Privacy Policy

Last updated: 13 October 2026. Template — the operator must fill in the bracketed items before publishing.

1. Who we are

HotelBot ("we") is operated by [OPERATOR NAME, ADDRESS, CONTACT EMAIL]. For hotel guests, the hotel you message is the data controller; HotelBot acts as its data processor. For hotel owners using the app, HotelBot is the controller of account data.

2. What we process

• Guests: WhatsApp phone number and profile name, message contents, booking details (dates, guests, room, price, special requests), language. We do not collect or store copies of ID documents. If the hotel enables the Turkish KBS helper, the hotel may enter ID number, nationality and birth date for legally required police reporting.
• Hotel owners: name, email, Google account ID (if you sign in with Google), property settings, device push token, subscription status from Google Play.

3. Why (legal bases)

• Answering enquiries and handling bookings — steps prior to/performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Legal obligations such as guest registration (Art. 6(1)(c); KVKK 5(2)(ç)).
• Marketing messages only with explicit consent, recorded per guest (Art. 6(1)(a); in Turkey registered in İYS).

4. Processors and transfers

Meta Platforms (WhatsApp Business Platform), Cloudflare (hosting, database, storage), Google (sign-in, Play Billing, Firebase Cloud Messaging) and, if enabled, an AI text provider used only to interpret free-text questions (no data is used to train models where the provider allows opting out). Data may be processed outside your country under Standard Contractual Clauses or equivalent safeguards.

5. Retention

Conversations are deleted automatically after the period set by the hotel (default 730 days). Booking records are kept as long as required by tax/accounting law, then anonymised. Accounts are deleted on request.

6. Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent; in Turkey the rights under KVKK Art. 11. Guests: contact the hotel, which can export or delete your data in one tap; or write to [CONTACT EMAIL]. You may complain to your supervisory authority (in Turkey: KVKK Kurumu).

7. Security

Encryption in transit (TLS), WhatsApp access tokens encrypted at rest (AES-GCM), hashed passwords, per-hotel data isolation and audit logs.

8. Account deletion

Owners can delete their account in the app: More → Privacy → Delete my account, or by emailing [CONTACT EMAIL].

← HotelBot