Privacy Policy

GARCIA&MAISEL
1985 Riviera Dr, Ste 103, Num 1018
Mount Pleasant, SC 29466, United States

Data Protection Officer (DPO): Álvaro García — algarcia@hotelbrain.io

• Hotel guests: name, email and phone, when the hotel uploads or syncs them with the platform.
• Hotel users: name, corporate email and role within the property.
• Browsing data: cookies, IP address, browser type, visited pages and basic usage events.

• Provide the SaaS service contracted by the hotel client.
• Send marketing communications, only with prior consent of the recipient.
• Handle customer support requests.
• Improve the product and develop new features.
• Aggregate analytics on website and application usage.

• Performance of contract with the hotel client to provide the service.
• Legitimate interest for security, fraud prevention and product improvement.
• Explicit consent for marketing communications and non-essential cookies.

We use Google Analytics 4 (GA4) for analytical purposes to understand on an aggregate basis how our site is used. You can manage and revoke cookie consent at any time from your browser settings.

We retain data for the duration of the contractual relationship with the hotel client and for applicable legal periods. Data processed for marketing purposes is retained until the user revokes consent.

You may exercise at any time the rights of access, rectification, erasure, restriction, objection and portability over your personal data, and withdraw any previously granted consent.

To exercise them, write to algarcia@hotelbrain.io or use the form at /en/delete-my-data.

On behalf of hotel clients, GuestBrain manages communications with guests through the following channels:

• WhatsApp: via the official WhatsApp Business API from Meta Platforms, Inc. Messages are sent through Meta's infrastructure and are also subject to its terms and privacy policies.
• Email: transactional notifications and, where applicable, marketing communications.
• SMS: operational messages and reminders related to the stay.

These messages are sent only to guests who have given prior consent to the hotel to be contacted through these channels, or when the communication is strictly necessary for the service booked (for example, booking confirmation, check-in or stay information). Recipients can revoke consent or opt out at any time by replying on the channel itself or writing to algarcia@hotelbrain.io.

GuestBrain acts as a data processor for the hotel client, which is the controller of the guest relationship and responsible for obtaining consent.

To provide the service we rely on technology providers acting as processors under contract:

• Cloud infrastructure (hosting and database).
• Transactional and marketing email (sending providers).
• Web analytics (Google Analytics 4).
• Guest messaging: Meta Platforms, Inc. (WhatsApp Business API) and SMS providers.
• AI models: OpenAI and other model providers powering the platform's AI features.

We do not sell personal data to third parties.

Some providers may be located outside the European Economic Area. For European residents, in such cases we apply standard contractual safeguards (EU Commission standard clauses) and additional measures where needed.

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss or alteration: access control, encryption in transit, backups and activity logging. No measure guarantees absolute protection, so we maintain ongoing review processes.

We may update this policy to reflect legal or service changes. We will publish the date of the last update at the top of the document.