Data processing agreement (Annex I to the terms)

Last updated: 20 October 2026

DRAFT pending review by a lawyer in Spain. This text accurately describes how casflows works, but it has not yet been through a full professional legal review and may change. When it changes, we will ask you to accept the new version.

This annex is part of the casflows terms of use (https://casflows.com). It governs the processing casflows carries out on your behalf of other people’s personal data: the people in your team and your guests (the dates of their bookings and, if you turn on forwarding of your Airbnb emails or you enter them yourself in a booking, their name and how many they are). casflows is a service for professionals only: you accept it in the course of your business or professional activity, never as a consumer.

Parties#

Controller: the individual (self-employed or professional) or the company or management company identified when accepting this annex, with its name or company name, its tax ID (NIF/CIF), its address and a contact email for privacy. You can see and update them in Settings → Legal.
Processor: ENBA HOMES, S.L., a Spanish company with NIF (Spanish tax ID) B70892401, registered office at Camino del Prado 1, Bloque 4, Bajo A, 29630 Benalmádena, Málaga, España and registered in the Mercantile Register of Málaga, electronic folio, sheet MA-181808, entry 1.ª, which provides the casflows service ("casflows").

Who accepts: an owner of the account accepts it, declaring (1) that they use casflows in the course of a business or professional activity, such as managing tourist accommodation, and (2) that they are the identified controller or have sufficient authority to bind it. With each acceptance we keep the controller’s details, who accepted it and in which capacity (account holder or representative), the version, the language, the date and time and the fingerprint (SHA-256) of the accepted text, which you can download at any time.

Management companies working for owners#

If you manage accommodation for other owners, when accepting you declare which of these two situations you are in (and you can change it in Settings):

You decide about the data (you are the controller towards the guests and your team): this annex applies as it is between you and casflows.
You process the data on behalf of each owner (each owner is the controller and you are their processor): casflows then acts as your sub-processor. You undertake to (1) have each owner’s prior written authorisation to engage casflows and its sub-processors, (2) pass on to them data protection obligations equivalent to those in this annex, (3) only give us instructions that respect theirs and tell us if an owner changes them or withdraws their authorisation, and (4) pass on to them what this annex provides for the controller (breach and sub-processor notices and data subject requests). For casflows, your instructions are the owner’s.

Who gives instructions and how they are recorded#

Instructions are given by the account owners (the people with full access to casflows): they configure the service, handle data subject requests, order erasures and decide which team members receive which data. You decide who gets that access and you are responsible for it. A team member with a limited profile restricted to their work does not give instructions: they only see and record their own work.

Your documented instructions are the terms, this annex and the settings you choose in the app. Settings changes that affect the processing are recorded, with the date and who made them, in the Instructions history (Settings → Legal), which you can view and download as CSV:

accepting this annex and updating the controller’s details;
turning on, regenerating or turning off receiving Airbnb and Booking.com emails;
adding a team member and changing their boxes (Cleanings, Arrivals, See the guest’s name, Telegram, active) and the properties assigned to them;
connecting or disconnecting a Google Calendar (the account’s or a team member’s);
creating or regenerating a property’s “Block on Airbnb” link;
inviting someone to casflows (with full access or with a limited profile), and a person getting or losing access to the account or to their profile;
marking, renewing or removing “keep for a claim” on an incident.

The history does not store your guests’ data. Instructions that infringe the law: if an instruction seems to us to infringe the GDPR or another law, we will tell you in writing and we may suspend only the affected operation (not your whole account) until you clarify or change it.

