Privacy Policy

Version: 1.1
Last updated: March 14, 2026

 

Summary of the main treatments

Category	Examples	Where covered
Accounts and roles	email, user ID, role, language, account type, plan status	server + app
Security and devices	Device ID, technical sessions, logs, push tokens	server + app
Calendars & Apartments	apartment_id, unit name, ICS link, event metadata	server + app
Automated messages	testi, canali, destinatari, schedule, nextSendAt, log, retry	Servers
Guest Data and Notes	number of guests, name, telephone, notes and instructions	mainly apps; servers when needed for syncing, delivery, or team sharing

 

1. Data Controller and contacts

The data controller is HBM software, with registered office in Via Marcello Malpighi 8, 20129 Milan. For privacy-related requests, you can write to privacy@domusync.com or info@domusync.com.

This policy describes the processing of personal data carried out within the Domusync app and the associated technical services.

2. To whom the information refers

The policy concerns registered users of Domusync, including the Host who owns the main account and the Invited Users authorized to operate through the Host Account. To the extent technically necessary, the information also covers third-party data that users enter, share or synchronise via the app.

Domusync is designed to support a model with Host Accounts and invited access, with different roles, permissions and visibility based on the Host configuration and enabled features.

3. What data we process

To provide the service, we may process different categories of data, which vary according to the features used, the role of the user and the integrations activated.

• Account and profile data: email, user ID, user role, account type (Host or Invited User), language, sync settings, backup settings, relationships with the Host Account, plan limits, plan status, and subscription status.

• Technical device and security data: device ID, session identifiers, technical tokens, authorized device status, log data, IP address, date and time of requests, error information, and security metadata.

• Notification and communication data: device push tokens, reception preferences, language and time zone of the device, as well as data necessary to send push notifications, banners, emails or other reminders configured by the user.

• Apartment and calendar configuration data: apartment ID, apartment name or identifier, ICS links, calendar configuration parameters, synchronization rules, and event metadata.

• Team and sharing data: identification data of users connected to the apartments, shared roles, associations between apartments and team members, relationships between Hosts and invited Users, recipients of automatic reminders and related settings.

• Data relating to reminders and automatic messages: type of message, text, recipient, recipient phone or email, sending schedule, nextSendAt, outcome log, retry data and information strictly necessary for the management of the automation.

• Guest data and operational notes: data entered manually by the user or from synchronized feeds, such as guest number, guest name, phone, operational notes, notes for host or team, login information, or other instructions, within the limits of the functionality actually used.

4. Data that remains local and data that can transit or be processed on the server side

In many cases, Domusync is designed to keep a significant portion of manually entered operational data and guest information on the user's device.

However, when you use synchronization, sharing, messaging, reminders, fan-out, ACK, retry, backup, restore, or automation features, certain operational information may transit through or be processed by the server, even temporarily, to the extent strictly necessary to synchronize authorized devices, distribute data between Hosts and Authorized Invited Users, deliver updates, send reminders, record outcomes, and ensure security service technique.

Any guest data that may be present in the ICS feeds of portals or other third-party services are processed by the server to the extent that they are contained in the feed and are necessary for calendar synchronization, the correct distribution of data to authorized users and the operational continuity of the service.

5. Purpose of the processing and legal basis

• Provide the service, create and manage the account, associate the authorized device, allow login, recovery, single-device and business continuity: legal basis execution of the contract or pre-contractual measures.

• Manage the activation of the Host plan, any trial periods, invited accesses and the configuration of roles and authorizations: legal basis execution of the contract or pre-contractual measures.

• Synchronize calendars, events, statuses, notes, reminders, and updates between authorized devices and team members: legal basis for contract execution.

• To send push notifications, banners, e-mails or other automated messages requested by the user or provided for by the activated functionalities: legal basis execution of the contract and user instructions in the use of the service.

• Monitoring security, preventing abuse, managing incidents, technical logs, errors, audits and service defense: legal basis legitimate interest of the owner in the security, integrity and continuity of the service.

6. To comply with legal obligations, requests from the authorities or legal protection needs: legal basis, legal obligation or legitimate interest, as the case may be.

Any verification PIN codes generated for registration, restoration or similar procedures are processed for the time strictly necessary for verification and, where technically required, stored in hash form or in any case with adequate security measures.

Passwords or codes chosen by the user for local use of the app, if present in the functionality of the application, remain on the device and are not stored in plain text on our servers.

The service may also process technical session identifiers, tokens, and other authentication metadata necessary for the operation of the system and the protection of the account.

7. Processing methods and security

The processing is carried out with electronic tools and organisational logics consistent with the purposes indicated above.

We take appropriate technical and organizational measures to reduce the risk of unauthorized access, loss, misuse, alteration or destruction of data, including encrypted communications, access controls, security logs, segregation of roles, and measures to protect databases and backups.

ICS links can be stored in encrypted form; Logs and technical data are processed in protected environments to an extent proportionate to the needs of security and continuity of service.

8. Recipients and categories of subjects who may process the data

The data may be processed by authorized personnel of the owner and by technical suppliers who support the service, such as hosting providers, databases, storage, backups, push notifications, transactional emails, communication services, cloud services and infrastructure assistance.

The data may also be communicated, within the limits necessary, to the Host holding the account, to the Invited Users authorized by the Host or configured as recipients in the logic of team sharing, notes, reminders or automations, based on the permissions and configurations of the service.

If some suppliers are established outside the European Economic Area, any transfers will take place in compliance with the applicable legislation and through the guarantee tools provided for by the GDPR.

9. Data retention

• Account data, configurations, apartments, team relationships and settings are stored for the time of use of the service and subsequently for the time strictly necessary to manage closures, disputes, security, backups and legal obligations.

• Technical and safety logs are kept for a limited period and proportionate to the purposes of diagnostics, safety and abuse prevention; ordinarily they can be kept for about 30-90 days, except for further needs in the event of accidents or requests from the authority.

• Data relating to automatic reminders, sending logs, retries and operational metadata are stored for the time necessary to perform the service, demonstrate the technical outcome of the activities, manage anomalies and protect the owner in the event of disputes.

• Backups are retained according to normal rotation cycles and for the time strictly necessary for recovery or business continuity.

• If a trial period is not converted to an active plan, data may be deleted, anonymized or made no longer accessible in active systems within a reasonable time, subject to what is necessary for security, disputes, backups and legal obligations.

10. Rights of the data subject

• You can exercise your rights under the GDPR, including access, rectification, erasure, restriction of processing, objection where required by law, and data portability.

• The data subject also has the right to lodge a complaint with the Data Protection Authority, if he/she believes that the processing violates the applicable legislation.

• To exercise your rights or ask for clarifications, you can write to privacy@domusync.com. Additional information may be requested to verify the identity of the applicant.

11. Third-party data entered by users

If you enter data about guests, collaborators, Invited Users, or other third parties into the app, you are responsible for having an appropriate legal basis and providing any disclosures required by law.

When the Host enables invited access or shares team data, the owner processes such data to the extent that this is technically necessary for the provision of the requested service and the correct distribution of information to authorized users.

12. Children and updates to the policy

The app is not intended for minors and registration is restricted to individuals of legal age or otherwise entitled to use the service on behalf of an organization, business, or Host Account.

This policy may be updated from time to time. The latest version will be made available in the app or on the service website, with an indication of the update date.