Privacy Policy

GARCIA&MAISEL
1985 Riviera Dr, Ste 103, Num 1018
Mount Pleasant, SC 29466, United States

Data Protection Officer (DPO): Álvaro García — [email protected]

• Hotel guests: name, email and phone, when the hotel uploads or syncs them with the platform.
• Hotel users: name, corporate email and role within the property.
• Browsing data: cookies, IP address, browser type, visited pages and basic usage events.

• Provide the SaaS service contracted by the hotel client.
• Send marketing communications, only with prior consent of the recipient.
• Handle customer support requests.
• Improve the product and develop new features.
• Aggregate analytics on website and application usage.

• Performance of contract with the hotel client to provide the service.
• Legitimate interest for security, fraud prevention and product improvement.
• Explicit consent for marketing communications and non-essential cookies.

We use Google Analytics 4 (GA4) for analytical purposes to understand on an aggregate basis how our site is used. You can manage and revoke cookie consent at any time from your browser settings.

We retain data for the duration of the contractual relationship with the hotel client and for applicable legal periods. Data processed for marketing purposes is retained until the user revokes consent.

You may exercise at any time the rights of access, rectification, erasure, restriction, objection and portability over your personal data, and withdraw any previously granted consent.

To exercise them, write to [email protected] or use the form at /en/delete-my-data.

On behalf of hotel clients, GuestBrain manages communications with guests through the following channels:

• WhatsApp: via the official WhatsApp Business API from Meta Platforms, Inc. Messages are sent through Meta's infrastructure and are also subject to its terms and privacy policies.
• Email: transactional notifications and, where applicable, marketing communications.
• SMS: operational messages and reminders related to the stay.

These messages are sent only to guests who have given prior consent to the hotel to be contacted through these channels, or when the communication is strictly necessary for the service booked (for example, booking confirmation, check-in or stay information). Recipients can revoke consent or opt out at any time by replying on the channel itself or writing to [email protected].

GuestBrain acts as a data processor for the hotel client, which is the controller of the guest relationship and responsible for obtaining consent.

GARCIA&MAISEL may use the business email, name and phone of hotel professionals we contact, or who request information through our forms or ads, to show them GuestBrain ads on Facebook and Instagram (Meta Platforms, Inc.) and to measure which contacts become customers. This applies only to contacts in the countries where we advertise, currently Mexico.

• We only share an encrypted fingerprint (SHA-256 hash) of the email, name, phone and country, never the readable data. Meta uses it to match accounts and then discards it.
• For people who fill in our ad forms, we tell Meta the stage they reach with us (for example, meeting or customer) using Meta's contact ID, so that ads reach similar professionals.
• With that encrypted list Meta may build an audience of people with a similar profile (lookalike audience); we receive no data about those people.
• Legal basis: our legitimate interest in promoting GuestBrain to hotel businesses.

You can object at any time by writing to [email protected] or using the unsubscribe link in our emails: you will be removed from these lists within 24 hours.

To provide the service we rely on technology providers acting as processors under contract:

• Cloud infrastructure (hosting and database).
• Transactional and marketing email (sending providers).
• Web analytics (Google Analytics 4).
• Guest messaging: Meta Platforms, Inc. (WhatsApp Business API) and SMS providers.
• Advertising: Meta Platforms, Inc. (Facebook and Instagram ads; encrypted fingerprints only, see section 9).
• AI models: AI model providers powering the platform's AI features.

We do not sell personal data to third parties.

Some providers may be located outside the European Economic Area. For European residents, in such cases we apply standard contractual safeguards (EU Commission standard clauses) and additional measures where needed.

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss or alteration: access control, encryption in transit, backups and activity logging. No measure guarantees absolute protection, so we maintain ongoing review processes.

We may update this policy to reflect legal or service changes. We will publish the date of the last update at the top of the document.