Last updated: 22 October 2026
This policy explains what personal data we process when you use the Entavo app, the website and the admin panel, why we do it and what rights you have.
Who we are
The controller of your personal data is "Fondle" Ltd., company ID 206174020, registered at 4 Prof. Petar Shapkarev str., Sofia, Bulgaria. For anything about your personal data, write to us at support@entavo.app.
What data we process
Account. Name, email, language, profile photo (if you upload one) and password, if you sign in with email. We keep the password only as an irreversible hash.
Sign in with Google or Apple. If you sign in this way, Google or Apple give us your name, email and the ID of your account with them, and we keep which sign-in you linked to your account. We never receive your password with them. If you choose to hide your email with Apple, we receive an address that Apple forwards to you. For Apple we also keep an encrypted token, with which we end Entavo’s link at Apple when you delete your account.
Phone. The mobile number you confirm with an SMS code before you book or publish a place. Only Entavo administrators see it, not the owners.
Devices and sign-in. For each device you sign in from: an installation identifier, model, platform, app version, IP address, time of last use and a token for notifications. We keep only hashes of the sign-in tokens, not the tokens themselves.
Bookings and payments. Place, date and time, price, fee, payment status and when the door was unlocked. You enter your card directly with Stripe. We keep only its brand, last 4 digits and expiry, never the full number or the CVC.
Messages. The messages you exchange with the place’s owner about a booking.
Reviews. The stars and text you give a place after a booking, and the owner’s answer. Every user of the app sees them, with your first name and profile photo.
Reports and blocking. If you report a review or a conversation: the reason, your text, what was reported (with the review’s text as it was then), who wrote it and when. Only Entavo administrators see it; the one you report does not learn it was you. If you block someone after a report, we keep whom and the name you saw, until you unblock them.
Favourites. The places you mark with a heart, and when. Only you see them.
Location. If you allow access to your location, the app uses it to show the map around you and the places nearest to you. For the nearest places, and when you unlock a door (so we can check you are at the place), the app sends your location to the server. We do not store it or link it to your history.
Entering places. When and by whom a door was unlocked, and when the door sensor reports it opening and closing.
Owners. The places’ details (name, description, address, location, time zone, prices, opening hours, photos). Before we save the photos, we remove their metadata, including GPS coordinates. You enter your identity and bank account details for payouts with Stripe. We do not receive them; we only know whether payouts are enabled. We also keep when you accepted which version of the owner terms.
Applications from the website. Name, email, phone, city, kind and number of places, and a message, if you apply as an owner.
Messages to places. When we offer Entavo to businesses and to owners of rooms, we use the contact details they have published themselves (on their website, on Google Maps, on social networks or in a listing): email, phone or profile, the name of the place and the name to address, if given. We keep no record of whom we wrote to.
Usage statistics. Only if you allow it in the app (asked once; Profile → Usage statistics): which screens you open and actions such as booking, paying, unlocking or a review, with the phone’s model and system, the app’s version, an approximate country and city and a random ID of the installation. Without your name, email, phone, the places or the amounts, and never for ads.
Technical records. Records of errors and of how the system works, which may contain an IP address and a user identifier.
Why we process it and on what basis
- To perform our contract with you (Art. 6(1)(b) of Regulation (EU) 2016/679): account, bookings, payments, unlocking the door, notifications, messages, payouts to owners, answering applications.
- To comply with the law (Art. 6(1)(c)): accounting and tax obligations for payments.
- In our legitimate interest (Art. 6(1)(f)): security of accounts and places, preventing fraud and abuse, fixing errors. For example, we check whether a new password has leaked publicly by sending only the first 5 characters of its hash, never the password itself.
- In our legitimate interest to tell you about Entavo (Art. 6(1)(f)): push notifications on the “News and offers” channel, about new places and offers in the app. We send them only to the app, never by email or SMS. You can turn them off at any time in Profile → Notifications or in your phone’s settings.
- In our legitimate interest to present Entavo (Art. 6(1)(f)) to businesses it may be useful to: the messages to places. We write to business contact details, a few at a time and personally, and every email has an unsubscribe link.
