Privacy
Last updated 28 October 2026.
bàzilo is scheduling software for holiday lets. This page explains what it records about the people who use it — mostly cleaners and laundry providers — why, who else can see it, and how to get a copy or have it removed.
Who is responsible for your data. Each host or agency runs their own separate bàzilo database and decides what goes into it, so they are the controller. Fractional Minds builds and runs the software on their behalf, as the processor. For the few things listed under What we decide ourselves, Fractional Minds is the controller instead. If you clean for someone, your first point of contact is them — but you can write to us and we will help.
If you clean or do laundry
You are the person this page is most about. To give you a working list of jobs, bàzilo records:
| Your name and contact details | So the host knows who is on a job, and so we can message you about one. |
|---|---|
| Which jobs are yours | The property, the date and the time. This is the schedule itself. |
| When you started and finished | Stamped by the server, not by your phone. It is what a fixed-price job is checked against and what an hourly one is paid on. |
| Photos you take | Proof that a room was left ready. They carry the moment they were taken, stamped on the picture. The location and phone details a camera stores in a photo are removed before it leaves your phone. |
| Notes you write | Anything you tell the host about a job, including a problem you flag. |
| Time off you enter | So you are not given work on a day you said you were away. |
| Your language | So the app and the messages sent to you are in English or Slovenian, whichever you read. |
| Messages about your work | Only where the host has it switched on: a copy of each message bàzilo sends you about a job, and of what you write in the app, so the host can look back at what was said. |
| What you charged | Only where the host lets you enter it: the cost you type for a job, which is what you are paid for it. |
Why we are allowed to. Because it is necessary for the work you have agreed to do, and because the host has a legitimate interest in knowing their properties were cleaned. You are not tracked between jobs: there is no location tracking, no background reporting, and nothing is recorded when you are not using the app.
How jobs reach you. A host can let bàzilo assign cleans automatically. It picks someone who has not said they are away that day, preferring whoever has the fewest jobs. The host can change any assignment, and bàzilo does not score you or decide what you are paid.
If you are a host or manager
We hold your email address and, if you asked for alerts, a mobile number and whether it is on WhatsApp. Your properties are held as a name, an address, a booking calendar link and how much linen each one owns.
Before you have an account, and for your account and bills once you do, Fractional Minds is the controller — see What we decide ourselves.
Guests
We do not keep guest names. There is no field for one.
Booking calendars usually carry the guest's name. bàzilo reads how many people are staying — so the right number of beds is made up — and discards the rest at the moment of import. A guest's name is never written to the database, so it cannot be exported, leaked or disclosed. This is a design decision rather than a policy, which is why it holds. Airbnb's calendar carries no head count, so a host can let a small script in their own mailbox send bàzilo just the reservation code and the number of guests and pets from Airbnb's confirmation emails; the guest's name stays in the host's mailbox.
A cleaner can rate, from one to five, how the guests left the property. The rating is kept with the clean, not with a name, and only the host and that cleaner see it.
What we decide ourselves
For these, Fractional Minds decides what is collected and why, so we are the controller and you can come to us directly.
Signing up
Your name, email, company name, phone number, billing currency and language, the address your request came from, and which version of our terms you agreed to and when. We use them to check the request is genuine, set your account up and keep a record of what you agreed to.
Lawful basis: taking the steps you asked for before entering a contract with you. Kept: a signup that is never confirmed, or that we turn down, is deleted after 30 days; otherwise it becomes your account record, below.
Your account and bills
The details above, plus your plan, your bills and your payments, so that we can run your subscription and bill you.
Lawful basis: our contract with you, and the tax law that requires us to keep bills. Kept: while you are a customer; a short reference record for 12 months after your account closes; bills for as long as tax law requires.
Analytics in the apps
Only if you say yes. The cleaning, laundry and admin apps ask each person once, and you can change your answer at any time from the Guide screen. If you say yes, Google Analytics records which screens are opened, the kind of phone or computer and browser, and roughly where from — which Google works out from your internet address without storing it. It never sees what you type, your jobs, photos or names, or anything else in the database, and never your sign-in link: that is removed from the address before analytics can load. We use it to see which parts of bàzilo get used and where people get stuck.
Lawful basis: your consent. Kept: by Google, for no more than 14 months.
The website
bazilo.uk and bazilo.si ask before using Google Analytics, on the same terms as the apps. They also count visits at our network edge, run by Cloudflare: for each page view we add one to a daily total for the page, the site that sent you, your country and your type of device. That uses no cookie, script or identifier and does not keep your internet address, so the totals cannot be linked to you. You can switch it off for your browser under Privacy choices, and browsers that send Global Privacy Control or Do Not Track are never counted. The contact and signup forms are protected by Cloudflare Turnstile, which looks at your browser and connection to tell people from bots. A message you send through the contact form reaches us by email.
