Privacy Policy
Last updated: November 2026Protecting your personal data and safeguarding your privacy is of the highest importance to EntraLane and CreativeBytes e.U. EntraLane was engineered from the ground up on the principles of Privacy by Design, Privacy by Default, and Data Minimization (Art. 5(1)(c) and Art. 25 GDPR).
1. Data Controller & Privacy Contact
Data Controller pursuant to the General Data Protection Regulation (GDPR):CreativeBytes e.U. — Owner: Michael Fichtinger
Industriestraße 9
6841 Mäder
Austria
Privacy Email: privacy@creativebytes.at
General Contact: office@creativebytes.at
Website: https://entralane.com
If you have any questions about data protection, exercising your data subject rights, or this Privacy Policy, you can contact us directly at any time using the email address above.
2. Privacy for Waiting Visitors, Patients & Walk-In Guests
2.1 Complete Anonymity When Drawing a Ticket (Zero-PII Principle)
When obtaining a virtual queue ticket at an entrance check-in kiosk (/kiosk/:slug) or on your own smartphone (/t/:ticketId), we collect, store, or process zero direct Personally Identifiable Information (PII):
- check_circleYou are never required to provide your name, email address, phone number, or date of birth.
- check_circleNeither an app download nor an account registration is required.
- check_circleTicket allocation and waiting room TV callouts rely exclusively on anonymous sequence numbers paired with optional memorable codewords (e.g., A-024 • Silver Fox) and cryptographically generated, session-scoped random tokens.
- check_circleNo user profiling, advertising fingerprinting, or cross-site tracking takes place.
2.2 Optional Web Push Notifications
If you explicitly choose to receive a notification on your smartphone when your ticket is called, your browser generates an anonymous push subscription token (Web Push Endpoint pursuant to RFC 8030 / RFC 8291) based on your explicit consent (Art. 6(1)(a) GDPR):- check_circleThis token contains no clear-text personal information or phone number.
- check_circleDelivery is mediated end-to-end encrypted via the official push service of your operating system or browser vendor (Apple APNs, Google FCM, Mozilla Autopush, or Microsoft WNS).
- check_circleThe push subscription token is automatically and permanently purged from our database immediately upon ticket completion, cancellation, no-show, or expiration.
3. Data Processing for Tenants (B2B Customers, Team Members & Staff)
3.1 Registration, Account & Team Management
When registering an organization account (tenant) or joining as an invited team member (Organization Owner or Location Manager), we process the following data for contract performance and account administration (Art. 6(1)(b) GDPR):
- check_circleFirst name, last name, business email address, optional phone number, and preferred UI language (
ApplicationUser); - check_circleCryptographic password hash (ASP.NET Core Identity PBKDF2) and optional two-factor authentication metadata (TOTP secret and hashed recovery codes);
- check_circleRole assignment (
OwnerorLocationManager) and—for Location Managers—the assigned branch scope (AssignedLocationId); - check_circleOrganization name, branch metadata, timezone, billing address, EU VAT Identification Number (UID), selected subscription tier or Event Pass, and payment status.
3.2 Service Desk Staff (DeskOperator)
To route and manage visitor flow across service desks (/desk/:slug), tenant administrators can create desk operator profiles:
- check_circleOperator Name / Pseudonym: For identification at the service desk terminal.
- check_circlePIN Authentication: 4-digit operator PINs are never stored in plaintext; they are hashed using strong salted cryptography (PBKDF2 with a unique per-operator salt).
- check_circleTransient Invitation Emails: Email addresses entered when sending a staff PIN-setup link are used strictly transiently to dispatch the invitation email and are never stored permanently in our database (strict data minimization pursuant to Art. 5(1)(c) GDPR).
- check_circleOperational Throughput Metrics: Wait durations, service durations, and served ticket counts are processed to compute live wait-time estimates and aggregated branch statistics for the tenant.
3.3 Outbound Webhooks & REST API Keys
Where a tenant configures outbound real-time webhooks or external REST API integrations, we process the configured target URLs, the HMAC signing secret, and exclusively the cryptographic SHA-256 hash of the API key (el_live_...) for contract execution (Art. 6(1)(b) GDPR).
3.4 Security, Anti-Abuse & Audit Logging
To ensure network and information security, defend against automated bot attacks, and maintain accountability for administrative account changes (legitimate interest pursuant to Art. 6(1)(f) GDPR and Art. 32 GDPR), we process:- check_circleEphemeral IP Rate Limiting: Client IP addresses are processed strictly in volatile memory (RAM / Redis with short TTLs of a few minutes) to enforce rate limits and prevent brute-force or denial-of-service attacks. Client IP addresses and session tokens are excluded or redacted from persistent application log files by default.
