Privacy policy

Summary#

• Who we share it with: only the providers we need to run the service; some are outside the European Union, with the safeguards stated. See Who we share data with and International transfers.
• How long: as long as each purpose needs, with specific periods. See Retention.
• Your rights: access, rectification, erasure, restriction, portability and objection, by writing to privacidad@casflows.com. See Your rights.

Who the controller is#

• Controller: ENBA HOMES, S.L.
• NIF (Spanish tax ID): B70892401
• Registered office: Camino del Prado 1, Bloque 4, Bajo A, 29630 Benalmádena, Málaga, España
• Registration details: Mercantile Register of Málaga, electronic folio, sheet MA-181808, entry 1.ª
• Privacy email: privacidad@casflows.com
• Service: casflows — https://casflows.com

The controller is a Spanish company, established in Spain, offering the service to customers in Spain and the rest of the European Union. We apply Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).

Who decides about each piece of data#

Depending on the operation, we are the controller (we decide why and how the data is processed) or a processor (we process it on behalf of whoever uses casflows to manage their properties, whom we call “the host”, only on their instructions, under the data processing agreement (Annex I to the terms), Art. 28 GDPR):

Management companies. If a management company uses casflows for other owners’ properties, it declares its role when accepting the data processing agreement: if it decides about the data, it is the controller and casflows its processor; if it processes the data on behalf of each owner, the owner is the controller, the management company its processor and casflows acts as the management company’s sub-processor (see Management companies working for owners). In this policy, “the host” is whoever decides in each case.

Telegram. When the host sets up notices, we, as processor and on their instructions, send them to each person who has linked the bot through the Telegram API, and the same way we receive what those people send to the bot. Telegram transmits and stores those messages as the provider of the messaging service, under its own terms and privacy policy. We do not have a data processing agreement signed with Telegram: it does not offer one to those who use its bot API. That is why we only send through Telegram what each notice needs, and linking the bot is always the person’s own decision. Your account’s bot. If you turn it on, the bot your team uses is created by you in your own Telegram account and belongs to you: you manage it in @BotFather (you can delete it, change its token or restrict it whenever you like). Telegram tells us you have created it and gives us its token, the credential we use to operate it; we store it encrypted, only use it to send and receive your team’s messages on your behalf, and delete it when the bot is retired or your account is closed. Telegram remains the same messaging provider and is covered by what is said above. Until you have a bot of your own, notices go out through casflows’ shared bot; if yours stops working, those notices wait until you reconnect it.

Confidentiality. The people in our organisation who can access personal data (support, systems administration and incident response) are bound by a duty of confidentiality that continues after their relationship with us ends (Article 5 LOPDGDD).

What data we process#

We do not ask for special categories of data (health, beliefs, etc.). Please do not include them in notes, and do not write guest data in notes unless it is necessary. Today casflows does not charge or store payment data; if we enable payments, we will update this policy first.

Guests at your properties (forwarding or entered by you)#

If the host turns on forwarding of their Airbnb emails to their casflows address, we only read from those emails the guest’s name, the number of guests, the reservation confirmation code and its dates. We never store the phone number, email, amounts, city or listing title, even if they appear in the email.

If the host also forwards Booking.com “New booking!” emails (sender noreply@booking.com), we only read from them the booking number, the property ID on Booking.com, the check-in date and the property name. We use them to confirm that an event in the Booking.com calendar is a booking (and not a closure) and to learn which property it belongs to. Those emails carry neither the guest’s name nor amounts, and the rest of the email is discarded at once. Until a Booking.com booking is confirmed it is shown as “to be confirmed” and the team receives no notices about it.

If you create a manual booking (a stay you arrange outside Airbnb), you can enter the guest’s name and the number of guests yourself. It is the same data and it is handled the same way: the same people see it and it is deleted within the same periods. The same applies to a Booking.com booking: Booking.com does not give us the guest’s name, so, if you wish, you enter it yourself (with the number of guests) and it is handled the same way. And in an Airbnb booking without a name (for example, if you do not forward the emails): if you enter it yourself, it is handled the same way; if the Airbnb email for that booking arrives later, its data replaces what you entered.

