soph.
Privacy Policy
Last updated: June 2026
1. Introduction
Soph ("we", "our", "us") operates a valet management platform for hotels, restaurants, and venues. This Privacy Policy explains what personal data we collect, how we use it, and your rights in relation to it.
We are committed to protecting your privacy and handling your data in accordance with applicable data protection law, including the principles of the General Data Protection Regulation (GDPR).
2. Who This Policy Applies To
This policy applies to two groups:
- Guests: individuals who use the valet service at a participating venue.
- Operators and staff: venue managers and valet staff who use our platform to manage the service.
3. Data We Collect
From guests:
- Phone number — used to send you a car-ready notification via WhatsApp or push notification.
- Room number and guest name (hotel venues only) — optionally linked to your ticket by front desk staff.
- Car request timestamps — when you requested your car and when it was delivered.
- Feedback — an optional rating and comment you may submit after your car is returned.
- Device push token — a technical identifier used to send a push notification if you used our App Clip or web app. Not linked to your identity beyond the current visit.
- Visit history — a count of previous visits at a venue, used only to apply loyalty rewards.
From operators and staff:
- Name and contact details provided during onboarding.
- Login credentials (stored as a one-way cryptographic hash — we cannot recover your password).
- Usage data: actions taken on the platform such as ticket updates and reports viewed.
4. How We Use Your Data
- To deliver the valet service — notifying you when your car is ready.
- To operate the platform — giving venue staff a live dashboard to manage the queue.
- To apply loyalty rewards — tracking paid visits to unlock a complimentary park.
- To improve the service — aggregate, anonymised analytics on wait times and volumes.
- To respond to support requests.
We do not use your data for advertising. We do not sell your data to any third party.
5. Legal Basis for Processing
- Legitimate interest: delivering the service you requested at the venue.
- Consent: where you have opted in to push notifications via the App Clip or browser.
- Contract: processing necessary to deliver the service agreed between us and the venue operator.
6. Third-Party Services
We share data with the following third parties only as necessary to operate the service:
- Twilio — sends WhatsApp notifications on our behalf. Your phone number is transmitted to Twilio for this purpose only.
- Apple (APNs) — push notifications to iPhone users who used our App Clip. Apple receives only the push token, not your phone number.
- Railway — our cloud hosting provider. Your data is stored on Railway's infrastructure in Europe or the United States.
- Cloudflare R2 — stores venue branding assets (logos, cover photos). No guest personal data is stored here.
We do not share your data with any other third party without your explicit consent.
7. Data Retention
- Guest ticket data is retained for as long as the venue's account is active, then deleted.
- Push tokens are tied to a single visit and not stored beyond the life of that ticket.
- Operator account data is retained for the duration of the business relationship and deleted within 30 days of account closure on request.
8. Security
- All data is transmitted over HTTPS.
- Passwords are stored using scrypt, a one-way hashing algorithm. We cannot recover your password.
- Platform access is protected by per-site passwords and signed session tokens.
- We do not store payment card data.
9. Your Rights
You may have the right to access, correct, delete, or port your personal data, and to object to or withdraw consent for processing. To exercise any of these rights, contact us at privacy@soph.app. We will respond within 30 days.
10. Cookies
Our guest-facing pages do not use tracking cookies. We use a session cookie solely to maintain login state for venue staff. We do not use advertising or analytics cookies.
Our App Clip and web app may store device-local preferences (e.g. whether you added a pass to Apple Wallet). This data never leaves your device.
11. Children
Our service is not directed to children under 16. We do not knowingly collect personal data from children. Contact us at privacy@soph.app if you believe a child has provided us with personal data.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated to venue operators directly. The date at the top of this page reflects the most recent revision.
13. Contact