Subject matter, nature and purpose#

casflows processes the data only to provide you with the service described in the terms and on your documented instructions:

reading your listings’ iCal feeds and creating, moving or cancelling the cleaning of each booking;
storing the manual bookings you create (rentals outside Airbnb) and doing with them the same as with Airbnb ones: creating their cleaning, assigning it, notifying your team through Telegram, keeping their events in Google Calendar and counting it in team payments;
organising cleanings and arrivals, assigning them to your team and working out what each person is paid;
sending notices through Telegram and keeping events in Google Calendar;
receiving the incident (text, photos and voice notes, which we turn into text) and restocking reports your team sends you through the Telegram bot, numbering them and linking them to that day’s cleaning; notifying via Telegram, for each incident, the person who sent it (a summary and when it is resolved) and the members of your team with access to casflows who have Telegram linked;
if you turn it on (for the whole account or per property), asking your team in the reminder for, and receiving through the bot, photos of how the property was left after the cleaning and the confirmation that the cleaning is finished;
publishing, if you ask for it, a secret link with the dates of your manual bookings so that your Airbnb blocks them;
if you turn it on, reading the Airbnb emails you forward to know who is arriving and how many people;
if you forward Booking.com “New booking!” emails, reading them to confirm that an event in the Booking.com calendar is a booking (and not a closure) and which property it belongs to;
if you upload an Airbnb earnings report or a Booking.com payments statement, reading the amounts of each booking to calculate the income statistics of your properties;
if you give a team member access to casflows with a limited profile, showing them only their work (their cleanings, the arrivals of their properties, with the guest’s name only if you authorise it, the issues they send and the shopping list, and what they are owed only if you turn on “See what they are owed”), storing what they record there (cleanings they mark as finished, issues, photos and what is missing) and sending them their notices through app notifications if you choose so;
preparing, with the settings you choose, the fee report of each property for its owner.

Export ordered by you: a property's “Block on Airbnb” link is an export you ask us for: anyone who has the link can read the occupancy dates of its manual bookings (never names, guest counts or notes). You can invalidate it at any time by generating a new one.

The operations are: collection, recording, storage, consultation, matching with your reservations, disclosure to the people you designate (those in your team) and erasure. As regards the data it processes as processor, casflows does not use it for its own purposes, does not sell it and does not disclose it except to the sub-processors listed below. The data of your own relationship with casflows (your account, your access, your subscription) is processed by casflows as controller, under the privacy policy.

Duration#

For as long as you have a casflows account and, afterwards, during the 30-day return and erasure period set out in Return and erasure at the end.

