authorization code received at sign-in with Apple (appleid.apple.com/auth/token) for a refresh token, kept encrypted, only so we can revoke it at Apple when you delete the account or unlink the method; if the revocation does not succeed at once, the encrypted token goes to a revocation queue (not linked to the account) and we retry at most 8 times, at growing intervals, over about 3 days; if it still fails, the token is deleted from the queue and only an error note remains in the server log. We never receive your Google / Apple password and ask only for openid and email. Google's token may also contain your name and profile picture: we do not store them;
• a log of actions taken from the account (who, what, when), for security and for the property's records; for a Google / Apple sign-in it keeps only the provider and the masked email (e.g. a***@gmail.com).

Legal basis: performance of the contract between Torcip SRL and the property (Art. 6(1)(b) GDPR) and the legitimate interest in keeping the platform secure (Art. 6(1)(f)). Accounts are created by invitation only.

Google and Apple are only an alternative way to sign in to a staff account already created by invitation: they never create an account, and the authenticator-app code (TOTP) is still required. You can link or unlink them at any time in Settings → Sign-in methods (app) or Security (admin panel). The provider (Google LLC / Apple Inc.) handles the sign-in under its own policy.

The KioskOS Staff app

The mobile app for staff processes:

• the account data above (email, name, role) and the account's internal identifier (user ID);
• the property's reservations, check-ins, cards and kiosks, shown from the server; when the front desk adds a reservation in the app, it enters the booking code, the guest's name, the guest's email (optional), the dates and the room;
• a random device ID (a UUID generated on first launch, one per installation), kept locally in the app. It is not an advertising identifier (IDFA, AAID) nor a hardware identifier (IMEI, MAC, serial number, Android ID); we do no fingerprinting. We use it for per-device statistics: crashes, performance, active installations and versions;
• the crashes, errors, performance data and diagnostics described below, linked to the account when you are signed in.

On the phone, the session and the “Remember this device” token are kept in the system's secure storage (Keychain / Keystore). The app only requests internet access: it does not use the phone's camera, microphone, location or files, has no ads, does no tracking and does not collect the IP address.

Guest data

From the reservation

The property enters reservations (in the admin panel or the Staff app) or imports them from a channel manager or iCal calendar: guest name, email and phone (when provided; some channel managers provide only the last 4 digits of the phone), booking code, dates, number of guests, room, amount, balance due and booking source. Legal basis: the accommodation contract between the guest and the property.

At the kiosk

At check-in the kiosk reads the ID document (MRZ zone) and, depending on the property's settings, collects:

• surname and given names, document type, issuing country, date of birth, expiry date, nationality, sex and any corrections the guest made on screen;
• the document number, stored encrypted (AES-256-GCM); elsewhere it is only shown masked;
• a photo of the document, stored encrypted and visible only to staff with that permission (every access is logged);
• a face photo, only if the property has enabled this step: stored encrypted, visible only to staff allowed to view ID documents. The photo is only archived for the property: we do no facial recognition and do not compare it automatically with the document;
• the time the guest gave consent, when the property requires it.

Version 0.3 does not collect the Romanian personal numeric code (CNP), the address, the purpose of stay or a signature.

Phone: if the property requires this check, the guest types the last 4 digits of the phone on the reservation. The digits are only compared with the reservation and are not saved.

Lost card: when a guest asks for a new room card, the kiosk compares the scanned document (or the last 4 digits of the phone) with the reservation; only the event is logged (when, the reason, the old and the new card).

On the device no ID document data remains: the check-in session lives only in memory and is wiped when the kiosk returns to the start screen. So that check-in also works without internet, the kiosk keeps a local list of the current day's reservations (code, guest name, dates, room), replaced on every update.

Registration form and SIT

From the data above, the admin panel generates for the property the export of registration forms for the Romanian SIT register. The property downloads and submits the export; the platform sends no data to authorities. Every export is logged.

Legal basis: the property's legal obligation to fill in the guest arrival/departure form and report it in the SIT system (Art. 6(1)(c)), the accommodation contract (Art. 6(1)(b)), and for the face photo the guest's consent (Art. 6(1)(a)).

Payments

If the property has enabled payment at the kiosk, the guest can pay the stay balance by card, on the kiosk screen or on their phone (QR code). The payment processor is Stripe.

• Stripe receives from KioskOS only the amount, the currency, the description “Cazare N nopți · rezervare <code>” (“Stay, N nights · booking <code>”) and internal IDs (payment, property, reservation, session). We do not send it the guest's name, email, phone or ID document.
• The guest enters the card details directly in the Stripe form (Payment Element on the kiosk screen or Stripe Checkout on the phone). They never pass through the KioskOS servers.
• KioskOS stores: the amount, currency, nights, price per night, status, decline code, card brand and last 4 digits, the Stripe IDs, the times of payment and refund, the link to the reservation, session and kiosk, and the ID and type of the events received from Stripe.
• KioskOS does not store the full card number, expiry date, CVC, the name on the card or the IP address.