- check_circleCloudflare Turnstile (Bot Protection): On public forms (
/register,/login,/forgot-password, and public QR ticket check-in), we verify a privacy-preserving, non-interactive challenge token via Cloudflare Turnstile to confirm that requests originate from a genuine client browser. - check_circleTamper-Resistant Audit Logs (
AuditLogs): Administrative and security-relevant events (such as Terms/DPA acceptance upon registration, plan changes, team member invitations or removals, and authorized support actions) are recorded in audit logs with automatic pruning of operational entries after 365 days.
3.5 Direct Contact & Support Inquiries
When you contact us via email (e.g., atoffice@creativebytes.at or privacy@creativebytes.at), we process the information you provide (name, email address, organization, and message content) to handle your inquiry and any follow-up questions (Art. 6(1)(b) and (f) GDPR).
4. Cookies, LocalStorage & SessionStorage (§ 165(3) Austrian TKG 2021)
We use zero tracking, analytics, advertising, or marketing cookies (no Google Analytics, no Meta Pixel, no third-party ad networks).
Pursuant to § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), § 25(2) German TDDDG, Art. 5(3) of the ePrivacy Directive, and Art. 6(1)(b) and (f) GDPR, we use strictly necessary client storage mechanisms solely to provide the UI preferences, session security, and real-time queue functionality explicitly requested by you:
4.1 Strictly Necessary HTTP Cookie
| Name | Purpose | Properties & Retention |
|---|---|---|
entralane_refresh_token | Securely renews the short-lived JWT access token for authenticated tenant administrators without requiring repeated password entry. | HttpOnly, Secure, SameSite=None (HTTPS production) / Lax (local dev), Path /api/v1/auth · Retention: 7 days (or until manual logout). |
4.2 Client-Side Browser Storage (localStorage & sessionStorage)
| Storage Key | Surface | Technical Purpose & Retention |
|---|---|---|
lang | All pages | Stores the selected interface language (de or en). |
entralane_theme, entralane_desk_theme | All pages / Desk | Stores the selected color theme preference (Light/Dark mode). |
entralane_client_session, entralane_ticket_session_{id}, entralane_ticket_claim_{id}, entralane_ticket_kiosk_{id}, push_sub_{id} | Mobile Ticket (/t/:id) | Cryptographic, anonymous possession and session tokens used to maintain and reconcile the visitor's live queue ticket across phone screen locks or network drops. |
entralane_device_token, entralane_device_info | Kiosk, TV Display, Desk | Cryptographic hardware binding token authenticating paired entrance kiosks, waiting room TVs, and service desks (retained until unpaired by an administrator). |
entralane_pending_plan_intent | Pricing / Registration | Preserves a subscription tier or Event Pass pre-selected on the pricing page across registration and setup (cleared upon checkout or after 24 hours). |
entralane_active_location_id, entralane_active_location_slug, entralane_selected_visitor_flow_queue_slug, entralane_sidenav_insights_expanded | Admin Portal (/app/...) | Remembers the active branch location, selected queue in the Visitor Flow Designer, and sidebar collapse state for logged-in administrators. |
entralane_desk_operator_{id}, entralane_desk_arrival_muted_{id} | Service Desk (/desk/:slug) | Stores the currently active desk operator session and local arrival chime mute toggle on the specific counter terminal. |
el_dismissed_system_notice | Admin Portal | Remembers whether an administrator has dismissed a current system maintenance notice banner. |
entralane_chunk_reload_ts, entralane_nightly_maintenance_date (sessionStorage) | All pages / Terminals | Prevents infinite reload loops when fetching updated JavaScript bundles after a deployment and prevents duplicate 03:00 nightly maintenance checks (retained for the browser tab session only). |
5. Sub-Processors & Third-Party Service Providers
We engage carefully vetted service providers who act strictly under our documented instructions pursuant to Art. 28 GDPR Data Processing Agreements:
| Provider | Purpose / Scope | Location & Data Protection Safeguards |
|---|---|---|
| Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) | Cloud hosting, application servers, Redis cache & relational MySQL databases | European Union (Germany) · ISO/IEC 27001 certified · Art. 28 GDPR DPA |
| Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA / Cloudflare Germany GmbH) | Edge CDN, DDoS mitigation, bot protection (Turnstile), static frontend hosting (Cloudflare Pages), and encrypted object storage (R2) for tenant logos and encrypted backups | EU Edge Network / USA · Certified under the EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCCs) |
| Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) | Payment processing, subscription billing, Customer Portal & B2B EU VAT validation | European Union (Ireland) · PCI-DSS Level 1 certified |
| World4You Internet Services GmbH (Hafenstraße 35, 4020 Linz, Austria) | Transactional SMTP email delivery (OTP verification codes, password resets, team and operator invitations, billing alerts) | European Union (Austria) · Art. 28 GDPR DPA |
| Apple (APNs), Google (FCM), Mozilla (Autopush), Microsoft (WNS) | Transient relay of end-to-end encrypted (RFC 8291), pseudonymous Web Push notification signals to visitor smartphones | Transmitted strictly upon explicit visitor opt-in without personal identifiers |
6. Data Retention and Deletion Periods
We retain personal and operational data only for as long as necessary for the respective purposes or as required by statutory retention laws:
- check_circleRaw Ticket Records (
Tickets): Automatically purged nightly via a sliding-window retention worker according to the tenant's active tier:
- Starter / Flash Pass: 7 days - Free Trial / Weekend Pass: 14 days - Pro / Festival Pass: 30 days - Business: 90 days
- check_circleAggregated Daily Analytics (
DailyQueueMetrics): Contain zero individual tickets or visitor identifiers—only anonymized daily and hourly totals and averages (retained based on tier: 14 days on Free Trial, 90 days on Starter, 365 days on Pro, 730 days on Business). - check_circleTenant Accounts After Deletion Request: When an Organization Owner requests account deletion under
/app/profile, the organization is suspended for a 14-day safety recovery window and subsequently purged permanently and irreversibly (including all queues, operator profiles, tickets, and uploaded logos). - check_circleInactive Free Trial Accounts: Unmonetized evaluation accounts without an active subscription or redeemable Event Pass are automatically purged 30 days after registration (14-day trial + 16-day reactivation grace period).
- check_circleStatutory Tax & Billing Records: B2B invoices and payment transaction records are retained for seven (7) years pursuant to mandatory Austrian tax and commercial law (§ 132(1) Federal Fiscal Code – BAO and § 212 Commercial Code – UGB).
- check_circleOperational Security Audit Logs: Automatically pruned after 365 days (excluding the statutory record of Terms/DPA contract acceptance for the duration of the active customer relationship).
7. Data Processing Agreement for B2B Clients (Art. 28 GDPR)
For organizations deploying EntraLane in their commercial or public-sector operations, we provide a comprehensive Data Processing Agreement (DPA / AVV) pursuant to Art. 28 GDPR, including Technical and Organizational Measures (TOMs under Art. 32 GDPR). It is publicly viewable at /dpa and can be downloaded at any time by authenticated tenant administrators under /app/legal/dpa as a personalized, dated PDF document.
8. Data Subject Rights & Data Portability
Under the GDPR, you have the following statutory rights regarding your personal data:
- check_circleRight of Access (Art. 15 GDPR): Obtain confirmation and details regarding your personal data processed by us.
- check_circleRight to Rectification (Art. 16 GDPR): Update inaccurate personal data directly under
/app/profileor request correction. - check_circleRight to Erasure (Art. 17 GDPR): Request deletion of your personal data or schedule full organization deletion directly under
/app/profile, provided no statutory retention obligations (such as § 132 BAO / § 212 UGB) apply. - check_circleRight to Restriction of Processing (Art. 18 GDPR)
- check_circleRight to Data Portability (Art. 20 GDPR & EU Data Act): Export your account, location, queue, operator, and audit records at any time via self-service under
/app/profileas a machine-readable JSON archive, as well as analytics data under/app/analyticsas CSV. - check_circleRight to Object (Art. 21 GDPR) & Withdrawal of Consent (Art. 7(3) GDPR): Any consent granted (e.g., for mobile Web Push notifications) may be withdrawn at any time with future effect directly on the mobile ticket screen or in your browser settings.
To exercise your rights, please contact us at privacy@creativebytes.at.
9. Right to Lodge a Complaint with a Supervisory Authority
If you believe that the processing of your personal data infringes data protection laws, you have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
The competent supervisory authority for our registered office is:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority — DSB)
Barichgasse 40–42
1030 Vienna
Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at