Privacy Policy

Who we are

ProfitTracker (profittracker.app) is operated by Profit Tracker, a UK business. We are the data controller for the personal data described in this policy. Full trading details are provided on invoices and in the Data Processing Agreement.

66 Paul Street, London EC2A 4NA, United Kingdom
legal@profittracker.app

Scope

This policy covers visitors to profittracker.app and account holders — the hotel staff who sign up for and use ProfitTracker.

It does not cover data collected by the ProfitTracker tracking snippet installed on a customer hotel's own website. That data is about the hotel's website visitors, the hotel is the data controller for it, and we process it only on their instruction. Terms for that are set out in our Data Processing Agreement, not here.

What we collect when you visit

Our server logs your IP address, browser user-agent, the page you requested, and the referring URL. We keep these logs for up to 90 days for security and abuse prevention.

We use Plausible, a privacy-friendly analytics tool that we host on our own infrastructure. It sets no cookies and doesn't track you across sites. We don't share visitor data with third parties.

What we collect when you have an account

• Your business name, personal name, and email address.
• Your login credentials. Passwords are stored hashed, never in plain text.
• The property details you enter, such as name, location, currency, and time zone.
• The connections you authorise to advertising platforms and booking engines. We access these only to provide the service — pulling campaign and cost data and matching it to bookings.
• Payment details are handled directly by Stripe. We never see or store your card details.

Email

Transactional email — verification, receipts, password resets — is sent from our own mail infrastructure and is necessary to run your account.

Marketing email, including launch updates for waitlist signups, is sent via Brevo and only if you've opted in. You can unsubscribe at any time using the link in any email, or by emailing legal@profittracker.app.

Why we process it

• Contract. Account data, property data, and platform connections are necessary to deliver the service you're paying for.
• Legitimate interest. Server logs and cookieless analytics keep the service secure and working.
• Consent. Marketing email. You opt in, and you can withdraw at any time.

Sub-processors

We use a small number of processors to run the service. We don't sell data, and we don't share it with anyone for advertising.

• Hetzner Online GmbH. Hosting in Germany and Finland.
• Brevo SAS. Marketing email storage and delivery, in France.
• Bunny.net d.o.o.. Static asset CDN, in Slovenia and the Netherlands.
• Stripe Inc.. Payment processing. Stripe is US-based; transfers are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

Where data lives

All visitor and account data is stored in the EU or UK. We chose our infrastructure providers specifically to keep data inside European jurisdictions. Stripe (US) handles payment metadata only.

Cookies

We don't set any cookies on the marketing site. Once you have an account and log in, a session cookie is set so the site knows you're logged in. That's it.

The tracking snippet that ProfitTracker installs on customer hotel websites is a separate matter, covered by the Data Processing Agreement signed with each hotel customer.

How long we keep it

• Billing and accounting records. Six years after your account closes, as required by UK tax law.
• Other account data — properties, campaigns, attribution history, settings. Deleted within 90 days of account closure.
• Server logs. 90 days.
• Marketing list. Until you unsubscribe, and we'll delete your details within 30 days of a request.

Security

We take reasonable, proportionate measures: encrypted connections everywhere, hashed passwords, access limited to what's needed to run the service, and EU-based, self-hosted infrastructure for error tracking and analytics so your usage data doesn't leave our systems.

No system is perfectly secure, and we won't pretend otherwise. If a breach affects your personal data, we'll notify you and the ICO as UK GDPR requires.

Your rights under GDPR

If you're in the UK or EU, you have the right to access, correct, delete, or export the data we hold about you. You can also object to or restrict how we use it, and withdraw consent for marketing at any time.

To exercise any of these rights, email legal@profittracker.app. We'll respond within 30 days.

If you're not satisfied with our response, you can complain to the UK Information Commissioner's Office at ico.org.uk, though we'd appreciate the chance to sort it out first.

Changes to this policy

If we make material changes, we'll email account holders and the waitlist before the changes take effect. Minor updates are posted here with a new date stamp at the top.