For that processing the host is the controller and casflows is a processor, under the data processing agreement (Annex I). If you are a guest, you can exercise your rights with the host; if you write to us instead, we will pass your request on to them.

The host determines and documents the legal basis for each use they make of this data (for example, organising your arrival) and informs you as controller; casflows only processes it on their instructions. casflows does not carry out the traveller registration under Royal Decree 933/2021 (casflows is not that register) and does not send anything to the authorities.

• casflows deletes the data extracted from Booking.com emails (booking number, property ID, check-in date and property name) 30 days after the check-in date, always.
• casflows deletes the name and party size from its own systems automatically 30 days after check-out, and immediately if the reservation is cancelled. On cancellation, it also removes the name from the upcoming Google Calendar events it manages.
• Telegram notices already delivered and past Google Calendar events stay in the chats and calendars of the people who received them: there, the host remains the controller, together with those people.
• For emails that are not from Airbnb, Booking.com or Google’s verification, we only keep the domain of the last rejected sender (for example, “gmail.com”, never the full address), to diagnose forwarding, and it is deleted after 90 days.
• If the email arrives before the reservation, it is kept without being shown until the reservation appears and, at most, until the end of the stay stated in the email (never less than 72 hours) or, if the email does not state the check-out date, 90 days; if it does not appear, it is deleted without ever being shown.
• They are only shown to the people in the host’s account (and in their own Google Calendar, if they connect it) and to the people in their team they authorise: a team member only gets the guest’s name and party size if the host ticks the “See the guest’s name” box for them (which requires “Arrivals”): in their arrival notices, in their calendar and in their profile, also on their cleanings (who checks out and who checks in that day; in their calendar and profile, not in the Telegram cleaning notice). Someone who only does cleanings (without that box) does not get it.

If you are part of a host’s team#

If you are part of a host’s team (you clean, welcome their guests or help them manage their properties with casflows), that host or management company is the controller of your data and we process it on their behalf, as processor. They decide what data about you is kept, which notices you get and what you see (for example, whether you see guests’ names).

• What data: your name, a label, the tasks you do and the properties assigned to you (provided by the host); your Telegram chat ID and what you send to the bot, such as the text, photos or voice notes of an incident and, if the host asks for them, photos of how the property was left when you finish a cleaning and the confirmation that you have finished it (provided by you when you use it; a voice note is turned into text and the audio is not stored); if you connect your own Google Calendar, the email address of that Google account and an encrypted token (see Data we receive from Google); and, if the host uses it, what you are owed per cleaning and the payments they mark.
• Who else processes it: Telegram, if you link the bot; Mistral AI, if you send a voice note (it turns it into text); and Google, if you connect your calendar (see Who we share data with).
• What is optional: linking the Telegram bot and connecting your Google Calendar. You can ask the host to unlink or disconnect you, and remove casflows’ access from your Google account whenever you want.
• If the host gives you a limited profile in casflows: you sign in with your user account (the email you sign in with) and a password, and see only your work: your cleanings and the arrivals of your properties (with the guest’s name and party size — on a cleaning, who checks out and who checks in that day — only if the host authorises it, “See the guest’s name” box), the issues you send, the shopping list and, only if the host turns on “See what you are owed”, your balance and the statement of your payments and adjustments (with the comments the host writes). You never see other people’s data or the account’s amounts. From there you can mark a cleaning as finished and send issues, photos and what is missing, and choose whether you receive your notices through Telegram or app notifications (see Push notifications).
• Who is the controller of your user account and your devices: we are. Your user account (email, password and sessions) and the subscription of each device on which you turn notifications on are data about your use of casflows; what you see and record in the host’s account we process on their behalf, as a processor. Legal basis for your user account: our legitimate interest in giving you the access the host authorises and keeping it secure — Art. 6(1)(f). Basis for notifications: your consent — Art. 6(1)(a): you turn them on, on each device, and can turn them off whenever you want.
• How long: while the host keeps you in their team and within the periods in Retention. Your limited-profile access ends as soon as the host removes it or removes you from the team.
• Your rights: contact the host. If you write to us, we will pass your request on to them and help them answer it (see Your rights).

