Data Protection & Security Information · Last updated: June 2026
FoundKeeper is a professional app for the digital management of lost & found items in hotels. Staff can record, manage and process guest requests for lost items. Additionally, a web form (foundkeeper.app) allows reception staff to record guest requests.
All data is stored with Supabase – a professional, GDPR-compliant database service.
| Feature | Details |
|---|---|
| Server Location | EU – Ireland (eu-west-1) |
| Provider | Supabase Inc. (EU server location) |
| Encryption | SSL/TLS – all connections encrypted |
| GDPR Compliance | Yes – DPA (Data Processing Agreement) available |
| Certification | SOC 2 Type II certified |
| Data Isolation | Each hotel sees only its own data |
| Category | Fields | Purpose | Retention |
|---|---|---|---|
| Lost Items (App) | Description, room number, date, photo, storage location, status, staff name | Lost & found management | Until manually deleted |
| Staff Accounts (App) | First name, last name, email, role (Admin/HSK/Checker) | Access control | Until account is deleted |
| Guest Requests (Web Form) | Name, room number, checkout date, description, phone, email | Processing requests | Max. 90 days after completion |
| Technical Data | Login timestamps, IP address | Security & logging | Max. 30 days |
✓ Row Level Security (RLS) – Each hotel sees exclusively its own data
✓ SSL/TLS Encryption – all data transfers are encrypted
✓ Role-based Access – Admin, HSK, Checker have different permissions
✓ Passwords stored encrypted – no plain text passwords
✓ Automatic backups by Supabase
✓ No sharing of guest data with third parties
✓ Access only for authorized hotel staff
Supabase provides a Data Processing Agreement (DPA) that governs GDPR-compliant processing of personal data. A DPA between the hotel and FoundKeeper can be provided upon request.
✓ Right of access – Information about stored data upon request
✓ Right to deletion – Data deleted after max. 90 days or immediately upon request
✓ Right to rectification – incorrect data can be corrected
✓ Data portability – Data export as CSV available
✓ Right to object – processing can be objected to