Privacy Policy

1. Who we are

[legal entity], [tax number], [address] ("Bugpi", "we") provides booking, reception, voucher and invoicing software to venues that sell timed entries, sessions and seats. Questions about this policy: [email protected].

2. Two different roles

For this website and for the people who represent a business that uses it (owners, managers, desk staff with an account), Bugpi is the controller: we decide what is collected and why. That is what most of this policy is about.

For the guests of a business (customers, families, schools, groups) whose data is recorded in the Service when they book or visit, that business is the controller and Bugpi is the processor. We act only on the business's instructions, under the data processing terms in our Terms of Service. If you are a customer with a question about a booking, contact the business; section 9 explains more.

3. Data we collect on this website

Contact and demo requests: name, email, business name, size and message, so we can reply. Nothing is collected unless you send a form.

Analytics: Cloudflare Web Analytics, which counts page views without cookies, without fingerprinting and without identifying you; we see aggregate numbers only. Our hosting provider keeps standard server logs (IP address, time, page requested) for security, for a short period.

4. Data we collect from people who use the panel

Account data: name, email, role, language, and the business you belong to.

Usage logs: IP address, time of access, browser, and actions taken in the panel. We keep them to secure accounts, investigate incidents, support you and improve the Service.

Support conversations: what you write to us by email or in the panel.

5. Why we use it and on what legal basis

To provide and administer the Service to your business: performance of our contract with it.

To answer your request for a demo or information: our legitimate interest in responding to you.

To secure the Service and detect abuse: our legitimate interest in protecting the Service and its users.

To send you news about Bugpi: only with your consent, which you can withdraw in any message.

To comply with the law or a binding order: our legal obligation.

6. Who we share it with

Service providers that help us run the Service, under contracts that limit them to that purpose: hosting in the European Union, email delivery, error monitoring, and the invoicing and payment providers each business chooses to connect. A current list is available on request.

Authorities, when the law requires it, and professional advisers if a dispute arises.

A buyer or successor, only as needed if Bugpi changes ownership, under the same commitments.

We do not sell personal data and do not share it for advertising.

7. How long we keep it

Contact requests: until the conversation is closed, then up to 12 months. Account data and usage logs: while the business subscribes, then 30 days, except what tax or legal rules oblige us to keep longer. Guest data: for as long as the business instructs, and deleted 30 days after it leaves.

8. Security and where data lives

Data is stored on servers in the European Union, encrypted in transit and at rest, backed up, and accessible only to staff who need it. If a provider outside the EU is ever involved, we use the safeguards the GDPR requires, such as standard contractual clauses. No system is risk-free; we will tell you and the authorities without undue delay if an incident affects your data.

9. Guests of a business

When a customer books, the Service records what the booking needs: name and contact details, the names and ages of any children or group members, allergies or notes the customer chooses to share, the signed responsibility terms where the business uses them, and the payment status. The business decides what to ask and how long to keep it, and answers requests to see, correct or delete that data. Bugpi helps it do so. We never use guest data for our own purposes.

10. Your rights

Under the GDPR you may ask us to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent at any time. Write to [email protected]; we may ask you to confirm your identity, and we answer within one month. You can also complain to the Portuguese data protection authority, the CNPD (cnpd.pt), or to the authority of the country where you live.

11. Changes

If this policy changes in a way that matters to you, we announce it by email to account holders and on this page before it applies.