So that the host can inform you as controller (Articles 13 and 14 GDPR), casflows gives them a short, reusable, layered text (Article 11 LOPDGDD): the “Privacy notice for your team” on the Team page. With their name already filled in, it explains who the controller is, why and on which basis your data is processed, what data and where it comes from, who else processes it (casflows, Telegram and Google), how long it is kept and how to exercise your rights, and links to this section. We also remind you of it when you link the Telegram bot and when you connect your Google Calendar.

Information requests#

If you write to us through the contact form on casflows.com ("Let's talk"), we store your name, your email, how many properties you manage, your message (if you write one), the page language and the date you write to us. To stop automated or abusive submissions, we also store a fingerprint (hash) of your IP address, computed with a secret key, which cannot be turned back into the IP; it is only used to limit how many requests arrive from the same origin in an hour. We remove it from requests older than 24 hours every time a new one arrives and, in any case, it is deleted together with the rest of your request.

• We are the controller of this data (we do not process it on behalf of any host).
• What for: To answer your request and, if you ask us to, tell you how casflows works and what it costs. We will not send you advertising or newsletters.
• Legal basis: Taking, at your request, pre-contractual steps — Art. 6(1)(b); and our legitimate interest in replying to people who write to us — Art. 6(1)(f). For the IP fingerprint, our legitimate interest in protecting the form — Art. 6(1)(f).
• Which emails are sent: when you send the form we send you an email confirming that we have received it (at most one every 24 hours, even if you write to us several times) and we notify the casflows team by email with the details of your request so we can reply. They are sent by our email provider, Resend (see Who we share data with). The technical record of each email does not keep your email address and is deleted after 90 days.
• Who sees it: the authorised staff of casflows who handle the contact mailbox, bound by confidentiality. That notice reaches our contact mailbox, which we receive through Cloudflare’s email forwarding in a Gmail account (Google). Apart from Resend, Cloudflare and Google, which process those emails to deliver and store them, we do not disclose it to anyone else or use it for other purposes.
• If we sign you up: if you want to start using casflows, we create a single-use sign-up link with your email (it expires after 7 days). Only we send that link, through the channel we have been talking to you on; we store your email and a hash of the link, never the link itself, and delete them 30 days after it expires.
• How long: 12 months from when you write to us (see Retention). If you later sign up to casflows, your account data follows its own periods.
• It is stored in our database in the European Union (Supabase).

You can ask us to delete your request, object to this processing and exercise the rest of your rights by writing to privacidad@casflows.com.

Push notifications#

If you tap “Turn on notifications” in Settings, your browser gives us a delivery address for that device (an address of its maker’s notification service) and some public keys to encrypt the alerts. We store them under your name, with the type of device and browser, to send you the alerts you choose from the accounts you have access to: new and cancelled bookings, new issues, finished cleanings and problems that need your attention (a calendar that won’t sync, a disconnected Google Calendar, no one receiving the next day’s arrival or undelivered Telegram notices). The permission is given by your browser and we only ask for it when you tap that button.

