Datenschutzerklärung.

01Who we are

HotelOS is operated by Island Inventions Inc., a Delaware corporation with its principal place of business in San Francisco, California, USA ("HotelOS", "we", "us"). This policy explains what personal data we handle, why, and what you can ask us to do about it.

For questions about this policy, or to exercise any right described in it, write to [email protected]. We answer every request from a real person, not a ticket queue.

02The two roles we play

HotelOS handles personal data in two distinct capacities, and your rights differ depending on which one applies.

We are the controller

for the data of the people who deal with us directly: hotel staff who hold HotelOS accounts, people who submit our contact and walkthrough forms, and visitors to hotelos.ai. We decide why and how that data is processed, and this policy governs it.

We are the processor

for the operating data inside a customer's workspace — guest profiles, reservations, folios, messages, tasks, and financial records belonging to the hotel. The hotel is the controller. We act only on its documented instructions under the agreement at /legal/dpa, and a guest's request is answered by the hotel, not by us.

03What data we handle

As controller, we handle a deliberately small set of data:

• Account data — name, work email, phone number where given, job role, the property or group you belong to, and your permission set.
• Authentication data — hashed credentials, session and refresh tokens, single sign-on identifiers from your identity provider, and the audit record of sign-ins.
• Enquiry data — anything you type into our contact or walkthrough forms, plus the campaign parameters, referrer and landing page carried by that visit.
• Support and correspondence — the emails, messages and call notes exchanged while we help you.
• Billing data — the contact and company details needed to invoice you. Card details are entered directly with our payment processor; we never receive or store them.
• Technical data — IP address, user agent, device and language settings, and the diagnostic logs our systems produce while serving a request.

As processor, we handle whatever operating data a customer chooses to put into its workspace. That typically includes guest names and contact details, stay and reservation records, payment tokens issued by the hotel's payment provider, requests and preferences, staff scheduling data, and accounting records. We do not decide what enters that workspace; the hotel does.

04Why we process it, and on what legal basis

Where the GDPR or an equivalent law applies, we rely on the following bases for the data we control:

Performance of a contract

Creating and securing accounts, delivering the products a customer has subscribed to, providing support, and invoicing.

Legitimate interests

Keeping the platform secure and available, preventing abuse, understanding aggregate product usage so we can improve it, and responding to business enquiries people send us. We balance these against your interests and stop where yours prevail.

Consent

Optional analytics beyond what is strictly necessary, and marketing email. Consent is asked for separately and can be withdrawn at any time without affecting the service.

Legal obligation

Tax, accounting and record-keeping duties, and responses to lawful requests from authorities.

We do not sell personal data, we do not share it with advertising networks, and we do not use it to build cross-site advertising profiles. We do not use customer or guest data to train machine-learning models.

05AI features and model providers

Several HotelOS features use AI models — drafting replies to guest messages, summarising conversations and reviews, answering staff questions in Nexus, and classifying or scoring incoming requests. When you use one, HotelOS sends the content that feature needs, such as the message being answered and the relevant reservation details, to an AI model provider, which processes it and returns a result.

Every AI model provider we use is named at /legal/subprocessors, with what it does for us and where it processes data. Which provider handles a given request depends on the feature, and can change among the providers listed there.

AI model providers act only on our instructions, under data processing terms with standard contractual clauses for transfers outside the EU. Each provider's terms prohibit using the content we send to train or fine-tune AI models, and limit how long it is kept to what the provider needs to deliver the request and keep its service secure.

For guest and workspace data the hotel remains the controller, and AI processing happens on its instructions under /legal/dpa. Gmail and Google Workspace data receives the additional protections in the next section.

06Google-API-Daten und eingeschränkte Nutzung (Limited Use)

Die Nutzung und Weitergabe von Informationen, die HotelOS über Google-APIs erhält, entspricht der Richtlinie zu Nutzerdaten der Google-API-Dienste, einschließlich der Anforderungen zur eingeschränkten Nutzung (Limited Use). Diese Richtlinie gilt für Gmail- und Google-Workspace-Daten sowie daraus abgeleitete Daten.

Wenn eine autorisierte Postfachverbindung aktiviert ist, verarbeitet Desk die auf dem Zustimmungsbildschirm genehmigten E-Mail-Inhalte, Konversationsmetadaten und Kontokennungen, um Unterhaltungen anzuzeigen und die von Ihnen aktivierten Kommunikationsfunktionen bereitzustellen, einschließlich KI-gestützter Antwortentwürfe. Berechtigungen und jeder zusätzliche Datenzugriff müssen vor der Autorisierung offengelegt werden. Die Verfügbarkeit hängt von den für die Verbindung erforderlichen Genehmigungen ab.