Types of data and categories of data subjects#

Data subjects	Data
Guests (if you turn on forwarding of your Airbnb emails or you enter them yourself in a booking)	The guest’s name as it appears on the reservation, the number of guests (adults, children and infants), the reservation confirmation code and the check-in and check-out dates. We never store their phone number, their email, amounts, their city or the listing title, even if they appear in the email. Manual booking: the property and the check-in and check-out dates are required; the guest’s name, the number of guests and the note are optional and are only stored if you enter them. Booking.com booking or Airbnb booking without a name: Booking.com does not give us the name or the number of guests, and Airbnb only sends them in its emails; if you enter them yourself, we only store what you enter. If the Airbnb email for that booking arrives later, its data replaces what you entered. Booking.com emails (if you forward them): from the “New booking!” email we only store the booking number, the property ID on Booking.com, the check-in date and the property name, to confirm that an event in the Booking.com calendar is a booking and not a closure and to learn which property it belongs to; those emails carry neither the guest’s name nor amounts, and the rest of the email is discarded at once.
Guests (if you upload an Airbnb earnings report)	For each movement in the report: the booking confirmation code, the check-in and check-out dates, the nights, the date on which Airbnb releases the payment and the amounts (gross, service fee, fast payout fee, cleaning, taxes and net), including adjustments and resolutions, and the listing name. We never store the guest’s name or the bank details of the account holder that Airbnb includes in the file: they are discarded when it is read. You upload the report yourself, voluntarily.
Guests (if you upload a Booking.com payments statement)	For each movement in the statement: the booking number, the check-in and check-out dates, the nights, the booking status, the date on which the payment is issued and the amounts (booking amount, commission, VAT on the commission, payment service charge and net), including commission adjustments. We never store the guest’s name or the payment ID that Booking.com includes in the file, nor any bank details: they are discarded when it is read. You upload the statement yourself, voluntarily.
Guests (always)	The reservation identifier and its dates, which come from the iCal feed or that you enter yourself in a manual booking, and whatever you choose to write in the notes. Even without a name, they are personal data: a booking with its dates in a specific home can identify whoever is staying there, so this annex applies to them all the same.
People in your team (whoever cleans, welcomes your guests or helps you manage)	Name, label, what each of them does (cleanings, arrivals, seeing the guest’s name), assigned properties, Telegram chat identifier, notices received and, if they connect their own Google Calendar, the data of that connection. If you give them access to casflows, also the invitation email until they accept it or 1 day after it expires. Limited profile (optional): if you give them access with a profile limited to their work, their user account (the email they sign in with), the cleanings they mark as finished and when, the issues, photos and missing items they send from the app, the channel through which they prefer to receive notices (Telegram or app notifications) and, if they turn on notifications, their notification devices (the delivery address their browser gives, its public encryption keys and the type of device and browser). casflows processes their user account and notification devices as a controller, under the privacy policy; what they see and record in your account we process on your behalf, as a processor. Team payments: the cleaning type and the amount attributed to each person for each cleaning, the closed payment periods and, for each person, the payments and adjustments you record (date, amount, payment method and comment) and the balance that results from them. Incidents and restocking: the reports they send you through the bot (text, photos, property, date and who sent it), their status, the note you resolve them with and what is missing in each property. Voice recordings (transcribed and not stored): the voice notes they use to report an incident (their voice and what they say); casflows only stores the resulting text. Photos of the property after the cleaning (optional, deleted after 15 days): if you turn it on, the photos of how the property was left that someone in your team sends when they finish a cleaning, who sent them and when; and the confirmation that a cleaning is finished (date and who confirms it).
Users of your account (the people with access to casflows, full or limited)	Name and email, and what they do in the account on your behalf (for example, who accepted this annex, who gave each instruction, who resolved an incident or recorded a payment).
The account itself (outside this annex)	The account name, its settings, access and subscription are processed by casflows as controller, under the privacy policy. The controller’s details you give us when accepting this annex are used to identify the parties and to contact you about privacy.

A guest’s name and party size only reach the people in your account and the people in your team you authorise (“See the guest’s name” box, which requires “Arrivals”) assigned to that property, in their arrival notices, calendars and profile. Anyone without that box never receives them, neither in notices nor in calendars nor in the app. If you remove it, we stop sending them from that moment.

Only the account owners can see the amounts, payments, balance and Airbnb income. The people in your team do not see in casflows what anyone is paid, not even their own, unless you turn on “See what they are owed” for a person with a limited profile (off by default): they then see only their own balance and the statement of their payments and adjustments, with the comments you write, never anyone else’s; the summary of a closed period is emailed to each owner.

Photos of an incident, and those of the finished cleaning if you ask for them, may show, without meaning to, your guests' belongings or other personal data: ask your team to photograph only the problem or the property, never people or documents. They are kept in private storage, only the people in your account can see them and they are never public.

Voice notes: someone in your team can report an incident with a Telegram voice note (at most 2 minutes). casflows downloads it, turns it into text with the sub-processor Mistral AI and stores only the text, as the incident text; the audio is never stored (it only exists while it is being transcribed). A voice note may contain, without meaning to, third-party data (for example, a guest’s name): ask your team to describe only the problem.

No special categories of data are processed. You must not enter them in the notes.

What each team member receives#

Person’s boxes	What they receive or see (Telegram, the app and, if they connect it, their Google Calendar)
Cleanings	The cleanings of their properties: property, date, time from which they can clean and whether another guest checks in that day (with the deadline). Never the guest’s name.
Arrivals	The arrivals of their properties: property, check-in date and time and check-out date. Without the guest’s name.
Arrivals + See the guest’s name	The same as “Arrivals”, plus the guest’s name and number of guests, if we have them.
Full access to casflows	Everything in the account in the app, as an owner (including amounts, incidents and this annex).
casflows app (limited profile)	Only their work, in the app: their cleanings for today and the coming days (property, date, time and whether another guest checks in), which they can mark as finished and, if you ask for it, with photos; the arrivals of their properties (the guest’s name and party size only with “See the guest’s name”); the issues they send and the shopping list, if you allow it; and what they are owed (their balance and the statement of their payments and adjustments) only if you turn on “See what they are owed”. They never see other people’s data, the account’s amounts or this annex. Their notices reach them through Telegram or app notifications, depending on the channel chosen.
Doesn’t use Telegram	Nothing through Telegram (neither notices nor linking). If they connect their Google Calendar, they still get their events there.