• We are the controller of this data: it is data about your use of casflows, not data we process on behalf of a host.
• Why: to send that device the alerts you have turned on and, if you ask for it, a test notification.
• If you are part of a host’s team and have a limited profile: you can choose to receive here, instead of through Telegram, the reminder of the day before, changes and cancellations of your cleanings, the question of whether you have finished and the notice that an issue of yours is resolved. These notices never carry a guest’s name or the text of an issue. The host processes them as controller and we do so on their behalf; the subscription of your device is ours (see If you are part of a host’s team).
• Legal basis: performance of a contract — Art. 6(1)(b): it is a feature of the service that you turn on, on each device, and can turn off whenever you want. Storing the subscription in your browser is necessary to provide the service you ask for (Art. 22(2) LSSI).
• What shows on the lock screen: the property name, the dates, the platform (Airbnb or Booking.com), the issue number or how many notices were not delivered. The finished-cleaning alert also says who finished it (the name that person has in the account’s Team) and how many photos they sent or, if someone with access to the account marked it as done on the web, their user name (they don’t receive it themselves). Never a guest’s name, how many guests there are, the booking code, the text of an issue, links or error messages.
• Who is involved: the alert is delivered by the notification service of your browser’s or phone’s maker (Apple, Google, Mozilla or Microsoft). The content travels end-to-end encrypted (Web Push standard): that service cannot read it; it only sees your device’s delivery address and technical data about the delivery, such as the time and size. We do not choose it: it is the one your browser uses for all its notifications (see Who we share data with).
• How long: until you turn notifications off on that device or remove it from “Your devices”, sign out on it, the notification service tells us that address no longer exists (for example, if you uninstall the app or withdraw the permission) or your user is erased. Your preferences for an account are deleted if you lose access to it. The technical record of each delivery does not keep your device’s address and is deleted after 90 days.
• It is stored in our database in the European Union (Supabase).

Why we use it and on which legal basis#

Where we are the controller:

Where we are a processor (data about your team, properties, reservations, cleanings, team payments, Airbnb income, incidents, guests and the content of Google Calendar events), you as controller determine the purposes and the legal basis; we only process it to provide the service, on your instructions. Those instructions are documented in the Instructions history (Settings → Legal), which you can view and download. See your responsibilities.

We do not send advertising or marketing newsletters. If we ever wanted to, we would ask for your consent first.

Data we receive from Google#

Connecting Google Calendar is optional and you start it from casflows. We only request these scopes:

• https://www.googleapis.com/auth/calendar.app.created: create one secondary calendar owned by casflows and manage the booking, cleaning and Airbnb block events inside it. We never invite anyone to those events.

With that scope (https://www.googleapis.com/auth/calendar.app.created), casflows cannot read or modify any other calendar or event in your Google account: it only accesses the calendar it creates itself and the events it creates in it. We do not request any Google sign-in permission (such as identifying your account or reading your email).

Legal basis. The authorisation you give in Google (OAuth) is not the legal basis: it is the technical way of letting casflows write in that calendar. If you are the host and connect your own calendar, keeping that connection is part of the service you sign up for (Art. 6(1)(b)). If you are a member of a host’s team and connect yours, you give your consent to that connection, which you can withdraw whenever you want; but the events we copy into it (cleanings, check-ins and, if the host authorises you, the guest’s name) are processed on the host’s instructions and on the host’s legal basis, never the consent of whoever connects their calendar.

This is all the Google data we store:

• The ID of the secondary calendar casflows creates.
• The IDs of the events casflows creates in that calendar.
• The OAuth refresh token, encrypted with AES-256-GCM, which lets us keep the calendar up to date without you having to reconnect.
• The email address of the Google account connected, which casflows learns as the creator of the calendar and events it created itself. We use it only to show you which account is connected (if a person in your team connects it, we show it to you).
• The permissions (scopes) you granted when connecting, to check that the connection has the permission it needs.

What we do with Google data:

• We use it only to provide the feature you see in casflows: keeping your cleanings in that calendar.
• We do not use it for advertising, advertising profiles or retargeting.
• We do not sell it or share it with third parties, except with the providers needed to run the service (see recipients), when required by law, or in a corporate transaction (merger, acquisition) with the same safeguards.
• We do not use it to train artificial intelligence or machine learning models, whether general or our own.
• No human reads it, except in these closed cases: you give us explicit consent for a specific case (for example, support), it is necessary for security purposes (investigating abuse or an incident) or to comply with the law. Only casflows’ authorised technical staff have access to the systems where it is stored, under a duty of confidentiality, and the token is encrypted. For internal operations we only use aggregated and anonymised data.

