Privacy notice
Cameras and access logging
The suite at 5 West Gay Street is covered by Verkada security cameras, and every door opening is logged against the credential that opened it. There is no expectation of privacy in common areas. Occupancy figures shown publicly are aggregate counts only — never per-person data.
What we keep, and for how long
Bookings and accepted agreements are kept for 7 years — they are the evidence a licence was accepted. Access logs are kept for 1 year. Magic-link sign-in tokens live for 15 minutes.
Your WorkOS and Sign in with Apple identifiers are kept for as long as your account exists, so a returning sign-in recognizes you. A device push token is kept while it is registered, and removed as soon as you unregister it, sign out, delete your account, or Apple/Google tells us the token is no longer valid.
Signing in
You can sign in with an emailed magic link, with a Google account or an email and password through WorkOS AuthKit, or with Sign in with Apple on iOS. WorkOS acts as our sign-in processor for the Google and password options: it confirms who you are before we create your session, and does not receive your bookings or access data.
Sign in with Apple shares Apple’s stable per-app account identifier with us, plus your name and email if you choose to share them — including a private relay address ending in @privaterelay.appleid.com if you use Hide My Email, which we treat like any other sign-in email. We link that identifier to your Node account; we never see your Apple ID password.
Push notifications
If you install the iOS or Android app and allow notifications, we store a device push token — an opaque per-install identifier issued by Apple or Google, not a phone number or hardware serial — so we can send booking reminders, door-ready alerts, and support-ticket replies. It is tied to your account only, never shared, and removed when you turn notifications off, sign out, or delete your account.
Analytics and cookies
We use Google Analytics to count visits and see which pages are used. It loads only after you press Accept analytics on the banner; until then no analytics script runs and no analytics cookie is set. If your browser sends a Global Privacy Control signal we treat it as a refusal and do not show the banner. Page addresses sent to Google have sign-in and invitation tokens removed. You can change your choice at any time with Privacy settings in the footer.
Separately, this site is served through Cloudflare, which measures page loads and performance with Cloudflare Web Analytics. That measurement is part of delivering the site and is not controlled by the banner. Payments are processed by Stripe, which sets its own cookies on its checkout page.
Your property
Personal property in the suite is at your own risk. Cameras deter; they do not insure.
Deletion requests
You can ask Harris Technology Services to delete your data via support@hts.pro. Bookings and agreements are retained for the legal period above; everything else is purged. We say that plainly rather than claiming full erasure.
Deleting your account also removes your device push tokens and, if you signed in with Apple, removes that connection from your account on our side.