Privacy

Last updated: October 5, 2026.

This Privacy Policy explains the handling of personal information in the GuestTrust website, booking application, guest accounts, property dashboards and support services. It covers visitors, guests, property account holders and their authorized team members.

GuestTrust handles information needed to operate platform accounts, security, subscriptions and support. Accommodation providers also use the platform to handle reservations and stays, and determine the purposes of their own guest records. Their privacy notices may apply alongside this Policy. A request concerning property-managed data may require coordination with the property.

Depending on the account and fields you complete, we collect names, email addresses, phone numbers, country, address, document type and identification number. Property accounts also include business or workspace details, team roles, invitations and access permissions.

Password-based accounts use password hashes. The service also keeps verification and invitation records, sign-in provider identifiers, session records, expiry and revocation information, and relevant account timestamps.

When you choose Google or Apple sign-in, we receive the identity information made available for that sign-in, such as a provider identifier, verified email address and name where supplied. We do not receive your Google or Apple password. Those providers handle information under their own privacy terms.

Booking information includes guest names and contact details, property and room selection, stay dates, number of adults and children, selected extras, pricing, currency, discounts, booking reference and status. It can also include notes, cancellation reasons, payment references and check-in or check-out records.

Property teams may add guest contact and identification details, room assignments, charges and other operational records needed for the stay. Information about accompanying guests or children may be provided by the adult making the reservation or by authorized property staff.

Only provide information you are entitled to share. Avoid putting unnecessary sensitive information in booking notes, support messages or other free-text fields. Contact the property about identification information it requires for accommodation or legal reporting.

Payment and subscription records include the payer's email, transaction and provider references, amount, currency, status, billing cycle, selected plan, renewal settings and relevant authorization records.

Wompi processes payment credentials and card tokenization. GuestTrust's application database stores payment source references, token hashes, card brand, last four digits and authorization records; it is not designed to store reusable full card numbers or card security codes.

When you authorize card saving or recurring subscription payments, the service records the relevant acceptance and authorization details. Removing a saved card disables its future use in that flow, subject to pending transactions and renewal settings, but does not erase completed financial records.

The payment provider's personal data authorization and privacy terms are presented in the payment flow and also govern its handling of information.

When you submit an available support form, we collect your name, email, audience or account type, topic, subject and message. A request may include a booking reference or property name. Support staff use these details to investigate and respond.

The application's support form stores requests in a private support inbox. A successful submission does not itself mean that a reply email has been sent. The service also records whether requests are open or closed.

The Help Center stores an anonymous browser identifier and your helpful or not-helpful response to an article. This helps record feedback and avoid duplicate votes from the same identifier. Do not include payment credentials or account secrets in a support request.

The service processes request and device information as needed for authentication, security and operation, including IP addresses used for request limits, browser or device descriptions for dashboard sessions, and relevant activity and error records. Audit records can include the user responsible for an action, the affected record, its time and operational details.

The booking application uses cookies for guest and administrator sessions, temporary sign-in flows, selected property, language, currency and recent destinations. For example, its language preference cookie is configured for one year and its recent-destination cookie for 90 days; other cookie lifetimes depend on their purpose.

Checkout may use browser session storage for temporary access to a payment flow. The Help Center uses local storage for its feedback identifier, which remains until removed from the browser. Clearing browser storage or blocking necessary cookies can affect sign-in, preferences, checkout or feedback.

The reviewed GuestTrust website and application code do not include a configured advertising pixel or third-party analytics tracker. This statement concerns those implementations; external sites, payment pages and sign-in providers may use their own technologies and notices.

We use the relevant information to create and secure accounts, verify identity during sign-in, manage permissions, search availability, confirm and manage reservations, support property operations, process payments and subscriptions, and deliver related service messages.

Information also supports customer assistance, payment reconciliation, usage accounting, troubleshooting, prevention of misuse, and investigation of disputed or unauthorized activity.

Where applicable law requires a legal basis or authorization, processing must use the basis appropriate to the purpose, such as providing the requested service, meeting a legal obligation, a permitted legitimate interest, or consent. These bases are not interchangeable, and this Policy is not a blanket consent to unrelated processing. Withdrawal of consent does not undo processing that was lawful before withdrawal.