In addition, any team member linked to the bot can send you incidents and what is missing in the properties assigned to them.

Retention periods and automatic deletion#

Guest name and party size: casflows deletes them from its own systems automatically 30 days after the check-out date of the reservation, and immediately if the reservation is cancelled. On cancellation, we also remove the name from the upcoming Google Calendar events managed by casflows.
Copies already delivered: Telegram notices already delivered to your recipients and past Google Calendar events stay in their chats and calendars, outside casflows’ systems, under your control and theirs. As the controller, you decide whether to ask them to delete them. In practice: ask your team to delete the bot chats they no longer need (or the whole chat), and remember that removing their “See the guest’s name” box or unlinking them from Telegram does not delete what they already received.
Telegram: messages already delivered are on Telegram’s servers and on each person’s devices, under their control and Telegram’s (which processes them under its own terms): casflows cannot delete them.
Google Calendar: when a calendar is disconnected from casflows, or when your account is erased, we delete the calendar we created for it (if Google responds; otherwise access is revoked anyway). If the person revokes access from their Google account, casflows can no longer touch that calendar: any remaining events are theirs and only they (or you, by asking them) can delete them.
Email received before the iCal reservation: its data is kept, without being shown, until the matching reservation appears and, at most, until the end of the stay stated in the email (never less than 72 hours) or, if the email does not state the check-out date, 90 days; if it does not appear, it is deleted without ever being shown.
Airbnb income (the movements of the report you upload, with their date, amounts, booking code and listing name): 6 years from the date on which Airbnb releases the payment, or until the account is closed if sooner; then they are deleted automatically. You can delete them earlier, per property, from the statistics. casflows is not your accounting: it is an aid to see how much each property earns.
Booking.com income (the movements of the statement you upload, with their date, amounts and booking number): 6 years from the date on which the payment is issued, or until the account is closed if sooner; then they are deleted automatically. You can delete them earlier, per property, from the statistics. casflows is not your accounting.
Limited profile of a team member: their access ends as soon as you remove it or remove them from the team; their notification devices are deleted when they turn them off, sign out, the notification service reports the address as expired or their user is deleted; what they recorded (finished cleanings, issues, photos and missing items) follows the periods of each kind of data.
Data extracted from Booking.com emails (booking number, property ID, check-in date and property name): casflows deletes them automatically 30 days after the check-in date, always. A Booking.com booking without its email is shown as “to be confirmed” and your team receives no notices about it until it is confirmed (with the email or because you decide whether it is a booking or a closure).
Log of emails received (without the guest’s name, only the type of email, the result and the reservation code): 90 days.
Gmail forwarding verification code: deleted when the first Airbnb or Booking.com email arrives or, at most, after 7 days.
Rejected senders: for emails that are not from Airbnb, Booking.com or Google’s verification, we only keep the domain of the last rejected sender (for example, “gmail.com”, never the full address), to help you diagnose forwarding; it is deleted after 90 days.
Team payments (closed periods, with their amounts per person, and the payments and adjustments you record): 6 years from the end of the period or from the date of the payment or adjustment, or until the account is closed if sooner; then they are deleted automatically. This is the period we apply by default when you use this feature; we chose it as an indicative reference based on the general retention period for business records (Art. 30.1 of the Spanish Commercial Code), if it applies to you, but deciding how long you need to keep them is up to you. casflows is not your accounting: download the period reports you need to keep, and write to us if you need a different period.
Incidents and restocking: photos are deleted automatically 24 hours after the incident is marked as resolved and, at most, 12 months after we receive them; the text of resolved incidents and restocking reports already restocked, 12 months after they are resolved or restocked. An issue counts as resolved from the moment someone with access to your account marks it as “Resolved” in casflows (if it is reopened before then, the photos stay and the period starts again when it is resolved again). Also, you can delete any photo earlier. Telegram: as soon as we store a photo, we delete the message with the photo from the bot chat; Telegram only allows this within 48 hours of it being sent, so, if we don't manage to, it stays in that chat, under the control of that person and of Telegram. On the other hand, the text the person writes stays in their chat.
Photos of the finished cleaning: deleted automatically 15 days after the date of the cleaning, always (also if you turn the feature off); those we could not download from Telegram, at most 2 days after they were sent. As soon as we store one, we delete the message from the bot chat (only possible within 48 hours; if we don't manage to, it stays in that chat). The confirmation that a cleaning is finished is kept with the cleaning and follows its period.
Voice notes: casflows does not store the audio; its text follows the incident’s periods. The identifier of the Telegram message is deleted when it is transcribed (if something fails, at most 2 days later) and, once transcribed, we delete the voice note from the bot chat (only possible within 48 hours of it being sent; if we don't manage to, it stays in that chat, under the control of that person and of Telegram). Mistral AI may keep the audio and the text for a limited time to monitor abuse of its service, except with zero data retention (see the list of sub-processors).
Keep it for a claim: if you need an incident for a claim (for example, the deposit), an account owner can mark it to keep it for a claim, always with a reason. While the mark is in force we delete neither the issue nor its photos. The mark lasts 6 months and can be renewed; 30 days before it expires, the dashboard asks you to review it. If you let it expire, the normal periods apply again. Marking, renewing and removing it are recorded in the Instructions history. When the account is closed, the mark does not prevent erasure: download beforehand what you need for the claim.
All other data is kept for the periods in the privacy policy.

