Privacy Policy

Last updated: 17 May 2026

1. Who we are

Warehubcy is operated by A.G. HorecaCy 3button Ltd ("Warehubcy", "we", "our"), registered in the Republic of Cyprus. Our F&B inventory platform is hosted at warehubcy.eu. The data controller for personal data collected through this Service is A.G. HorecaCy 3button Ltd. The data protection contact is andreas@3buttontrading.com.

2. What we collect

• Account data — name, email, role, last-login timestamp, IP address and user-agent string. We use this to operate the Service and to populate the audit log.
• Operational data — products, suppliers, purchase orders, goods received notes, transfers, waste records, recipes, and consumption forecasts that your team enters or that we extract from invoices you upload.
• Staff records (optional HR module) — when the HR module is enabled, our customers (the employer) may store staff profiles including name, contact details, nationality, identifier numbers, employment dates, leave history, and uploaded documents such as passports or work permits. Warehubcy acts as data processor for these records; the employer is the controller.
• Operational telemetry — error logs and request metadata strictly needed for security and reliability.

3. Lawful basis

We process personal data under the following GDPR Article 6 bases:

• Contract (Art. 6(1)(b)) for everything required to deliver the Service to a paying customer.
• Legal obligation (Art. 6(1)(c)) for tax and accounting records the law requires us to keep (e.g. Cyprus retention rules for invoices).
• Legitimate interest (Art. 6(1)(f)) for fraud detection, security logging, and product improvement.

4. Where data lives

All operational data is stored on Supabase (EU region, Frankfurt and Ireland). Uploaded staff documents are stored in a private Supabase Storage bucket also located in the EU. Outbound email is relayed via AWS SES (eu-central-1, Frankfurt).

5. Sub-processors

The following service providers process data on our behalf:

• Supabase, Inc. — database, authentication, file storage (EU).
• Amazon Web Services EMEA — outbound transactional email (EU).
• Anthropic, PBC — AI processing of invoice photos you upload (US, transmitted with appropriate safeguards).
• Hetzner Online GmbH — server hosting (EU, Germany).

We sign a Data Processing Agreement (DPA) with each sub-processor. Customers can request our DPA template at andreas@3buttontrading.com.

6. How long we keep it

• Account & audit log — for the lifetime of your subscription plus 12 months for compliance.
• Operational data — for as long as your account is active. Invoices and goods received notes are retained for at least six years to satisfy Cypriot tax law.
• Staff records — controlled by the employer; we delete on written instruction.

7. Your rights (or your staff's)

Under GDPR you have the right to:

• Access the data we hold about you.
• Correct inaccurate data.
• Request erasure (subject to legal retention obligations described above).
• Object to processing or restrict it.
• Receive a portable copy of your data.
• Lodge a complaint with the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or your local supervisory authority.

Email andreas@3buttontrading.com to exercise any right. We respond within 30 days.

8. Security

We use TLS 1.2+ in transit, AES-256 at rest, and Row-Level Security plus application-layer companyId scoping to keep customer data isolated. The principle of least privilege governs internal access.

9. Cookies

We use a single first-party cookie (sb-…-auth-token) strictly necessary for keeping you signed in, plus a functional cookie (warehubcy:sidebar:state) that remembers whether you collapsed the sidebar. We do not use analytics or advertising cookies.

10. Changes

We will email all account owners 30 days before any material change to this policy.

Questions? andreas@3buttontrading.com · See also our Terms of Service.