Lawful basis: your consent, for analytics; our legitimate interest in knowing which pages are read and how people find us, for counting visits, and in keeping bots out of the forms and answering you. Kept: analytics as above; the visit totals for two years; a message for as long as the conversation needs it.
Keeping bàzilo secure
Server request logs — your internet address, the time and what was asked for — and counts of failed sign-in attempts, so that we can spot and stop attacks. The counts are held in memory only and are forgotten when the server restarts.
Lawful basis: our legitimate interest in keeping bàzilo, and the data in it, secure. Kept: logs for five days.
Who else processes it
We do not sell anything to anybody, and there is no advertising in bàzilo. These are the services it runs on:
| Amazon Web Services | Hosting. Your database and photos sit on a server in Frankfurt, in the EU. |
|---|---|
| Cloudflare | Serves the website and counts its visits without identifying anyone, passes app traffic through, and runs the bot checks on the website. It sees requests, not the contents of your database. |
| Meta (WhatsApp) | Only if messages are switched on. To send you one, Meta receives your phone number and the text of the message — which can include a property name and a date. |
| Infobip (SMS, Viber) | Not in use yet. If text or Viber messages are switched on, Infobip receives your phone number and the text of the message — which can include a property name and a date. It is based in Croatia and keeps the data in its EU data centres. A Viber message is then delivered by Rakuten Viber (Viber Media S.à r.l., Luxembourg). |
| Google (email) | Sends the emails bàzilo sends: sign-in codes, alerts and summaries. |
| Google Analytics | Only for people who said yes to analytics, in the apps or on the website. Sees which screens and pages are opened and the device used — never your jobs, photos or anything in the database. |
Leaving the UK and the EU. Meta, Cloudflare and Google are US companies, and Rakuten Viber belongs to a Japanese group; each may process data outside the UK and EEA. Where they do, the transfer is covered by an adequacy decision — such as the EU–US Data Privacy Framework and its UK extension — or by standard contractual clauses. Your database itself does not leave Frankfurt.
Cookies and storage on your device
The apps keep a few things on your phone or computer so that they work: your sign-in, your language, changes waiting to be sent while you are offline, and a copy of the app itself so it opens without signal. They are needed for the service you are using, so you are not asked about them. Google Analytics' cookies (named _ga and _ga_…, kept for up to two years) are set only if you say yes. The website remembers your answer, and your choice of language, in your browser. On the website, Cloudflare's security check sets a cookie called cf_clearance, kept for up to a year, once your browser has passed it, so that you are not checked on every visit; it keeps the site secure and is not used to track you. If you save a choice under Privacy choices, a cookie called _nyb_opt remembers it for six months. Both are strictly necessary, so you are not asked about them.
How long it is kept
- Jobs, times and notes — for as long as the host keeps using bàzilo. They are the record of work done and are often needed for pay and tax.
- Photos — the host can set a limit, after which they are deleted automatically; on the free plan they are deleted after 30 days. Where no limit is set they are kept.
- Your sign-in link — stops working when the host resets or expires it, and can be revoked at any time.
- Server request logs — five days.
- Copies of messages about your work — twelve months, where the host has them switched on, then deleted automatically.
- Backups — taken every night, encrypted, and kept for 14 days.
- When a host leaves — their whole database, yours included, is deleted 30 days after their account closes, and the last backup copy within a further 14 days.
Your rights
Under UK GDPR and the EU GDPR you can ask for a copy of what is held about you, ask for a mistake to be corrected, ask for it to be deleted, object to how it is used, or ask for it in a portable form. Where something rests on your consent, such as analytics, you can withdraw it at any time — in the apps, from the Guide screen. For a host's records, ask the host you work for, or write to us and we will pass it on and help; for what we decide ourselves, write to us.
One honest limit: work records like start and finish times are also the host's business records, so a request to delete them may be partly refused where they are still needed for pay, tax or a dispute. You will be told which parts and why.
Contact and complaints
Write to hello@bazilo.uk. If you are not happy with the answer you can complain to the regulator: the Information Commissioner's Office in the UK, or the Informacijski pooblaščenec in Slovenia.
Fractional Minds is a trading name of ZELE LTD, a company registered in England and Wales under number 16760837, whose registered office is at 30b Great Sutton Street, London EC1V 0DU. ZELE LTD is the controller for the things listed under What we decide ourselves, and the processor for hosts.
If we change this page in a way that matters, the date at the top changes and we tell hosts by email.