Privacy Policy

Meurneoba OS is software for running places with their own economy: estates, farm resorts and villages. It is operated by Meurneoba Group LLC, a limited liability company registered in Georgia (identification code 404784587), with its registered address at Gogebashvili II Lane 15, Mtatsminda District, Tbilisi, Georgia ("Meurneoba", "we"). Contact: zuka@meurneoba.ge.

This policy follows the Law of Georgia on Personal Data Protection and, for people in the EU, the GDPR. Who is responsible depends on whose data it is:

• Residents, guests and staff of a property. The property that uses Meurneoba OS (the estate or village company) decides why and how their data is used, so it is the controller. We process that data on its behalf as its processor, under our agreement with it. Questions and requests about this data go first to the property; we help it answer them.
• The people who set up and run a property account (founders and operators), and visitors to this website. Here we are the controller.

• Accounts: name, email, phone (if given), role, the property you belong to, and the status of your account.
• Sign-in and security: a hashed password (never the password itself), session records with IP address and browser type, and failed sign-in counts.
• Homes and residents: households, who lives in them and since when, and who is the main contact.
• Money: agreements with residents (gardens, rentals, cooperative membership), monthly statements, recorded payments and arrears, the property's income and expense ledger, and revenue received from connected hotel (PMS) and point-of-sale (POS) systems.
• Bookings and requests: table, dinner and service bookings, service requests and their comments.
• Votes: cooperative motions and ballots. A ballot is recorded per household; property managers see turnout and results, not how a home voted.
• Operations: work orders, alerts, site logs, schedules, harvest, assets, inventory and sensor readings. These can contain names of staff or residents where people typed them.
• Telegram, only if you link a chat: the chat's identifier and the commands sent to the bot.
• AI outputs: briefings, predictions and suggestions created from the property's operational data.
• Audit log: who changed what and when, from which IP address, and which fields were changed. It does not store the values people send, such as passwords, ballot choices or personal details.

We do not process payment card numbers or bank logins. Payments are recorded as amounts and references; the money itself moves through banks and payment providers outside Meurneoba OS.

• To provide the service the property and its people signed up for: accounts, homes, statements, bookings, votes, operations (contract; for residents, the property's own contract or legal duty).
• To keep financial records such as statements, payments and the ledger, for as long as accounting and tax law require (legal obligation).
• To keep the service secure and investigate misuse: sign-in records, rate limits, the audit log (legitimate interest in security, and the controller's duty to protect data).
• To send Telegram messages, only to people who link a chat themselves (your choice; you can unlink at any time).
• To produce AI briefings and suggestions for property managers (the property's legitimate interest in running its operations; see AI & Data Use).

We do not sell personal data, use it for advertising, or send marketing messages without consent.

We use these providers to run the service. Each processes data only to provide its part of it:

• Neon (USA; database hosted in Frankfurt, Germany): stores the data.
• Render (USA; servers in Frankfurt, Germany): runs the application server and keeps its logs for a short period.
• Vercel (USA): serves the web pages. Your browser talks to our server directly; Vercel sees page requests, not your records.
• Anthropic (USA): the AI model behind briefings and predictions. Data sent through its API is not used to train its models.
• GitHub (USA): keeps our nightly database backups, encrypted with a key only we hold, for 30 days.
• Telegram, only if you link a chat: delivers bot messages under Telegram's own privacy policy.
• OpenWeatherMap and the National Bank of Georgia: weather and exchange rates. We send them no personal data.
• The hotel or point-of-sale system a property chooses to connect, which sends us its revenue and room data under that property's own contract with it.

The database and application servers are in the EU (Frankfurt). Some providers above are based in the USA and may access data from there. For these transfers we rely on the providers' data processing terms, which include the EU Standard Contractual Clauses, as safeguards recognised under the GDPR and Article 37 of the Georgian law. Telegram is used only when you choose to link a chat.

• Accounts and property data: while the property uses Meurneoba OS. When a property leaves, we delete or anonymise its data within 90 days, after giving it the chance to export.
• Financial records (statements, payments, ledger): for the period Georgian accounting and tax law requires, even after an account closes; the person they relate to is then replaced by an anonymous reference where the law allows.
• Sign-in sessions: a session lasts up to 7 days without use; expired and ended sessions are removed regularly.
• Audit log: 400 days, then deleted automatically.
• Backups: 30 days, then deleted automatically.
• Server logs: kept by our hosting provider for a short period, then deleted.

Under the Georgian law and the GDPR you can ask to:

• know whether we process your data, and get a copy of it;
• correct data that is wrong or incomplete;
• delete your data, unless the law requires us to keep it (for example financial records);
• restrict processing while a question about it is being resolved;
• receive your data in a structured, machine-readable form (portability);
• object to processing based on legitimate interest;
• withdraw consent you gave, for example by unlinking Telegram, at any time;
• not be subject to a decision with legal or similarly significant effect made only by automated means. Meurneoba OS makes no such decisions: AI output is advice for people, not a decision about you.

See Data Requests for how to ask and how long it takes. You can also complain to the State Audit Office of Georgia, which supervises personal data protection in Georgia, or to a court. If you live in the EU, you can complain to the data protection authority of your country.

Each property's data is kept separate from every other property's, and every request is checked against the person's role. Passwords are stored only as hashes, connections are encrypted, backups are encrypted, and changes are recorded in the audit log. See Security.

If a personal data breach happens, we tell the affected property without delay. Where the law requires, the State Audit Office of Georgia (or the competent EU authority) is notified within 72 hours of us becoming aware of it, and affected people are told when the breach poses a high risk to them.

We update this policy when the service or the law changes, and show the date at the top. Material changes are announced to each property's founder before they take effect.