PRIVACY POLICY - VEZPA APP
Vezpa di Paolo Vezzola
Last updated: November 5, 2026
1. Data Controller / Organization
Vezpa di Paolo Vezzola
Registered office: Via San Zeno 67, 25015 Desenzano del Garda (BS), Italy
VAT: 04449070988 · Tax code: VZZPLA84C10D284C
Email: info@vezpa.it · PEC: lavezpa@pec.it
2. Scope of Application
This notice applies to the Vezpa App distributed through:
- Apple App Store (iOS, macOS) - Bundle ID:
it.vezpa.pms - Google Play Store (Android) - googleplay flavour
- Microsoft Store (Windows) - MSIX
- Direct sideload (Android APK, signed Windows installer) for use distributed directly by the Data Controller
Use of the app requires creating an account dedicated to the accommodation property. The app is intended for professional users over 18 years of age (property managers and their authorized personnel).
3. Data Collected by the App
3.1 User Data (Managers and Staff)
- Identity data: first name, last name, email, phone number
- Accommodation property data
- Credentials (password hashed on the backend, never transmitted in clear text)
- Account identifiers (User ID)
- Assigned role (manager, assistant, housekeeper, observer)
3.2 Guest Data (Vezpa acts as Data Processor)
Important: The property is the Data Controller of guest data. Vezpa acts as Data Processor under GDPR art. 28 (where applicable) and as service provider / third party under PIPEDA, governed by the DPA.
- Identity and contact data
- Identity documents scanned or photographed with the device camera, with OCR extraction of textual data to facilitate registration
- Stay and reservation data
3.3 Technical and Usage Data
- Device identifiers: model, operating system, app version
- Push notification tokens (FCM): unique identifier managed by Google Firebase for sending notifications
- SHA-256 hash of trusted device: generated locally to allow subsequent biometric login, 90-day expiry from last use
- Application and diagnostic logs: transmitted in batches to the backend via RemoteLogger for stability and security purposes; do not contain sensitive personal content
- IP address: collected by the backend for security purposes
4. Permissions Requested by the App
| Permission | Purpose | Required |
|---|---|---|
| Camera | Capturing images of guest identity documents for OCR and transmission to authorities | Optional (alternative: manual entry) |
| Push notifications | Receiving notifications on new bookings, check-ins, guest requests | Optional (the app works without them) |
| Biometric authentication (Face ID / Touch ID / fingerprint / Windows Hello) | Fast login after the first password authentication. Biometric data never leaves the user's device: it is managed exclusively by the operating system through native APIs (Keychain iOS/macOS, BiometricPrompt Android, Windows Hello) and is not accessible to Vezpa in any form, not even as hashes or derivatives. Vezpa receives only a boolean result (success/failure) and a trusted device identifier. | Optional |
| Storage / Files | Local saving of PDF reports, invoices, guest reports generated by the app | Optional |
| Internet | Communication with Vezpa servers | Required |
| REQUEST_INSTALL_PACKAGES (Android sideload only) | Automatic installation of updates via APK downloaded from Vezpa servers. Not present in the Google Play version. | Required only for the sideload flavour |
5. SDKs and Services Integrated in the App
| SDK / Service | Provider | Purpose | Data processed |
|---|---|---|---|
| Firebase Cloud Messaging (FCM) | Google LLC / Google Ireland Ltd | Sending push notifications | Device token, technical identifiers |
| StoreKit / Google Play Billing / Microsoft Store | Apple Inc. / Google LLC / Microsoft Corp. | In-app purchase and subscription management | Purchase token, subscription status, store account ID |
| Stripe SDK (guest payment page only) | Stripe Payments Europe Ltd | Card payment processing | Card data handled by Stripe, not transmitted to Vezpa |
| local_auth (biometrics) | Operating system (Apple / Google / Microsoft) | Local biometric unlock | No biometric data transmitted to Vezpa |
| Flutter Secure Storage | Platform (Keychain iOS/macOS, EncryptedSharedPreferences Android, DPAPI Windows) | Local storage of JWT tokens and credentials | Refresh tokens, encrypted by the operating system |
| share_plus | Open Source | Sharing files (PDF, reports) with system apps | Files chosen by the user |
Vezpa does not integrate behavioural analytics SDKs (e.g. AppsFlyer, Mixpanel, Facebook SDK), advertising SDKs or profiling SDKs. No cross-app tracking under Apple App Tracking Transparency (ATT).
6. Purposes of Processing
- Provision of the Vezpa App's features (GDPR art. 6.1.b / PIPEDA consent implied by service request)
- Legal compliance relating to guest registration, delegated by the property (art. 6.1.c)
- Security, fraud prevention, service stability (art. 6.1.f, legitimate interest)
- Subscription and payment management (art. 6.1.b and 6.1.c)
Data is not used for advertising, profiling or tracking purposes. We do not sell your personal information.
7. Processing Methods and Security
- Transmission via HTTPS/TLS 1.2+
- Rotating JWT authentication (15-min access, 60-day refresh with blacklist)
- System Secure Storage (Keychain / EncryptedSharedPreferences / DPAPI)
- Optional TOTP 2FA
- Backend servers located in the EU (Frankfurt) on DigitalOcean
- Application logs monitored to detect anomalous access
8. Retention and Deletion
User data is kept for the duration of the contract + tax obligations (10 years for invoicing; minimum 6 years for Canadian customers under CRA requirements).
The user may request account deletion through the dedicated feature in the app or by writing to the Data Controller. Some data may be retained for legal obligations (invoicing, security logs).
Guest data (for which Vezpa is Data Processor) follows the Data Controller's instructions as regulated in the DPA.
9. Disclosure of Data
Data is not sold or disseminated. It may be disclosed to the sub-processors listed at vezpa.it/subprocessors and, limited to reservation data, to the OTA channels activated by the property.
For data transmitted to public authorities (Police, ISTAT, Feratel, SES, NTAK, eVisitor, SEF, UbyPort, eTurizem, and where applicable CRA and provincial authorities), please refer to the general Privacy Policy.
10. Cross-border Data Transfers
Communications with US providers with active DPF certification (Google/Firebase, Google Cloud Translation, Stripe, Microsoft, DigitalOcean) take place under the EU-U.S. Data Privacy Framework (Commission Decision (EU) 2023/1795). Apple does not participate in the DPF: the contractual relationship for EU users is with Apple Distribution International Ltd (Ireland), and any transfers to Apple Inc. (USA) are governed by Standard Contractual Clauses 2021/914. Communications with STAAH (channel manager) take place under the EU Adequacy Decision for New Zealand (Commission Decision (EU) 2013/65). Tuya (China, optional) is governed by SCC 2021/914. Canadian users are informed that their personal information may be transferred to, stored in, and processed in the EU, USA, New Zealand or other jurisdictions, and may be subject to lawful access by foreign authorities.
11. Rights of the Individual
Under GDPR arts. 15-22 (where applicable) and under PIPEDA / Quebec Law 25, the user may exercise rights of access, rectification, erasure, restriction, portability and objection. Requests may be submitted through the app or to info@vezpa.it.
Complaints to the supervisory authority: Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (opens in a new tab). Canadian users may also file a complaint with the Office of the Privacy Commissioner of Canada - OPC (www.priv.gc.ca (opens in a new tab)). Quebec residents may contact the Commission d'accès à l'information (CAI, www.cai.gouv.qc.ca (opens in a new tab)).
12. Minors
The App is intended exclusively for adult users (professional managers). It does not knowingly collect data from minors.
13. Changes to the Privacy Policy
This notice may be updated. Changes will be published on this page and, if material, communicated by email and dashboard with at least 15 days' notice.