Privacy Policy

1. Application and Scope

This Policy applies to information we process about visitors, guests, applicants, employees and staff, vendors and contractors, and other individuals who interact with the Services. It does not apply to any third-party product, website, or service that we do not control, even where the Services link to or integrate with it.

The Services are used by hospitality businesses ("Client Organizations") who license the platform to run their operations. Where a Client Organization uses the Services, that organization determines what information is collected and why, and this Policy applies to our handling of that information as a service provider and processor on their behalf. See Section 2.

2. Our Role: Controller and Processor

When we act as controller. For our own websites, marketing, account administration, platform security and analytics, GuestLogic acts as a data controller and decides how and why information is processed.

When we act as processor / service provider. When we host and process data on behalf of a Client Organization — for example, that organization's guest reservations, staff records, or applicant data — GuestLogic acts as a processor and service provider, and the Client Organization is the controller. In that role we process such information under our agreement with the Client Organization and on their instructions. If you interact with a property or business that uses GuestLogic and wish to exercise privacy rights over the data that business holds, please direct your request to that business, which is the controller of that data. We will provide reasonable assistance to the controller as required by law, but we are not obligated to independently respond to, verify, or act on such requests where another organization is the controller.

3. Information We Collect

We collect information directly from you, automatically through your use of the Services, and from Client Organizations, our affiliates, and other sources. The categories we may collect include:

• Identifiers and contact data: name, email address, postal address, phone number, username, and account or reservation identifiers.
• Guest and reservation data: booking and stay details, arrival/departure dates, room or unit assignments, party details, special requests, government-ID and check-in information (including ID photos where you submit them), loyalty or membership details, and communications with a property.
• Payment and financial data: payment-card tokens, authorization details, billing information, and transaction records. We use tokenization and third-party payment processors; we do not store full card numbers on our own systems.
• Employment and applicant data: name, contact details, wage and pay data, hours and scheduling, role and department, work authorization, and — where legally required for payroll or compliance — government identifiers such as a Social Security Number.
• Vendor and contractor data: business contact details, service scope, quotes, and related correspondence.
• Device, log, and usage data: IP address, device and browser type, operating system, pages and features viewed, links clicked, session duration, referring pages, and diagnostic and performance data, collected automatically including through cookies and similar technologies.
• Content you submit: form entries, uploaded files and photos, notes, messages, and any other information you choose to provide.

You may choose not to provide certain information, but some features of the Services may not be available to you as a result. Information that is aggregated, anonymized, or de-identified is not treated as personal information under this Policy, and we may create and use such data without restriction.

4. How We Use Information

We may use the information we collect for any of the following purposes:

• Provide and operate the Services: deliver, maintain, and administer the platform; process reservations, payments, payroll, and other operations; and communicate with you about your use of the Services.
• Improve and develop: understand how the Services are used; debug, secure, and improve existing features; and research, develop, and launch new products and features.
• Analytics and aggregation: compile statistics, benchmarks, and aggregated or de-identified datasets, which we may use and share for any lawful business purpose, including improving and marketing the Services.
• Personalize: tailor content, defaults, and recommendations to your role, property, and prior activity.
• Communicate: send transactional, service, security, and (where permitted) marketing messages, and respond to your inquiries.
• Protect and comply: detect, prevent, and address fraud, abuse, security, and technical issues; enforce our terms and this Policy; establish, exercise, or defend legal claims; and comply with applicable law and lawful requests.

We may combine information from different sources and interactions to support the purposes above, and we reserve broad discretion to use the information we collect for any purpose compatible with those described here or otherwise permitted by law.

5. How We Share Information

We may share information as follows:

• Client Organizations: where you interact with a business that uses the Services, we share relevant information with that business, which controls it.
• Service providers: we share information with vendors, contractors, hosting, payment, messaging, analytics, and other providers who process information on our behalf under our instructions.
• Affiliates: we may share information with our affiliates and subsidiaries for the purposes described in this Policy.
• Business transfers: if we are involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, we may transfer information as part of that transaction or diligence.
• Legal and protection: we may share information to comply with law, legal process, or lawful government requests, and to protect the rights, property, safety, and security of GuestLogic, our users, and others.
• With your direction or consent: we share information as you direct or otherwise consent.

We may also share aggregated, anonymized, or de-identified information, which does not identify you, for any lawful purpose.

6. Service Providers We Use

We use service providers to run the Services: hosting and data storage, sign-in, e-mail and text-message delivery, payments and point of sale, business e-mail, calendars and chat, and counting visits to our public pages (see Section 9). Each processes personal information only to provide its service to us.

Measuring event ticket ads. When a business runs its event ticket sales with us, we receive each order from its ticket website (the buyer's name, e-mail and the tickets bought). To learn which ads led to a sale, we send the advertising platforms that business uses the order number and value, the internet address and browser type the buyer used on the ticket page, and scrambled (hashed) copies of the buyer's contact details, which they match against their own accounts. We do not send the name or e-mail in readable form.