AI features are available only to accounts for which they are enabled. GuestTrust stores AI conversations, responses, proposals, suggestion records and usage information so authorized users can access their history and review proposed changes.

When OpenAI-backed features are enabled, the service sends prompts, a limited amount of conversation history and relevant property context to OpenAI. Analytics and suggestion requests can include property names, room details, rates, promotions and operational aggregates. If you enter guest names, email addresses or other personal information while preparing an operational action, that information can also appear in the prompt or conversation sent to the provider.

Do not assume that AI conversations are anonymous, and do not send passwords, full card details, verification codes or unnecessary identification information. The integration requests that Responses API outputs are not stored through its response-storage feature; this does not mean the provider has no other security or operational retention.

AI proposals require a separate authorized confirmation before supported changes are applied. Conversation access is scoped by account and permissions; property suggestion records may be shared with the relevant property's authorized team.

The accommodation provider and its authorized staff receive the booking and operational information needed to manage the stay. Workspace administrators and authorized users receive information appropriate to their roles.

The service uses providers for hosting and databases, website content, payment processing, email delivery and optional sign-in and AI features. The reviewed integrations include Prismic for website content, Wompi for payments, Resend for service emails, Google and Apple for chosen sign-in methods, and OpenAI when its AI features are enabled. The information sent depends on the function: using Prismic for content does not by itself send it your reservation records.

Relevant information may also be disclosed when required by applicable law or a valid legal request, or when necessary and lawful to investigate fraud, protect accounts, resolve a payment dispute or defend legal rights. A property's separate uses of guest records are governed by its own obligations and notice.

Service providers may process information in countries different from the country where you or the property are located. Locations and processing arrangements depend on the provider and the service configuration.

Applicable data protection rules may require authorization, contractual terms or other protections for international processing. Contact GuestTrust support to request information about the processing locations and arrangements relevant to your data.

Different records have different retention needs. Relevant criteria include the duration of an account or stay, completion of payments and refunds, support follow-up, security investigations, unresolved disputes and any applicable accounting or legal recordkeeping obligation.

Session and verification credentials have expiry or revocation controls, but expiry of a credential is not the same as deletion of its database record. Similarly, signing out, cancelling a subscription or removing a card does not automatically erase reservations, payment history, support messages or audit records.

Some property and account records can be deactivated or archived while remaining stored. Contact support to request deletion or information about the retention period applicable to a particular record. Property-managed records may require a request to the property, and information may need to remain where a lawful retention obligation or unresolved transaction applies.

You can update available profile details in your account, manage saved cards, sign out, and change available preferences. Authorized property users can manage team access and subscription renewal settings. Disabling a feature may affect the related service.

Depending on applicable law, you may have rights to know or access your information, correct it, request deletion, obtain information about an authorization, withdraw consent, object to or restrict certain processing, or receive a copy in an available format. These rights have conditions and exceptions and do not necessarily require deletion of legally retained records.

Use Contact support in the GuestTrust booking application or its Help Center to make a privacy request. State that it is a privacy request, identify the account or booking concerned, and describe what you need. We may request proportionate identity verification to protect the account; do not send passwords, verification codes or full card details.

For a request about a property's own guest or stay records, you can also use the property's published contact details. Responses must follow the deadlines and procedures required by applicable law. You may raise a concern with the competent data protection authority where that right applies.

The application uses access permissions, password hashing, expiring or revocable sessions, limited-use verification flows and payment tokenization to protect relevant information. Security also depends on correct deployment and operation; no online service can guarantee that every risk is eliminated.

Protect your device and private links, use a strong password, and notify support if you suspect an account or booking has been accessed without permission.

GuestTrust is not intended for children to independently open accounts or purchase services. Adult guests and property staff may provide information about accompanying children where needed for a stay. They must have authority to do so, and any handling of that information must meet applicable protections for children.

We may update this Policy to reflect changes in the service or its handling of information. The date above identifies this version. Where required, material changes must be communicated and any necessary new authorization obtained before using information for a new purpose.

For privacy questions and requests concerning GuestTrust, use Contact support in the booking application or its Help Center. Property-specific privacy questions can also be sent to the accommodation provider using the contact details published for that property.