Privacy Policy

LobbyHost is check-in software used by businesses at their physical locations. That means we handle two kinds of information: details about the account holders who run the service, and details about the visitors, drivers and employees who check in at a customer's site. This page explains both, in plain English.

Who holds what

LobbyHost is a platform. You are the operator. You decide what your kiosk asks for, who at your business can see it, how long you keep it, and what you do with it. Depending on how you configure your kiosk, a check-in record can include a person's name, company, phone number, a photo taken at the kiosk, their signature on documents you ask them to sign, and — for delivery and pickup drivers — carrier, truck, trailer, load, container and seal details.

Those records are yours. We store and process them so the service works for you, and we take no part in the relationship between you and the people who check in at your sites: we do not contact them, we do not answer them, and we do not act on their behalf. Anything they ask about their information is between them and you.

What we collect from account holders

Your name, email address, and a password (stored only as a one-way hash — we cannot read it). Billing runs through Stripe: your card details go directly to Stripe and never touch our servers; we keep only the subscription status and a Stripe reference. We also keep normal operational logs, including an audit trail of significant actions in your account.

How information is used

To run the service: showing your team who is on site, sending arrival notifications, producing the evacuation roll call, keeping the visit and time-clock history you see in your dashboard, and billing. We do not sell personal information, we do not use visitor data for advertising, and we do not train AI models on your data.

Who it is shared with

Service providers that host and run the product: our database and file storage (Supabase) and web hosting (Vercel), email delivery (Resend) for notifications, and Stripe for payments. Beyond that, information goes only where the account holder points it: arrival notifications to the addresses and Slack/Microsoft Teams channels they configure, and — if they connect one — driver check-in details (including the signature) to their own warehouse system. We disclose information if the law requires it.

Information you send to a system of your own leaves our control when it arrives there. We cannot read it, change it or remove it, and deleting your LobbyHost account does not reach it — see Systems you connect in the Terms.

How it is protected

Connections are encrypted in transit (HTTPS) and data is encrypted at rest by our hosting providers. Passwords are hashed with bcrypt. Each customer's data is separated by row-level security in the database, and kiosk devices use scoped credentials that cannot read other sites' data. No system is perfectly secure, but isolation between customers is covered by a dedicated test suite that is run before releases.

How long it is kept

You decide. Your records are kept for as long as your account is active — many businesses need that history for compliance. We do not delete your records on anyone else's behalf, and we do not remove them on our own initiative while your account is open. An account holder can export everything, or delete the whole account, from Settings → Your data.

There is exactly one deletion we perform ourselves, and it is automatic. When an account closes, its data is kept for 30 days so the account can be reactivated. On the 31st day the account and everything in it are deleted — visits, signatures, employee records, and the photos and signed documents held in file storage. It happens on a clock rather than by anyone's judgement, it applies to every closed account without exception, and it cannot be undone afterwards.

Cookies

The dashboard uses one session cookie to keep account holders signed in. Kiosk devices store their site credential in the browser. There are no advertising or tracking cookies.

Children

The service is for businesses and is not directed at children; account holders must be adults.

Changes and contact

If this policy changes in a way that matters, we will post the new version here and update the date above. Questions, or a request about your information: support@lobbyhost.com.