Stripe processes, as an independent controller, the data it collects directly through its forms: the card details, the IP address, device and browser signals (Stripe Radar, for fraud prevention) and, in Stripe Checkout, the email the guest enters. The Stripe privacy policy applies to that data. Legal basis: the accommodation contract (its payment, Art. 6(1)(b)).

The kiosk

The kiosk periodically reports its status: hardware modules and their state, consumable levels, software version and update status, uptime, system resources and the device's private, local IP address on the property's network (not the public address). Over the real-time link (a permanent secure connection between the kiosk and the server) the same data arrives as soon as it changes, and the server sees whether the device is connected. The kiosk neither takes nor sends screenshots. Legal basis: legitimate interest in monitoring, troubleshooting and updating the device (Art. 6(1)(f)).

Diagnostics, crashes and performance

The kiosk, the KioskOS Staff app and the admin panel send errors and performance measurements only to the KioskOS server, with no third-party service (no Sentry, Crashlytics or similar):

• Errors and crashes (including native crashes and freezes of the Staff app): error type, message and stack trace, the screen it happened on, the last actions in the app (navigation, server requests without parameters), version and build, device model (for browsers: name and major version only), operating system, language.
• Performance (aggregated on the device, sent in batches): start-up time, screen load times, duration and errors of server requests (address without parameters), UI freezes, memory use.
• The random device ID described above (generated on first launch, not tied to the hardware). If the user is signed in, the event is linked to their account (user ID); kiosk events are linked to the device.

Before sending, and again on the server, texts are stripped of emails, phone numbers, tokens, URL parameters, CNPs, document numbers and IP addresses. Legal basis: legitimate interest in fixing errors and keeping the apps fast (Art. 6(1)(f)). The “Send diagnostics” option in the Staff app and admin panel settings stops recording and sending and clears the local queue.

IP addresses

The platform does not store the IP address of requests: not in accounts, not in the action log, not in payments, not in diagnostics. Connections pass through the Cloudflare network, which sees the IP address as a processor, only to deliver traffic and protect the service; we neither receive nor store the IP address. The web server keeps no access logs. Devices only report their private address on the property's local network, for support. Exception: Stripe collects the IP address in the payment form, as its own controller (see “Payments”).

How long we keep data

Who receives data

• DigitalOcean: server hosting (API, database, encrypted files) in the Frankfurt (FRA1) data centre, Germany, EU.
• Cloudflare: DNS and proxy/CDN for the platform's domains (delivering and protecting traffic) and hosting of the kiosk.torcip.com website (Cloudflare Pages).
• Google and Apple: only if you press “Continue with Google / Apple”. The sign-in page does not contact Google or Apple until you move the mouse over the button, select it or press it; only then does the browser load the provider's script, and the provider confirms your identity. We send them no account or guest data; to Apple we send only the authorization-code exchange and the token revocation request.
• Stripe: payment processing, only if the property has enabled payments (see “Payments”).
• Channel managers (Channex, Beds24, Smoobu) and iCal calendars: only if the property connects them, to sync its reservations.
• Authorities: only the property submits the registration form / SIT data, under its legal obligations.

The kiosk.torcip.eu, admin-kiosk.torcip.com, admin-kiosk.torcip.eu, api-kiosk.torcip.com and api-kiosk.torcip.eu domains pass through the Cloudflare network (CDN and security proxy): the connection is TLS-encrypted from the device to Cloudflare and from Cloudflare to our server. During the transition, the old names admin.kiosk.torcip.eu and api.kiosk.torcip.eu (used by older versions of the app and by kiosks) do not pass through Cloudflare: the connection is TLS-encrypted directly from the device to our server. The kiosk.torcip.com website, where this page is published, is hosted on Cloudflare Pages (Cloudflare, Inc.): static pages, with no cookies anywhere on the domain (the /pitchdeck presentation included) and no analytics or tracking scripts. Cloudflare, Inc. processes, as a processor, technical connection data (including the IP address) only to deliver traffic and protect the service; we neither receive nor store the IP address. Cloudflare may process traffic outside the EU under Standard Contractual Clauses (Cloudflare DPA). The KioskOS server and database stay in the EU (Frankfurt); Stripe may also process payment data outside the EU, with the safeguards described in its policy. We use no third-party analytics, advertising, tracking or crash-reporting SDKs, do not sell data, do not profile and make no automated decisions with legal effect.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to lodge a complaint with the Romanian data protection authority, ANSPDCP (dataprotection.ro).

Write to support@torcip.com. For guest data the controller is the property: we forward your request and help it answer. Deleting a staff account: Delete account.