This deletion of guest data always runs automatically, without you having to do anything.

Obligations of casflows as processor#

Process the data only on your documented instructions, including with regard to international transfers, unless a law requires otherwise (in which case we will inform you beforehand, where the law allows). If an instruction seems to us to infringe data protection law, we will tell you (see Who gives instructions).
Ensure that the people authorised to process the data have committed themselves to confidentiality.
Process only the minimum data: from the Airbnb and Booking.com emails we only extract the data listed in Types of data and discard the rest without storing it.
Keep a record of processing activities as processor where applicable (Art. 30(2) GDPR).
Assist you in meeting your obligations, as detailed in Assistance.

Security measures#

We apply the Art. 32 GDPR measures described in the privacy policy and, for email forwarding, also:

Each account has a secret forwarding address that only the account holder sees; you can generate a new one at any time and the old one stops working immediately.
Only emails whose sender is Airbnb, Booking.com or Google’s forwarding verification are accepted; everything else is rejected and, from it, we only keep its domain (that of the last rejected sender) to diagnose forwarding.
Delivery of the email to the app is signed (HMAC) and limited to a daily number of emails per address.
Isolation between customers with row-level security (RLS) and encrypted secrets (AES-256-GCM).
Incident and cleaning photos are kept in private storage and are only shown to the people in your account, through temporary links that expire after 5 minutes, with no bulk download and no public links.
Voice notes are not stored: the audio only passes through the server’s memory while it is being transcribed, and neither the audio nor the text is written to the technical logs.
Data from an Airbnb email is only linked to a reservation if its code matches a reservation in your account; data from a Booking.com email, only if the property ID and the check-in date match a calendar and a reservation in your account.

