Privacy & Data Protection Policy

Last updated: 14 July 2026

Two different roles: controller and processor

lockapi plays two different roles under GDPR, depending on whose data is involved:

• Data controller — for Tenant account data: the email, password hash, and billing email of people who sign up for and administer a lockapi account, plus their login and API activity. We decide why and how this data is processed.
• Data processor— for Guest data submitted by a Tenant: a guest's name, access code/PIN, and unlock timestamps. Tenants are themselves the controller for their own guests (e.g. a vacation-rental host processing a booking guest's details) and instruct us to process that data strictly to operate the access-code/unlock feature on their behalf. If you are a Guest and have a question about your data, contact the Tenant (property/service) that issued your access code, not us directly — we act on their instructions.

What we collect

Tenant account data(we are the controller): name, email, hashed password (bcrypt — the plaintext password is never stored), billing email, role, login timestamps, IP address and user agent recorded against security-relevant actions (see "Audit logging" below).

Guest data(Tenant is the controller, we are the processor): guest name, the access code/PIN issued to them, the validity window, and unlock event timestamps. We do not require or request a guest's email, phone number, or payment details — if a Tenant includes such data in the free-form metadatafield of an access code, that is the Tenant's choice and responsibility, not something lockapi asks for.

Usage/API data: API requests, device metadata synced from connected vendor accounts (device name, battery level, capabilities), and webhook delivery logs.

Legal basis

Tenant account data is processed under contractual necessity (providing the service you signed up for) and our legitimate interest in operating and securing the platform. Guest data is processed strictly on the Tenant's instructions and documented purpose (issuing and managing access codes) — the Tenant is responsible for establishing their own lawful basis with their guests.

Retention

• Guest access-code data— automatically scrubbed (name, code, and any metadata cleared; the record itself is kept in an anonymized, soft-deleted state for billing/audit integrity) 90 days after the code's validity window ends. A Tenant can request immediate erasure earlier via the API (POST /v1/access_codes/:id/erase_guest_data) or their dashboard.
• Audit logs (security-relevant actions — logins, API key issuance/revocation, access-code creation/revocation, webhook endpoint changes) — retained for 1 year for security and compliance investigation purposes.
• Tenant account data — retained for as long as the account is active, and deleted or anonymized within a reasonable period after account closure, except where we must retain billing records to meet legal/tax obligations.
• Idempotency cache (used to safely retry API requests) — purged within 24 hours of the original request.

Subprocessors

We use the following categories of subprocessor. A Tenant may request the current specific vendor list.

• Cloud hosting and database infrastructure (stores all Tenant and Guest data).
• Stripe — payment processing and usage-based billing.
• Resend — transactional email (password-reset links only; no marketing email).
• The connected lock vendors themselves (TTLock, Nuki, Akiles, Tedee, and others as a Tenant links them) — acting on the Tenant's instruction to actually operate the physical lock hardware the Tenant connected.

International transfers

Some subprocessors (e.g. Stripe, Resend) are based in or transfer data to the United States. Where this occurs, we rely on Standard Contractual Clauses or an equivalent approved transfer mechanism.

Security measures

Vendor account credentials, webhook signing secrets, and guest access codes are encrypted at rest with AES-256-GCM. Passwords are hashed with bcrypt and never stored in plaintext. All traffic to the API and dashboard is encrypted in transit (TLS). Access to Tenant-scoped data is enforced per-request via API-key or session authentication, and security-relevant actions are recorded in an audit log (see below).

Audit logging

We record an audit trail of security-relevant actions — login attempts, API key issuance/revocation, access-code creation/revocation/erasure, connected-account disconnection, and webhook endpoint changes — including the acting user or API key, IP address, user agent, and timestamp. This exists for security investigation and compliance purposes and is retained per the schedule above.

Cookies

The dashboard sets a single essential session cookie (via NextAuth) to keep you signed in. We do not currently use analytics, advertising, or other non-essential tracking cookies.

Your rights

If we are the controller of your data (you are a Tenant user), you can request access, correction, deletion, or portability of your account data, or object to processing, by contacting us at the address below. If you are a Guest, direct your request to the Tenant that issued your access code — as the controller for your data, they are responsible for fulfilling it, and can ask us to action an erasure request on their behalf via the erasure endpoint described above. EU/EEA data subjects also have the right to lodge a complaint with their local supervisory authority — in Spain, the Agencia Española de Protección de Datos (AEPD).

Data breach notification

In the event of a personal data breach, we will notify affected Tenants without undue delay and, where required by law, within 72 hours of becoming aware of it.

Contact

For any privacy question or data-subject request, contact the address listed in your dashboard. See also our Terms of Service.