GuestPoint Hospitality
Privacy Policy
This policy explains what personal data GuestPoint Hospitality handles on this website and in the GuestPoint platform — the guest app and staff app that hotels use — why, and what choices you have.
Last updated: 2 October 2026
1. Who we are
GuestPoint Hospitality ("GuestPoint", "we", "us") provides a digital guest experience platform for hotels. You can reach us about anything in this policy at support@guestpointhospitality.com.
For this website and for our own business contacts, we decide how personal data is used (we are the controller). For data processed in the GuestPoint guest and staff apps, the hotel you are staying at or working for is the controller and we process the data on its behalf and on its instructions (we are its processor) — see section 4.
2. This website
Demo requests and emails
When you use the demo request form or email us, we receive the information you provide:
- your name, hotel or company name, business email address and country;
- your property's number of rooms and what you are interested in;
- anything you write in your message.
We use it only to reply, arrange a demonstration, understand your hotel's requirements and follow up about GuestPoint. The legal basis is our legitimate interest in responding to business enquiries, or steps taken at your request before entering into a contract. We do not sell personal data and do not add you to a newsletter without asking.
Server logs
Like any website, our hosting provider automatically records technical data such as IP address, browser type and the pages requested, to deliver the site and keep it secure.
3. Cookies and analytics
This website uses Google Analytics to understand, in aggregate, how visitors find and use the site. Analytics cookies are only set if you click "Accept analytics" in the cookie banner. Until then, Google Analytics runs in a cookieless, consent-denied mode. You can change your choice at any time with the "Cookie settings" link at the bottom of every page.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Google Analytics | Distinguish visitors and sessions for statistics (only with consent) | Up to 2 years |
| gp_consent (local storage) | GuestPoint | Remember your cookie choice | Until you clear it |
We have enabled IP anonymisation. Google may process this data in countries outside the EU/EEA under the safeguards described in Google's own privacy terms.
4. The GuestPoint platform (guest app and staff app)
Hotels use GuestPoint to let guests browse hotel information and send requests from their phone, and to let staff handle those requests. The platform is designed to work with as little personal data as possible: guests do not create an account and are not asked for their name, email address, phone number or payment details.
Guests
| Data | Why |
|---|---|
| Room number and the PIN given by the hotel (the PIN is stored only as a secure hash) | To confirm the guest is staying in that room before requests can be sent |
| Requests and orders (what was asked for, notes, preferred dates/times, items and prices from the hotel's menu) and their status history | To deliver the service and show the guest its progress |
| Stay survey answers and comments | To give the hotel feedback while the guest is still in house |
| Prize wheel spins and voucher codes, and when a voucher is redeemed | To run the hotel's rewards and prevent a voucher being used twice |
| A notification token for the device — only if the guest turns notifications on | To send updates about requests, new events and offers, and a survey reminder |
| A session token stored in the browser | To keep the guest signed in to their room until checkout |
Access to a room ends automatically at checkout, or earlier if the hotel gives the room a new PIN. Guests can turn notifications off at any time in their browser or phone settings.
Hotel staff
For staff accounts we process name, work email address, role, department, sign-in credentials (managed by Amazon Cognito; we never see passwords in plain text), the actions taken on requests (who changed what and when), voucher redemptions, and — if notifications are enabled — a device notification token.
Who decides
The hotel is responsible for this data and for informing its guests and staff. If you are a guest or staff member and want to exercise your rights, please contact the hotel; we will help the hotel respond. You may also contact us and we will forward your request.
5. Service providers
We use carefully selected providers that process data on our behalf:
- Amazon Web Services (EU region Stockholm, eu-north-1) — hosting, database, file storage and staff sign-in for the GuestPoint platform.
- Google Firebase Cloud Messaging — delivery of phone notifications, only for devices where notifications were turned on.
- FormSubmit — delivery of messages sent through this website's demo request form to our inbox.
- Google Analytics — website statistics, only with your consent.
- Our website hosting provider — serving this website.
Where a provider processes data outside the EU/EEA, this happens under appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Demo requests and business emails: for as long as needed to handle the enquiry and any resulting business relationship, and no longer than 3 years after our last contact unless the law requires otherwise.
- Platform data: for the duration of the hotel's agreement with us, or shorter if the hotel instructs us. At the end of the agreement we delete it or return it to the hotel. Earlier versions of hotel content are kept for 90 days; technical logs for 30 days.
- Analytics data: kept for no longer than 14 months, according to our Google Analytics retention setting.
7. Security
All traffic is encrypted with HTTPS. PINs are stored as salted hashes, repeated wrong PIN attempts temporarily lock the room, staff access is personal and role-based and can be withdrawn immediately, and secrets are kept in a managed key store. No system is perfectly secure, but we work to protect data against loss and unauthorised access.
8. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, have it corrected or deleted, restrict or object to its use, receive it in a portable format, and withdraw consent at any time (for example to analytics cookies). To exercise these rights, email support@guestpointhospitality.com. You also have the right to complain to your local data protection authority.
9. Children
This website is aimed at hotel businesses. The guest app may be used by guests of any age staying at a hotel, but it does not ask for personal details. We do not knowingly collect personal data from children through this website.
10. Changes and contact
We may update this policy as our services evolve. The date at the top shows the latest version. Questions? Email support@guestpointhospitality.com.