This Privacy Policy explains how Pixhelm LTD ("Lobbix", "we", "us") collects, uses, and protects personal data when you use Lobbix. Lobbix is a hotel management platform: you run your property on it, and we host the reservations, guest records and billing data your operation creates.
Information we collect
- Account information. Name, email address, password (stored hashed), and workspace or organisation details you provide when you register or invite teammates.
- Property and operational data. The rooms, rates, reservations, folios, invoices and operational records your property creates in the platform.
- Guest records you manage. Names, contact details, stay history and preferences of your guests, which you enter or receive through booking channels. For this data you are the controller and we process it on your behalf — see theData Processing Addendum. We do not use your guests' data to build advertising profiles or for any purpose of our own.
- Billing information. Plan and subscription status. Card and payment details are handled by our payment provider (see Terms of Service); we do not store full card numbers.
- Cookies and similar technologies. See our Cookie Policy for the categories we use and how to manage them.
How we use information
- To provide, operate, and secure the service and your property's data within it.
- To sync availability and reservations with the booking channels you connect.
- To authenticate you, manage your account, and provide customer support.
- To process payments, manage subscriptions, and send service-related notices.
- To detect, prevent, and investigate abuse, fraud, and security incidents.
- To improve the product and, where permitted, to send product updates you can opt out of.
Legal bases for processing (GDPR)
Where the GDPR applies, we rely on the following legal bases:
- Contract — to provide the service you sign up for and to bill you.
- Legitimate interests — to secure, maintain, and improve the service and to prevent abuse, balanced against your rights.
- Consent — for optional cookies and any marketing communications, which you can withdraw at any time.
- Legal obligation — to meet accounting, tax, and other legal requirements.
Data retention
We keep account and property data for as long as your account is active. If you close your account, we remove or anonymise associated personal data within a reasonable period, except where we must retain records to meet legal, accounting, or security obligations. Aggregate statistics may be retained in de-identified form. Specific retention periods are set out inraw scan records are kept for 30 days on the free tier, 90 days on Starter, 365 days on Business and for the lifetime of the workspace on Enterprise; daily aggregates are kept for the same period; account and billing records are kept while the account is open and deleted when it is closed.
Sharing and sub-processors
We do not sell personal data. We share data only with service providers that help us run Lobbix — such as cloud hosting, payment processing, email delivery, and analytics — under contracts that require them to protect it and use it only on our instructions. Our current list of sub-processors is available at Hetzner Online GmbH (application hosting, database and object storage; Nuremberg, Germany); Cloudflare, Inc. (DNS, and DNS/TLS automation for customer custom domains; global edge network); Paddle.com Market Ltd (merchant of record — payment processing, invoicing and tax; United Kingdom); Purelymail (transactional email delivery; United States); Google LLC (optional "Sign in with Google" authentication, only for accounts that choose it; United States). We may also disclose data where required by law or to protect our rights, users, or the public.
Your rights
Depending on where you live, you may have the right to access, correct, delete, export (portability), restrict, or object to our processing of your personal data, and to withdraw consent. You can exercise many of these directly in your account settings, or by contacting us using the details below. You also have the right to complain to your local data protection authority.
International transfers
We may process and store data in countries other than your own. Where we transfer personal data across borders, we use appropriate safeguards such as Standard Contractual Clauses or an equivalent lawful transfer mechanism. Details of the safeguards we rely on are available on request at the UK International Data Transfer Addendum (IDTA) together with appropriate technical and organisational safeguards.
Children
Lobbix is not directed to children and is not intended for use by anyone under the age required to consent to online services in their country (generally 16, or as set by local law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Contact and data protection officer
For privacy questions or to exercise your rights, contact us at hello@lobbix.org. Our data controller of record is Pixhelm LTD, Suite 11114, 5 Brayford Square, London, United Kingdom, E1 0SG. Data protection contact / DPO: info@pixhelm.com.
Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the date below and, where appropriate, notify you. Continued use of Lobbix after an update means you accept the revised policy.
Questions? Contact hello@lobbix.org.
Last updated: August 13, 2026