Google-Nutzerdaten werden weder verkauft noch für Werbung verwendet, an Datenhändler übermittelt oder zur Beurteilung der Kreditwürdigkeit genutzt. Weder HotelOS noch seine KI-Anbieter dürfen Gmail- oder Google-Workspace-Daten verwenden, um allgemeine KI- oder maschinelle Lernmodelle zu trainieren, feinzujustieren oder zu verbessern. Die Verarbeitung für eine aktivierte KI-Funktion ist auf die Bereitstellung dieser Funktion beschränkt und unterliegt vertraglichen Trainingsverboten.

Die Weitergabe ist auf die Bereitstellung oder Verbesserung sichtbarer Funktionen mit Ihrer Zustimmung, Sicherheitszwecke, gesetzliche Verpflichtungen oder einen Unternehmensübergang mit Ihrer vorherigen ausdrücklichen Zustimmung beschränkt. Der Zugriff durch Menschen ist auf Ihre ausdrückliche Zustimmung zu bestimmten Daten, Sicherheitsuntersuchungen, gesetzliche Verpflichtungen oder richtlinienkonforme interne Abläufe mit aggregierten Daten begrenzt.

Verbundene Daten unterliegen den nachstehenden Bestimmungen zu Sicherheit und Aufbewahrung. Ein Widerruf verhindert künftigen API-Zugriff; bereits importierte Datensätze werden dadurch nicht automatisch gelöscht. Sie können den Zugriff von HotelOS auf der Verbindungsseite Ihres Google-Kontos widerrufen. Für Unterstützung bei der Trennung oder zur Löschung gespeicherter Daten wenden Sie sich an [email protected] (dpo at hotelos.ai). Anfragen zu Datensätzen, für die das Hotel verantwortlich ist, werden gemeinsam mit dem Hotel bearbeitet, wie im Abschnitt Your rights und im Auftragsverarbeitungsvertrag beschrieben.

• Richtlinie zu Nutzerdaten der Google-API-Dienste
• Verbindungen des Google-Kontos verwalten

07WhatsApp Business messaging

Where a hotel connects its WhatsApp Business Account to Desk through Meta's Embedded Signup, Desk receives, through the WhatsApp Business Platform, the messages exchanged between the hotel and its guests on that number: the guest's WhatsApp phone number and profile name, message content, timestamps, and delivery and read status. It also stores the WhatsApp Business Account and phone-number identifiers, the hotel's message templates, and an access token issued by Meta, which is kept encrypted in our credential vault.

We use this data only to display, route and answer those conversations for the hotel, to manage its message templates, and for the AI-assisted reply drafts described above. Hotel staff send every WhatsApp reply; Desk does not operate an automated chatbot on WhatsApp. WhatsApp data is not sold, used for advertising, or used to train AI models.

The hotel is the controller of its guest conversations, and HotelOS processes them on its behalf under /legal/dpa. Disconnecting a number in Desk deletes the stored access token and stops new messages; messages already received follow the retention provisions below. To request deletion of stored WhatsApp data, contact [email protected] (dpo at hotelos.ai).

08Cookies, storage and analytics

hotelos.ai and the product applications use a short list of browser storage, all of it first-party:

Essential authentication cookies

Set on hotelos.ai and its application subdomains to keep you signed in, protect against cross-site request forgery, and separate production from staging. They are strictly necessary; the products cannot work without them, and they are not used for tracking.

Local storage preferences

Your chosen language and light or dark theme are kept in your browser's local storage so the site opens the way you left it. They never leave your device.

Product analytics

We use PostHog to understand how the product is used. It is configured for privacy: person profiles are created only for identified, signed-in users, we do not run advertising or cross-site pixels, and IP addresses are used for coarse location and abuse prevention rather than individual tracking.

Where consent is required for analytics, we ask for it and honour a refusal. Browser "do not track" and global privacy control signals are respected as an opt-out of non-essential analytics.

09Who we share data with

We share personal data only with service providers who help us run HotelOS, and only to the extent they need it. Each one is bound by a written contract with confidentiality and security obligations at least as strict as ours, and is security-reviewed before onboarding. The current list, with purpose and location, is published at /legal/subprocessors.

Beyond that, we disclose data only where a customer instructs us to (for example, connecting an integration), where a professional adviser is bound by confidentiality, where a corporate transaction requires it and the acquirer accepts these commitments, or where the law compels us under the process below. Where we are legally permitted to tell you about a compelled disclosure, we will.