- With your consent: when you send an application from the website, and the usage statistics in the app. You can withdraw your consent at any time; for the statistics, in Profile → Usage statistics, which also deletes what has not been sent yet.
We do not show ads, we do not use your data for ads by others, we do not sell it and we do not profile you in ways that have legal effects on you.
Who else receives data
- The owner of the place you booked sees your name, the time of the booking, when the door was unlocked and your messages. They do not see your phone or email.
- Stripe (payments and payouts): card and payment details, your name and email, and for owners the payout details.
- Google and Apple (sign-in), if you sign in with them: they know you signed in to Entavo.
- Google Firebase and Apple (notifications): the device token and the notification text.
- Google Firebase Crashlytics (app crash reports): the phone’s model and system, the app’s version and what went wrong, with a random ID of the installation.
- Google Analytics for Firebase (usage statistics), only if you allow them: the data under “Usage statistics”. It is not linked to Google’s advertising.
- Sentry (error reports from our servers): what went wrong and the request it happened in, without your name, email or IP address.
- Twilio (SMS codes): your phone number.
- Google (the map in the app): the data Google Maps processes on your phone, including your IP address.
- Google Maps Platform (the places’ addresses): the text an owner types as a place’s address, and the point on the map, to suggest addresses and find the place’s time zone. We send them from our server, with no data about you.
- Meta (Instagram, Facebook) and Viber, when we write to a place there: the message.
- SuperHosting.BG (email) and Contabo (servers in the EU), which process data only on our instructions.
- Public authorities, when the law requires it.
Some of these providers process data outside the European Economic Area (for example in the USA). This is based on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.
How long we keep data
- We keep your account and the data linked to it (bookings, messages, places, photos) until you delete the account.
- When you delete the account, this data is deleted, and if you signed in with Apple, we also end Entavo’s link at Apple. Bookings and payments stay without your name, email and phone (as “Deleted user”), because they are accounting records and may be needed if a payment is disputed. For the same reason, and because they are also part of the other side’s conversation, the messages you exchanged about a booking stay too, also as “Deleted user” (legitimate interest, Art. 6(1)(f)). Stripe keeps payment records according to its own obligations. We keep the documents the law requires for as long as it requires.
- Google keeps the usage statistics for 14 months.
- We keep technical records for 14 days and records from the door controllers for 30 days.
- Confirmation codes expire within minutes and are deleted every night. Expired sessions are also deleted every night.
- We keep applications from the website until they are reviewed and decided, and after that only as long as needed.
- We keep nothing of the messages to places. If you unsubscribe or tell us you do not want us to write to you, we keep only your email on a “do not contact” list, so that we do not write to you again.
Your rights
You have the right:
- to ask for access to your data and a copy of it. You can download it yourself from the settings in the app (“Download my data”);
- to correct inaccurate data. You can change most of it yourself in the app;
- to ask for erasure. You can delete your Entavo account yourself: in the app, open Profile, tap “Delete account” and confirm with your password (or by signing in again with Google or Apple). Or write to us at support@entavo.app from the account’s email. What is deleted and what stays is under “How long we keep data”;
- to restrict processing, or to object to processing based on legitimate interest;
- to object to messages to places at any time: with the Unsubscribe link in the email, by answering “no”, or by writing to us. We stop at once;
- to receive your data in a machine-readable format (portability);
- to withdraw consent where processing is based on consent.
To exercise your rights, write to us at support@entavo.app. We answer within one month.
You also have the right to complain to the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or to the data protection authority of the country where you live.
Cookies
The website does not use cookies, has no visitor analytics and loads nothing from other sites. The admin panel uses a session cookie when signing in and a cookie for the chosen theme. The app stores your sign-in data securely on your phone, and the usage statistics’ ID only if you allow them.
Security
Connections to us are encrypted. We keep passwords and codes only as hashes. Access to data is limited to the people who need it for their work.
Children
Entavo is not meant for people under 18, and we do not knowingly collect data about them.
Changes
If we change this policy, we will publish the new version here with the new date. For significant changes we will notify you in the app or by email.