1. Who we are
InnBoss is operated by CrossMedia Inc., of 20 Todds Terrace, St. George, Barbados 19015, company number 20408596 (“InnBoss”, “we”). We are the data controller for the processing described here.
Questions, or any request about your data: info@crossmediadesigns.com
An important limit on our role.
When you book a table, a room or a tour through InnBoss, the business you are booking with is a separate controller of your booking details. They decide how they use your information to serve you, and their own privacy practices apply alongside this policy.
2. Who this covers
Three different groups use InnBoss, and we collect different things about each.
- Businesses — owners and staff of listed businesses, who hold accounts.
- Guests and travellers — people who browse listings, plan trips, book, or request a driver. Most never create an account.
- Drivers — people driving for a registered transport operator on the platform.
3. What we collect
From businesses
- Account details: name, email address, and either a password (stored only as a cryptographic hash) or a Google account identifier if you sign in with Google.
- Business information you publish: trading name, address, parish, coordinates, phone, website, photographs, logo, menus and prices, services, opening hours.
- Operational records: bookings, orders, availability, staff accounts, and any records created by add-on tools you use.
- Payment configuration: which gateway you use, its currency and mode. We do not receive or store your bank details or your customers’ card numbers.
- Notification settings: device push tokens, channel preferences, quiet hours, time zone.
From guests and travellers
- Booking details: your name, phone number, email address, party size, dates, and any notes you add.
- Trip itineraries you create or receive, including the places on them.
- Ride requests: pickup and destination addresses, any stops, times, and passenger numbers.
- What you type or say to our AI concierge and trip planner.
- A device push token, only if you choose to turn on notifications.
From drivers
- Driver profile: display name, phone number, photograph, vehicle make, model, colour and registration plate.
- Location. While you are marked online in the driver app, your device sends its position — latitude, longitude, heading and accuracy — approximately every five to ten seconds. See section 4.
- Ride records: rides offered, accepted, declined and completed; fares, tips and whether cash was collected.
- Device push tokens, so ride offers can reach you.
4. Driver location, specifically
This is the most sensitive thing we handle, so it gets its own section.
- Only while you are online. Location is collected when you set yourself available for work, and stops when you go offline or sign out.
- Used only for dispatch — matching you to nearby ride requests, and showing your operator where their active vehicles are.
- Not shown to guests. A guest tracking a ride sees the status of their booking and, once you accept, your name, vehicle and phone number. They are not shown your live position.
- Kept as a current position, not a history. Your latest ping replaces the previous one. We retain the current-position record for 30 days after your last activity.
- You can stop it at any time by going offline, or by withdrawing location permission in your device settings — though the driver app cannot offer you work without it.
5. Why we process it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Running your account and the services you ask for | Performance of a contract |
| Taking and confirming bookings, orders and rides | Performance of a contract |
| Dispatching drivers, including location | Performance of a contract; consent for device location |
| Invoicing businesses and keeping financial records | Legal obligation; legitimate interests |
| Security, fraud prevention, abuse investigation | Legitimate interests |
| Improving the platform and its AI features | Legitimate interests |
| Push notifications and marketing email | Consent, withdrawable at any time |
6. The AI concierge and trip planner
Our chat and voice assistants send what you write or say to third-party AI providers so they can answer you and build itineraries. Do not put anything into them you would not want processed that way — payment details, identity documents, or health information. They do not need any of it, and we do not ask for it.
7. Who we share it with
We do not sell personal information. We share it with the following, only as needed.
| Who | What for | Where |
|---|---|---|
| The business you booked | Your booking, so they can serve you | Barbados / regional |
| Supabase | Database, accounts, hosting | Outside Barbados |
| Google (Firebase Cloud Messaging) | Delivering push notifications | Outside Barbados |
| Lovable | Application hosting and message delivery | Outside Barbados |
| Anthropic | AI concierge and trip planning | Outside Barbados |
| ElevenLabs | Voice assistant | Outside Barbados |
| Twilio | SMS notifications | Outside Barbados |
| RouteStack | Flights, car hire and hotel bookings you make through us | Outside Barbados |
| Payment gateways | Taking payment, operated by the business, not by us | Varies |
| Partner hub sites | Publishing business listings (e.g. Hello Barbados) | Barbados |
We may also disclose information where the law requires it, or to establish or defend legal claims.
8. Payments
InnBoss never sees your card.
When you pay a business through the platform you are taken to a payment page operated by that business’s own payment provider. The money goes to the business’s own bank account under their own merchant agreement. We record that a payment happened; we do not receive, store or process the card details, and we do not hold the funds.
9. Sending data outside Barbados
Our hosting, notification and AI providers operate outside Barbados, mainly in the United States and Europe. That means your information is transferred out of Barbados. Where the Data Protection Act requires it, we rely on the provider’s contractual data-protection commitments and, where applicable, standard contractual clauses. You may ask us for details of the safeguards for any particular transfer.
10. How long we keep it
| What | Kept for |
|---|---|
| Business accounts and listings | While the account is open, then 12 months |
| Bookings, orders and rides | 7 years, for financial record-keeping |
| Driver current position | 30 days after last activity |
| Push tokens | Until revoked or the device stops responding |
| AI conversations | 90 days |
| Guest details on a cancelled request | 12 months |
11. Your rights
Under the Barbados Data Protection Act you may:
- ask what we hold about you, and get a copy;
- have inaccurate information corrected;
- ask us to erase information we no longer need;
- ask us to restrict how we use it, or object to a particular use;
- receive information you gave us in a portable form;
- withdraw consent — for notifications, marketing or location — at any time; and
- complain to the Data Protection Commissioner of Barbados if you think we have got it wrong.
Write to info@crossmediadesigns.com. We reply within two business days, and complete your request within the time the Act allows. We would rather hear from you first, but you are entitled to go to the Commissioner whether or not you do.
12. Security
Traffic is encrypted in transit. Access to records is restricted at the database level so a business can reach only its own data and a driver only their own rides. Passwords are stored as hashes and are never readable by us. Card payments happen on the payment provider’s own systems, not ours. No system is perfectly secure, and we will tell you and the Commissioner about a breach affecting you where the Act requires it.
13. Cookies and local storage
We use browser storage to keep you signed in, remember your selected business or driver profile, and hold small preferences such as a chosen currency. Our partner hub sites may use analytics cookies, which their own notices describe. We do not use advertising cookies on InnBoss.
14. Children
InnBoss is not intended for children. Accounts are for people aged 18 or over. We do not knowingly collect information from children; if you believe we have, contact us and we will delete it.
15. Changes
We will post any change here and update the date at the top. Where a change materially affects how we use your information, we will tell account holders directly.