10Government and law-enforcement requests

When a government, court, regulator or law-enforcement authority asks us for personal data, we do not produce it automatically. Every such request is handled under the following process, which applies whether we act as controller or as processor:

Legality review

A designated reviewer — typically the founder responsible for data protection, with counsel where the request warrants it — examines the request before any data is disclosed. We check that the issuing body has authority, that the instrument is valid on its face (for example a warrant, subpoena, court order or equivalent legal process), that it identifies the data sought with enough specificity to act on, and that the applicable law actually requires us to comply.

Challenge of unlawful requests

If a request appears unlawful, overbroad, procedurally defective, or outside the issuer's authority, we push back. That includes seeking clarification or narrowing, objecting in writing, and where proportionate pursuing available legal remedies to resist or quash the request. We do not comply with informal or voluntary asks that lack a binding legal basis.

Data minimisation

Where we are compelled to respond, we disclose only the minimum personal data strictly necessary to satisfy the lawful scope of the request. We do not volunteer additional fields, related records, or bulk extracts beyond what the instrument requires.

Documentation

We keep a written record of each request and our handling of it: the instrument received, the date, the requesting authority, the data categories sought, our legal reasoning, whether we challenged or narrowed the request, what (if anything) we disclosed and when, and the people who reviewed and approved the response. Those records are retained for so long as needed to demonstrate compliance and to defend our handling.

Where we are the processor for a customer's workspace data, we also notify the customer of the request before responding, unless the law prohibits that notice or a genuine emergency makes prior notice impossible — in which case we notify as soon as we are permitted. Where we are legally allowed to tell an affected individual about a disclosure of data we control, we will.

11International transfers

The primary database for customer workspaces, and the backups our database provider takes of it, are in the European Union (Frankfurt). Uploaded files and attachments are currently stored in object storage located in Asia-Pacific; we are moving them to EU storage and will update this policy when that is complete. We do not offer a choice of hosting region.

Some support, engineering and administrative access necessarily reaches across borders, and some of our service providers operate in the United States. Where such a transfer leaves the European Economic Area, the United Kingdom or Switzerland, it is covered by the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the Swiss equivalent, together with the supplementary technical measures described in our DPA. Copies of the clauses we rely on are available from [email protected].

12How long we keep it

• Account data is kept for as long as the account exists, and deleted or anonymised within 90 days of the account closing.
• Customer workspace data is kept for the term of the agreement and handled on exit as described in the DPA — exportable during the wind-down window, then deleted.
• Enquiry and correspondence data is kept for up to 24 months from the last exchange, so we can pick up a conversation where it left off.
• Security and access logs are kept for 12 months, except where a longer period is needed to investigate an incident. The administrative audit log inside a customer workspace is kept for the term of the agreement and handled on exit as described in the DPA.
• Financial and tax records are kept for the period the applicable law requires, typically seven years.

13How we protect it

Data is encrypted at rest (AES-256) by our database and storage providers and in transit with TLS 1.2 or later; older TLS versions are refused. Credentials for the systems you connect are kept in an encrypted secrets vault. Access is role-based and least-privilege, scoped to your organisation and property, and sign-in supports multi-factor authentication and passkeys. Administrative and approval actions are written to a hash-chained audit log. Our database provider takes automated daily backups. Customer-managed encryption keys are not offered. Our full security posture, including certification status and known gaps, is published at /trust.

14Your rights

Subject to the law that applies to you, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, provide it in a portable format, or withdraw a consent you previously gave. You may also ask us not to subject you to a decision based solely on automated processing.

Write to [email protected]. We respond within 30 days, and tell you if we need longer. Exercising a right never costs you anything and never degrades your service. If you are unhappy with our answer, you may complain to your local supervisory authority.

If you are a hotel guest and your data sits inside a hotel's HotelOS workspace, the hotel is the controller. Send your request to the hotel; if it reaches us instead, we forward it promptly and help the hotel answer it.

15Breach notification

We commit to notifying affected customers without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting their data, with a written remediation plan inside 14 days. This commitment is codified in every customer DPA, and it applies whether the breach originates with us or with a sub-processor.

16Children

HotelOS is a business tool sold to hotels. It is not directed at children, and we do not knowingly collect personal data from anyone under 16 as controller. A hotel may hold data about a minor travelling as part of a booking; that data is processed on the hotel's instructions under the DPA. If you believe a child's data has reached us in error, write to [email protected] and we will delete it.

17Changes to this policy

We update this policy as the product and our obligations change. The date at the top always reflects the current version. For material changes we email account owners at least 30 days before the change takes effect, so there is time to object or to leave.

18Contact

Island Inventions Inc., San Francisco, California, USA. Privacy and data protection: [email protected]. Security reports: [email protected]. Everything else: [email protected].