Privacy Policy

1. Privacy at a Glance

Lobby takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (in particular the EU GDPR).

For Business Customers: The processing of employee data within the scope of software utilization (e.g., via Slack or Microsoft Teams) is carried out on your behalf. For this purpose, our Data Processing Agreement (DPA) applies, which is an integral part of our Terms of Service.

2. Data Collection on this Website

• Cookies & Tracking: We are strictly committed to privacy. This website uses no US tracking tools (such as Google Analytics) and no advertising cookies. Only technically necessary connection data (server log files) are temporarily recorded by our host when accessing the page.
• Customer Dashboard & Session Storage: When you log into our web dashboard as an administrator (e.g., via Slack/Teams SSO), we store a technically necessary session token in your browser's local storage. This is strictly necessary to keep you logged in during your visit (Legal basis: Art. 6 (1) (b) GDPR). We do not track your user behavior.
• Contact Form: If you send us inquiries via the support form, your details from the form (name, email, subject, message) will be stored by us for the purpose of processing the inquiry. We do not pass on this data without your consent.
• SSL or TLS Encryption: For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption.

3. Data in the Slack & Teams App

To provide the Lobby service, we collect minimal data directly from your workspace or tenant. We never read, process, or store the content of your private chat messages.

• Workspace & Tenant Data: Slack Team ID or Microsoft Teams Tenant ID, team/tenant name, and the icon for allocation.
• User Data: Slack User ID or Microsoft Teams AAD Object ID (e.g., U123456). We do not store email addresses of regular employees.
• Usage Data: Timestamps of bookings for resources (e.g., desks, home office, sickness) as well as channel IDs in which the bot is supposed to post.
• Optional Data: If voluntarily provided by the user, we store license plates for parking lot management.

4. Permissions (Scopes)

Lobby only requests permissions that are strictly necessary for its core functions:

• Slack Scopes (chat:write & commands): To send you status updates and provide the /lobby command.
• Slack Scopes (users:read & team:read): To verify if a user has administrator rights in Slack and to display the team logo.
• Microsoft Teams Scopes (Graph API): Corresponding permissions such as User.Read (for profile info) and Chat.ReadWrite (for bot messages).
• Optional (Only with explicit consent): If you activate the "Status Sync" feature, Lobby automatically changes your Slack or Teams status to e.g. "Home Office 🏠" or "Sick 🤒". This happens exclusively based on your bookings made in the app.

5. Hosting and Third-Party Providers

• Server / Database: Our application and databases are securely hosted by Hetzner Online GmbH in Germany (ISO 27001 certified).
• Payment Processing: We use Stripe for paid subscriptions. Billing data of the purchasing administrators is processed here. No credit card data is stored on our own servers at any time. Stripe receives no access to the booking data of regular employees.

6. Data Deletion and Your Rights

You have the right at any time to free information about your stored personal data, its origin and recipient, and the purpose of data processing, as well as a right to correction, blocking, or deletion of this data.

Uninstallation of the App: If the administrator removes the Lobby app from the Slack workspace or the Microsoft Teams tenant (uninstallation), we will stop all communication with the workspace immediately.

Complete Deletion: To have all database entries linked to your workspace/tenant or your person completely and irrevocably deleted, please send a brief email with your Slack Team ID or Microsoft Teams Tenant ID to: privacy@lobby-app.de. We will carry out the deletion within 72 hours.

Right to lodge a complaint: In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work, or the place of the alleged violation.

Automatic deletion routine (data minimization): To technically rule out the creation of long-term behavioral profiles, our system automatically and irrevocably deletes historical booking and attendance data (including home office and sick leave status) after exactly 90 days. Billing-relevant usage statistics used to determine active users are purged after 3 months.

7. Responsible Controller