Petty Cash Book for apaleo

Privacy policy

The German version is binding. As of October 2026.

1. Who we are

AGI Research GmbH
Saarstr. 26
55424 Münster-Sarmsheim
Germany

E-mail: team@agi-research.de, phone: 06721-9498954

2. This website

Without your consent this website sets no cookies and uses no tracking. Only if you choose "Accept" in the banner do we use PostHog (servers in the EU) to see which pages and features are used and where errors occur, including session recordings in which amounts, texts and inputs always stay hidden (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The data goes through our own server to PostHog. The browser keeps a random ID and your choice for up to 1 year, recordings are deleted after 30 days at the latest, events after 12 months. Consent is voluntary, the website and the app work fully without it. You can withdraw at any time with effect for the future, here, under "Cookie settings" in the footer or in the app under Settings → Data.

Our host Cloudflare processes technical data such as IP address, time, page and browser to deliver the site and protect it against attacks (Art. 6(1)(f) GDPR).

3. The app

For the cash book data the hotel is the controller. We process it on the hotel's behalf as a processor (Art. 28 GDPR). A data processing agreement is available on request.

Data: apaleo account and property IDs; staff of the account (apaleo user ID, name, e-mail; names are stored with each booking, e-mails are only shown, not stored); bookings with date, type, amount, booking text and receipt number; for imports from apaleo also folio and payment ID and, for refunds, the reason entered in apaleo; an audit trail of who booked what and when; the rights set by admins; apaleo access tokens, stored encrypted.

Guest names, addresses and contact details are not imported from apaleo, only technical payment IDs. Description and receipt are free text: whatever staff type there is stored. Please do not enter guest data there; the hotel is responsible for that content. All details are in the detailed privacy policy of the app (German, binding).

Cookies: technically necessary cookies for the login (session up to 30 days, login protection 10 minutes). No consent is needed for these (Section 25(2) TDDDG). Analytics cookies from PostHog only with your consent, as described in section 2.

Usage statistics: on the server we count which features an apaleo account uses (for example booking recorded, export created) and log server errors, with account and property ID only, without persons, amounts or texts (Art. 6(1)(f) GDPR).

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (secure operation).

4. Service providers

  • Cloudflare, Inc., USA: hosting of app and website. Transfer based on the EU-US Data Privacy Framework and standard contractual clauses.
  • Supabase, Inc., USA: database, run in an AWS data centre in London (eu-west-2). The United Kingdom has an EU adequacy decision.
  • apaleo GmbH, Munich: the hotel's PMS, source of the cash payments and users.
  • PostHog, Inc., USA: usage analytics, error tracking and error logs, data stored in the EU (Frankfurt). Transfer based on the EU-US Data Privacy Framework and standard contractual clauses.

5. Storage period

Data is kept as long as the cash book exists. Admins can delete bookings or the whole cash book, account admins all data of the account. Deleted data stays in the database backups for up to 30 days. Keeping records for tax purposes (for example 10 years under Section 147 AO) is the hotel's duty, please use the Excel or PDF export for this.

6. Security

All connections use HTTPS. Tokens are encrypted, every hotel only sees its own data.

7. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR) and may withdraw a consent at any time with effect for the future (Art. 7(3) GDPR), for analytics under "Cookie settings" in the footer or in the app under Settings → Data. Please write to team@agi-research.de. You may complain to a supervisory authority, for us the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.