You can disconnect Google at any time from casflows or from your Google Account permissions. When you disconnect from casflows, we delete from your Google account the “casflows · …” calendar we created, with all its events (past ones included), and we revoke the token with Google and delete it. We try for a few seconds: if Google does not respond, the token is still deleted from casflows and the calendar may remain in your Google account, which belongs to you, and you can delete it from Google Calendar; in that case we keep the calendar ID, its event IDs and the account email so that, if you reconnect Google, casflows keeps using that calendar instead of creating another one (they are deleted when your casflows account is closed). If the calendar is deleted, we also delete its ID and its event IDs from casflows. When your casflows account is erased, we also try to delete that calendar before revoking the token. If you revoke access from Google, we delete the token as soon as we detect it; from then on casflows can no longer delete the calendar, which stays in your Google account.

Members of a host’s team. If the host or management company you work with sends you a casflows link, you can connect your own Google Calendar without creating a casflows account. We ask for the same single permission (https://www.googleapis.com/auth/calendar.app.created) and store the same data for that connection: the ID of the “casflows · …” calendar we create in your account, its event IDs, the encrypted refresh token, the permissions granted and your Google account email address. We use them only to keep the events assigned to you in that calendar, without invitations. The link expires after 7 days, works only once and we only store its hash. You can remove the access at any time from your Google Account permissions and the host can also disconnect you: in that case we try to delete from your Google account the “casflows · …” calendar we created, with all its events (past ones included), and revoke the token in Google; if any of that fails, it does not block the disconnection and the token in casflows is always deleted anyway (if the calendar could not be deleted, we try to cancel your upcoming events in it and it stays in your Google account, which belongs to you). If the host deactivates you instead of disconnecting you, you stop having any properties assigned and on the next cycle we likewise cancel your upcoming events in that calendar, but your connection and the token stay stored until the host disconnects you outright or closes their casflows account, at which point the rest of that data is deleted. Until then, the calendar stays in your Google account, which belongs to you.

If you use "Sign in with Google", Google only gives us your name, email and identifier to authenticate you; that sign-in does not grant access to your calendar.

Who we share data with#

We do not sell personal data. We only disclose it to these providers, and only as needed to provide the service. Where they process data on our behalf (or, as sub-processors, on the host’s behalf), they do so under a data processing agreement, except where stated. The list of those that process data on the host’s behalf, with the data each one accesses, is also at casflows.com/subencargados:

If you create the “Block on Airbnb” link for a property, we publish at that secret address only the dates of its manual bookings (no names, guest counts or notes) so that your own Airbnb can read them and block those days. We do not send it to anyone: whoever has the link can read it, you are the one who pastes it into Airbnb, and you can invalidate it at any time by creating a new one.

If you turn on push notifications, the alert is delivered by the notification service of your browser’s or phone’s maker (Apple, Google, Mozilla or Microsoft, depending on the device). It is not a provider we choose, but the one your browser uses for all its notifications, under its own terms and servers (which may be outside the EU). That is why the content travels end-to-end encrypted and carries only what is essential: that service cannot read it and only sees your device’s delivery address and technical data about the delivery (see Push notifications).

Data may also be disclosed to authorities and courts where the law requires it. We will announce any change to this list by updating this policy (and, for customers, as set out in the data processing agreement).

International transfers#

Some data may be processed outside the European Union. These are the transfers and the safeguard that applies to each:

• Supabase (Singapore), Vercel, Cloudflare and Resend (US): we store the data or send it from the EU where the provider allows it; any access from outside the EU is covered by the European Commission's Standard Contractual Clauses included in their data processing agreement. Vercel, Cloudflare and Resend also participate in the EU-US Data Privacy Framework, which the European Commission recognises as an adequate safeguard.
• Google (Calendar and our email mailbox): Google LLC participates in the EU-US Data Privacy Framework.
• Mistral AI (France, EU): voice notes are transcribed with Mistral’s European API, with data hosted by default in the EU; this is not an international transfer. If any of its sub-processors processes data outside the EU, Mistral states that it is covered by Art. 46 GDPR safeguards.
• Telegram: the messages a person chooses to receive or send through Telegram pass through its infrastructure, outside the EU, without standard contractual clauses or any other Article 46 GDPR safeguard, because Telegram does not offer them. That is why we only send through Telegram what each notice needs and linking the bot is optional.