7. Summary of Information Practices (Last 12 Months)

The following summarizes the categories of personal information we collect, the purposes for which we use them, and the categories of third parties with whom we may share them.

8. We Do Not Sell Your Personal Information

We do not sell your personal information for money, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding 12 months. Our sharing of information with service providers and Client Organizations to operate the Services is not a "sale." If this ever changes, we will update this Policy and provide any rights and choices required by law.

9. Cookies and Similar Technologies

A cookie is a small text file stored on your device. We use two kinds.

Needed to run the Services. When you sign in, your browser keeps a sign-in token so you stay signed in, and it remembers a few choices, such as your cookie choice itself. These are always on; the Services do not work without them.

Visit counting on our public pages, only if you agree. On our public pages (the home page, sign-up, job and application pages, public inquiry forms, and these policies) we use Google Tag Manager (container GTM-W29KHNQM) to load Google Analytics, which counts page views and a few anonymous actions, such as pressing "Get started". It is never loaded on a signed-in screen or on a page reached through a private link, and it is loaded only after you press Accept on the cookie banner. Your choice is kept in your browser. You can change it at any time: Cookie settings.

We are not required to respond to browser "Do Not Track" signals and currently do not.

10. Third-Party Links and Services

The Services may link to or integrate with third-party sites and services that we do not control. This Policy does not govern those third parties, and we are not responsible for their information practices. Review their privacy policies before providing information to them.

11. Retention

We retain personal information for as long as we determine necessary to provide the Services, operate our business, and fulfill the purposes described in this Policy, and for additional periods to comply with legal, tax, accounting, and regulatory requirements, resolve disputes, enforce our agreements, and maintain backups and records. We set retention periods in our discretion based on these factors. Where we process information on behalf of a Client Organization, retention is governed by that organization's instructions and our agreement with it. When no longer needed, information is deleted, anonymized, or de-identified.

12. Security

We use reasonable technical and organizational measures designed to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, and destruction. However, no method of transmission or storage is completely secure, and we cannot and do not guarantee the security of your information. You are responsible for safeguarding your account credentials and for activity that occurs under your account, and you use the Services at your own risk. To the fullest extent permitted by law, we are not liable for unauthorized access to or use of information that occurs despite our reasonable measures.

13. Your Choices and Access

You may update certain account information by signing in to the Services. You may opt out of marketing emails using the unsubscribe link in those messages; we may still send transactional and service messages. Where we act as a processor for a Client Organization, please direct requests to access, correct, or delete your information to that organization, which controls it (see Section 2). Copies of information may remain in backups or archives for a period of time after deletion.

14. California Privacy Rights (CCPA/CPRA)

If you are a California resident, and subject to legal exemptions, you may have the right to: (a) know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it; (b) request deletion of your personal information; (c) request correction of inaccurate personal information; and (d) not be discriminated against for exercising these rights.

To make a request, contact us at privacy@guestlogic.ai. We will verify your request using the information we hold, and may decline requests that are unverified or subject to a legal exception (for example, where retention is necessary to complete a transaction, comply with law, or protect against fraud or security threats). Where the personal information is controlled by a Client Organization, we will refer your request to that organization. An authorized agent may submit a request with proof of authorization.

15. EU/UK/EEA Data Subjects (GDPR)

Where the EU or UK GDPR applies and GuestLogic is the controller, we process personal information on one or more of the following legal bases: performance of a contract with you; our legitimate interests in operating, securing, and improving the Services (balanced against your rights); your consent, where requested (which you may withdraw at any time); and compliance with our legal obligations.

Subject to conditions and exemptions, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, and to data portability. Where GuestLogic acts as a processor for a Client Organization, that organization is the controller and such requests should be directed to it; we will assist the controller as required. To contact us, use privacy@guestlogic.ai. You also have the right to lodge a complaint with your local supervisory authority.

16. International Data Transfers

We are based in the United States and process and store information there and in other countries where we or our providers operate. These countries may have data-protection laws that differ from those in your location. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers. By using the Services, you understand that your information may be transferred to and processed in the United States and elsewhere.

17. Children's Privacy

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children under 16 without appropriate consent. If you believe a child has provided personal information to us, contact privacy@guestlogic.ai and we will take reasonable steps to delete it.

18. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above, and material changes will take effect when posted or as otherwise required by law. Your continued use of the Services after an update constitutes acceptance of the revised Policy.

19. Contact Us and Governing Law

If you have questions about this Policy or our privacy practices, contact:

Guest Logic LLC
4675 N Tamiami Trail, Unit P
Sarasota, FL 34234, USA
privacy@guestlogic.ai

This Policy and any dispute relating to it or to the Services are governed by the laws of the State of Florida, USA, without regard to its conflict-of-laws rules, and you agree to the exclusive jurisdiction of the state and federal courts located in Florida, to the fullest extent permitted by law.