Sub-processors#

You give us a general authorisation to engage sub-processors. The up-to-date list, with each one’s function, where it processes the data, which data it accesses and its international transfer mechanism, is always at casflows.com/subencargados. Today they are:

Supabase (Supabase Pte. Ltd.): database, authentication and storage of incident and cleaning photos (European Union).
Vercel (Vercel Inc.): application hosting.
Cloudflare (Cloudflare, Inc.): domain DNS and reception of the email you forward (Email Routing and Workers), which processes the email in transit to deliver it to casflows. Cloudflare records each email in an activity log (sender, recipient, subject —which may include the guest’s name— and delivery result), which its dashboard keeps for 30 days and which only the administrators of casflows’ Cloudflare account can view.
Google (Google LLC / Google Ireland Ltd.): Google Calendar, only if you or a team member connect it.
Telegram (Telegram Messenger Inc.): channel for the notices to your team and for the incident and restocking reports it sends you (see below).
Resend (Plus Five Five, Inc.): transactional emails (today, the summary of a closed payment period sent to the account owners), sent from the EU (Ireland); Resend account data and the log of what is sent are in the US.
Mistral AI (Mistral AI SAS, France): transcription of the voice notes your team uses to report an incident; it receives the audio and returns the text (European Union).

Telegram, in two parts: (a) Telegram transmits and stores the messages as the provider of the messaging service, under its own terms and privacy policy, and processes in that way the data of whoever uses its app (their account and their chats); it does not offer a data processing agreement to those who use its bot API, so casflows does not have one signed with Telegram; (b) sending the notices and receiving the incident reports (text, photos and voice notes) that casflows does through the Telegram Bot API is processing casflows carries out on your behalf, covered by this annex. A person opening the bot does not replace your obligations as controller (for example, informing them): it only allows the bot to message them. You can limit it with each person’s boxes and with “Doesn’t use Telegram”.

On Supabase, Vercel, Cloudflare, Resend and Mistral AI we impose by contract data protection obligations equivalent to those in this annex and remain liable to you for their compliance. Google and Telegram do not offer a data processing agreement for these uses: they process the data under their own terms. That is why they only take part if you or each team member decide so (connecting a Google Calendar, linking the bot) and you can limit it with each person’s boxes. Changes: we will notify you of any new or replacement sub-processor (or a change in where they process the data) at least 30 days in advance, by email to your account owners and with a notice in the app, and we will update the list. You may object on reasonable data protection grounds; if we cannot find a solution, you can turn off the affected feature or cancel the service without penalty.

Who is not a sub-processor: Airbnb (it reads the “Block on Airbnb” link and gives you the iCal feed because you ask it to; it processes that data on its own account). Nor is there any payment provider: casflows does not charge today; if we turn on charging, that provider will process your payment data with casflows as controller, never your guests’ or your team’s data.

Data location and international transfers#

Data	Where it is processed
All stored data (database and incident and cleaning photos)	European Union (Frankfurt, Germany), at Supabase.
Data while you use the app	Server functions in the European Union (Frankfurt), at Vercel.
The Airbnb and Booking.com emails you forward and their activity log	Cloudflare’s global network (may be outside the EEA).
Google Calendar events (if connected)	Google’s infrastructure (also outside the EEA).
Telegram messages	Telegram’s infrastructure, outside the European Union.
Emails to account owners	Sent from the European Union (Ireland), through Resend; Resend account data and the log of what is sent, in the US.
Incident voice notes (while being transcribed)	European Union, at Mistral AI (France; data hosted by default in the EU, according to Mistral).

Vercel, Cloudflare, Google and Resend are companies headquartered in the US, and Supabase Pte. Ltd. (Singapore) belongs to a group with a US parent company: their staff may access the data from outside the European Economic Area (for example, to provide support). That access or transfer takes place with the Chapter V GDPR safeguards: Standard Contractual Clauses in the data processing agreement of Supabase, Vercel, Cloudflare and Resend, and the EU-US Data Privacy Framework (adequacy decision) for Vercel, Cloudflare, Resend and Google LLC. Telegram processes the messages outside the European Union without standard clauses or any other Art. 46 GDPR safeguard, because it does not offer them: that is why we only send through Telegram what each notice needs and linking the bot is optional. Mistral AI is a European Union company and processes the data by default in the EU: there is no international transfer (if any of its sub-processors processes it outside the EU, it states that this is covered by Art. 46 GDPR safeguards). Each provider’s mechanism is set out in the list of sub-processors and in the privacy policy, and we will tell you if it changes.