You can ask us for a copy of the safeguards at privacidad@casflows.com.

How long we keep data#

Your rights#

You can exercise at any time, free of charge, your rights of:

• Access: find out what data about you we process and get a copy.
• Rectification: correct inaccurate or incomplete data (you can change most of it yourself in the app).
• Erasure: ask us to delete your data when it is no longer needed, among other cases.
• Restriction: ask us to pause processing in certain cases.
• Portability: receive your data in a structured, commonly used format (for example JSON or CSV).
• Objection: object to processing based on legitimate interest.
• Withdraw consent or the authorisation you gave (for example, the connection of your Google Calendar as a member of a host’s team), without affecting prior processing.

Data we are the controller of (your account, information requests and technical logs): write to privacidad@casflows.com stating which right you want to exercise, from your account email if you have one. We decide and reply within one month, extendable by two further months for complex cases (we will let you know). If we cannot verify your identity we will ask for the minimum information needed.

Data we process on behalf of a host (if you are a guest or part of their team): the host is the controller and decides on your request; contact them. If you write to us, we will pass your request on to them without delay and help them answer it, as the data processing agreement provides, but we do not decide it ourselves.

If you believe we have not handled your data properly, you can lodge a complaint with the data protection authority of your country. As the controller is established in Spain, the lead supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD, www.aepd.es).

How we protect data#

• Encryption in transit (TLS/HTTPS) for all communications.
• Encryption at rest of the database and, on top of that, application-level encryption (AES-256-GCM) of secrets: the iCal URL, the Google token and the “Block on Airbnb” secret link.
• Isolation between customers with row-level security (RLS) in the database: each account only sees its own data.
• Least privilege: explicit per-table and per-column permissions, and internal processes only access what they need.
• Passwords stored only as hashes; single-use, expiring Telegram links; secrets never go to logs.
• The “Block on Airbnb” secret link can only be created or changed by an account owner, only publishes occupancy dates for that property (which, together with the property name known to whoever has it, reveal when it is occupied) and is invalidated by creating a new one.
• Confidentiality: only authorised staff who need it access the data, under a duty of confidentiality (Article 5 LOPDGDD).
• Data hosted in the European Union and an incident management procedure, notifying the authority and affected people where the law requires it.

No system is infallible. Please use a strong, unique password and tell us immediately if you suspect unauthorised access.

Automated decisions#

casflows automates tasks (creating a cleaning, showing whether another guest checks in that same day or sending a reminder), but it does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, and it does not profile you.

Cookies and local storage#

We only use strictly necessary technical cookies for the service to work, which are exempt from consent (Art. 22.2 of the Spanish LSSI). We do not use analytics, advertising or third-party tracking cookies. These are all of them:

If we ever add non-essential cookies, we will ask for your consent first with a specific notice.

Minors#

casflows is a professional service and is not directed at minors (under 18): they cannot have an account or be part of a team. If we detect an account belonging to a minor, we will delete it; if you know of such a case, write to privacidad@casflows.com.

A property’s guests may include minors: about them casflows only processes, if the host turns on forwarding or enters them in a booking, the number of children and infants in the party (only the number, never their name). As a host, please do not write unnecessary data about minors in notes or in a booking’s guest details; if we see that it has been entered, we will ask you to delete it.

Changes to this policy#

We may update this policy when the service or the law changes. The last-updated date is shown above. If the change is material, we will notify you by email or in the app at least 30 days in advance and, where the law requires it, ask for your acceptance or consent again.

Contact#

For any privacy matter: privacidad@casflows.com. By post: ENBA HOMES, S.L., Camino del Prado 1, Bloque 4, Bajo A, 29630 Benalmádena, Málaga, España.