Legal
Privacy policy
Last updated: 27 September 2026.
This is a translation provided for convenience. Kinapi is operated from Spain and the Spanish version is the binding one in the event of any discrepancy.
This page explains what personal data Kinapi processes, for what purpose, and what rights you have over it. Kinapi is an API that lets holiday-rental businesses (the “customers”) comply with the legal obligation to file the traveller report with SES Hospedajes (the Spanish Ministry of the Interior).
Sereno Tech S.L., tax number B44916658, registered at Calle Tulipán 1, is the entity responsible for Kinapi. For any privacy question you can write to gestion@kinapi.es.
Two different roles under the GDPR
Kinapi processes two very different kinds of personal data, and acts in a different legal role in each case:
- Account data (controller). If you sign up to Kinapi to use the API or the panel — your email, your identity when signing in with Microsoft or Google, and your account configuration — Kinapi decides what that data is used for and is directly responsible to you.
- Guest data (processor). When a Kinapi customer uses the API to register their guests (name, identity document, nationality, signature…), Kinapi acts solely as a processor on that customer’s behalf: it is the customer (the business running the accommodation) who decides which guests are registered and who is the controller towards them. Kinapi only processes that data to provide the service to its customer and to transmit it to SES Hospedajes, under a data-processing agreement (art. 28 GDPR).
If you are a guest and want to exercise your rights over the traveller report for your stay, you should first approach the accommodation where you registered — they are the ones who decide what happens to that data. If you get no answer, you can write to the contact address on this page and we will help you locate the controller.
What data we process
- Account and billing: email, tenant/company name, role within the account, generated API keys (only their hash is stored, never the key in the clear). We use your email to manage the account and to write to you about the service: billing or report notices and, when you sign up, a welcome email to learn what you need.
- Guests (on the customer’s behalf): given name, surnames, identity document type and number, nationality, date of birth, address, phone, email, digital handwritten signature and, where the customer requires it, a copy of the rental contract carrying this data.
- Third-party credentials: if a customer connects their own SES Hospedajes credentials or other services, they are encrypted at application level (AES-256-GCM) before being stored — they cannot be read in the clear even with access to the database.
- Technical data: IP address and API activity logs, for security, debugging and abuse prevention.
Who we share data with
- SES Hospedajes (Ministry of the Interior): as a legal obligation (RD 933/2021 and public-security legislation), the traveller report data is transmitted to the Ministry’s official platform.
- Microsoft Azure: we host the database and the application in the Azure data centre in Spain (Spain Central). Microsoft acts as an infrastructure processor.
- Microsoft Entra External ID and Google: if you sign in with Microsoft or Google, those providers confirm your identity; Kinapi only receives your email and name, never your password.
- Microsoft Clarity and Google Analytics: only if you accept analytics cookies, and only on the public site, they receive browsing data (pages viewed, device, where the visit came from). Never in the panel or the guest form. Google and Microsoft may process it outside the European Union, under the EU-US Data Privacy Framework. Details in the cookie policy.
We do not sell personal data to third parties and we do not use it for advertising.
Retention
Account data is kept while the account is active and, after it is closed (closure takes effect 30 days after it is requested), for as long as needed to meet legal obligations or resolve disputes. Guest data is kept for the period required by the traveller-registration rules (three years from the end of each stay, Article 5(3) RD 933/2021) and according to the instructions of the controlling customer — Kinapi does not unilaterally decide how long it is stored. After the customer closes its account or offboards an owner, traveller report data still within that period is kept blocked, with no access except to comply with a request from a competent authority, and deleted when the period ends.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to gestion@kinapi.es. If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).
Minors
Traveller registration sometimes includes minors travelling with an adult. In those cases it is the responsible adult who enters and confirms the minor’s details on behalf of the accommodation, in line with the traveller-registration rules.
Security
Data always travels encrypted (HTTPS/TLS). Sensitive credentials are also encrypted in the database at application level. Access to the panel and the API requires authentication, and each customer can only see the data of their own account.
Changes to this policy
We may update this policy to reflect legal or service changes. If the change is significant, we will flag it visibly on this page.
See also the cookie policy.