Privacy Policy

HotelOne (“we”) plays two roles. For hotels’ guest and booking data we are a processor (service provider): the hotel decides why and how the data is used and we process it on the hotel’s behalf. For account, website and billing data about hotel staff and visitors we are the controller.

If you are a guest, the hotel you booked with is the controller of your booking data. You can contact the hotel or us; we will help route your request.

• Account data: name, email, phone (optional), password (stored only as a salted hash) and role.
• Booking data: stay dates, room, number of guests, notes, booking status and payment status, and contact details the guest provides.
• Hotel data: property details, rooms, rates, photos, staff accounts and activity logs.
• Voice and chat data: when someone talks to a hotel’s AI agent we process the conversation, and, where the hotel has turned it on, keep a transcript or message record.
• Payments: where card payment is enabled, card details are entered with our payment provider. We never see or store full card numbers.
• Card authorizations: when someone pays for another person’s stay, the hotel can ask the cardholder to sign an authorization: their name and contact details, billing address, the last four digits of the card, the type, country and last four characters of their photo ID, a photo of that ID (stored encrypted), their signature, and the IP address and device they signed from.
• Technical data: IP address, device and browser information, and security logs.

• To provide the Service: take and manage bookings, run the front desk, send confirmations and answer guests.
• To secure the Service, prevent abuse and fix problems.
• To communicate about your account, billing and service changes.
• To meet legal obligations.
• We do not sell personal data, and we do not use guest data to advertise to guests.

Performing a contract (running accounts and bookings), our legitimate interests (security, product improvement, support), legal obligation, and consent where we ask for it (for example, optional recordings).

With the hotel you booked with, and with service providers who help us run the Service under written terms (“subprocessors”). Current list (draft — to be completed before launch):

We may also disclose data when the law requires it, or in a business transfer, with notice to account holders.

Data may be processed in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

• Account data: while the account is open, then deleted or anonymised within [90] days of closure.
• Booking and guest data: for as long as the hotel keeps it in the Service, and as the hotel instructs. Records we must keep for tax or accounting are kept for the legally required period.
• Photos of ID taken for a card authorization: deleted 180 days after check-out (or the period the hotel’s deployment sets), unless a payment dispute about the stay is still open. The rest of the signed authorization is kept with the booking as a record.
• Voice transcripts and messages: [30–90] days unless the hotel sets a different period.
• Security and access logs: up to [12] months.
• Backups roll off within [35] days.

Traffic uses HTTPS. Passwords are hashed. Access is limited by role and by property so staff see only their own hotel’s data, and sensitive hotel credentials are encrypted. No system is perfectly secure; if a breach affects your data we will tell you and the hotel as the law requires.

Depending on where you live you may have the right to access, correct, delete or export your data, to object to or restrict some processing, to withdraw consent, and to complain to your data protection authority.

Email hello@hotelone.site. If your request is about a stay, we may pass it to the hotel (the controller) or ask them to act on it. We will respond within the time the law requires (usually one month).

The Service is not directed at children under 16, and accounts are for adults. Hotels may record the number of children travelling as part of a booking.

We will post changes here and notify account holders of material changes. Contact: hello@hotelone.site. Postal address: [COMPANY NAME AND ADDRESS].