Personal data breaches#

We will notify you without undue delay and in any case within 48 hours of becoming aware of any personal data breach affecting this data, so that you can notify the authority (Art. 33 GDPR) and, where appropriate, the data subjects (Art. 34 GDPR).

First notification, with what we know at that moment: what happened and when, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact person.
Information in phases: what we do not know yet we will send you in phases, as soon as we have it, without waiting to have it all.
Channel: by email to the privacy email you gave us when accepting this annex and to the account owners, with a notice in the app. You can write to us at privacidad@casflows.com.

Data subject requests#

Taking into account the nature of the processing, we will help you respond to requests for access, rectification, erasure, restriction, portability and objection. If a guest or a member of your team writes to us directly, we will forward the request to you without answering it on your behalf, unless you instruct us otherwise.

Assistance#

Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under Articles 32 to 36 GDPR:

the security of processing and the handling of breaches;
the data protection impact assessments you decide to carry out and, where needed, prior consultation with the supervisory authority;
complaints from data subjects and requests from the Spanish Data Protection Agency (AEPD) or another authority about this processing.

Return and erasure at the end#

When the service ends, you decide (Art. 33 of Spanish Organic Law 3/2018, LOPDGDD) whether the data is erased, returned to you or handed over to the processor you designate: during the 30 days after closure you can ask us for the export (or for it to be handed over to another processor). After that period we erase it from our active systems; in backups, which are encrypted, are only used by our technical team to restore the service after a disaster and are never restored for ordinary use, it disappears within a maximum of 7 further days. Guest data does not wait until then: it follows the retention periods.

Erasing the account also erases the acceptances of this annex and the Instructions history: download them beforehand if you need them. casflows only keeps, blocked, the data it needs to meet its own responsibilities as controller, under the privacy policy: the evidence that the terms were accepted and, once the paid subscription exists, its billing.

Information and audits#

We will make available to you the information needed to demonstrate compliance with this annex and will allow for and contribute to audits, including inspections, carried out by you or by an auditor you appoint who is bound by confidentiality. We will normally address them first with documentation and written answers. As a general rule, audits must be requested 30 days in advance, at most once a year, without compromising security or other customers’ data, and at your expense.

Without those limits (neither the 30 days’ notice nor the yearly maximum): when a supervisory authority requests it, after a security breach affecting your data, when there are reasonable indications of non-compliance with this annex or after a substantial change in the processing or in the sub-processors.

Your obligations as controller#

Have your own legal basis to process the data of your guests and the people in your team. For example, in Spain, your obligation to register travellers (Royal Decree 933/2021). casflows is not that register and does not send anything to the authorities: if you have that obligation, you keep meeting it yourself.
Turn on forwarding only from a mailbox you control and only for Airbnb and Booking.com emails, without forwarding any other mail.
You must inform your guests and the people in your team of this processing (Arts. 13 and 14 GDPR), including that casflows and its sub-processors act as processors.
Keep the controller’s details up to date (Settings → Legal) and give full access to casflows only to those who should give instructions on your behalf and, to team members who only need to see their work, a limited profile.
Give instructions that comply with the law, as set out in Your responsibilities for the data you enter in the terms.

Version and acceptance#

Current version: 2026-10-20, published on 20/10/2026. An account owner accepts it expressly in the app, with the controller’s details, and we keep a record of each acceptance (see Parties). Accepting this annex is separate from accepting the terms and from turning on each feature (for example, email forwarding), which are recorded separately. Without that acceptance casflows cannot be used, forwarding cannot be turned on and we do not store any guest data.

If we publish a new version, you will have to accept it to keep using casflows. Until you accept it, we will keep processing the data under the last version you accepted (for example, processing the emails you forward and what your team sends to the bot), and anything new in the pending version will only apply once you accept it. Each published version is kept as it is and you can download the one you accepted in Settings → Legal.

Contact#

For any question about this annex: privacidad@casflows.com. By post: ENBA HOMES, S.L., Camino del Prado 1, Bloque 4, Bajo A, 29630 Benalmádena, Málaga, España.