Privacy Policy

Reception | Visitor Register — operated by ASGILAB. Last updated: 26 July 2026.

This policy explains how the Reception | Visitor Register app ("the App"), provided by ASGILAB ("we", "us"), handles personal data.

1. Two roles: controller and processor

Each business that subscribes to the App and checks visitors in is the data controller of its visitors' data — it decides what to collect and why. ASGILAB acts as a data processor, providing the software and hosting that store and process that data on the business's behalf. If you are a visitor, please also refer to the privacy notice of the business you are visiting.

2. What we collect

Visitor data (entered by the subscribing business at check-in), which may include: name, phone number, email, age, company/organisation, photo, the host being visited, reason for the visit, and check-in/check-out timestamps. A visitor badge ID and QR code are generated for each visit.

Account data (from the business's staff): email address and authentication credentials, and the company name.

We do not use tracking cookies, advertising identifiers, or sell any data.

3. Why we process it (legal bases)

• Consent — visitors are asked to consent to their details being recorded at check-in.
• Legitimate interests — building/premises security and visitor management.
• Contract — to provide the subscribed service to the business.

4. How long we keep it (retention)

Visitor records are automatically deleted 12 months after the visit. A business can also delete an individual visitor's data at any time from within the App ("Delete visitor data"), which erases the person's record, visits, and photo.

5. Where it's stored & how it's protected

Data is stored using Supabase (our hosting sub-processor), on infrastructure located in the United States. Security measures include:

• Encryption in transit (HTTPS/TLS) and at rest.
• Strict tenant isolation — each business can only ever access its own data, enforced at the database level (row-level security).
• Passwords are hashed; we never see or store them in plain text.
• Visitor photos are kept in private storage, accessible only to the owning business.

6. Sub-processors

We use Supabase (database, authentication, storage/hosting). Payments and subscriptions are handled by Apple via the App Store; we do not receive your card details.

7. International transfers

If you are in the EU/UK, note that data is hosted in the United States. Transfers are made under appropriate safeguards (e.g. Standard Contractual Clauses with our sub-processor). [Confirm/replace with your finalised transfer mechanism.]

8. Your rights

Subject to applicable law (including the GDPR), individuals may request to access, correct, delete, or restrict processing of their personal data, and to object or request portability. Visitors should contact the business they visited (the controller); that business can action deletions in the App. For requests directed to ASGILAB, contact us below.

9. Children

The App is intended for use by businesses and is not directed at children.

10. Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

11. Contact

For any privacy questions or requests, contact ASGILAB at thisisme035@gmail.com.