It is the most common shortcut in small hotels: a guest email arrives, someone copies it into ChatGPT, asks for a reply, and pastes the answer back. It works, and it is also the moment guest data leaves your systems.
This piece explains what that means under the GDPR and what a sensible setup looks like. It is practical guidance, not legal advice; for your own situation, ask your lawyer or data protection adviser.
What is in a guest email
A typical enquiry contains a name, an email address, travel dates, the number and ages of children, sometimes a phone number, and occasionally things that are more sensitive: an allergy, a wheelchair, a pregnancy, a reason for travelling. All of it is personal data. Health details are a special category under the GDPR and need extra care.
As the hotel, you are the controller of that data. Any service that processes it on your behalf, from your booking system to an AI tool, is a processor, and the GDPR expects a written agreement with each processor: a data processing agreement, or DPA.
Personal account versus business plan
The difference is not the AI model. It is the terms you accept.
Personal ChatGPT accounts (Free, Plus, Pro): OpenAI’s help centre says conversations may be used to improve its models unless you turn off “Improve the model for everyone” in Settings → Data controls. There is no data processing agreement with your hotel.
ChatGPT Business, Enterprise and the API: OpenAI states that by default it does not use inputs or outputs from these services to train its models, and that it can sign a data processing addendum for ChatGPT Business, Enterprise and the API in support of GDPR compliance.
Other providers draw a similar line between consumer and business offers. Check the current terms of whichever tool you use before you put guest data into it.
In practice: a member of staff using a personal account for guest emails is the setup to avoid. A business plan with a signed DPA, used by named staff, is the setup you can defend.
A short policy for your team
Five rules cover most of it:
- Business accounts only. No guest data in personal AI accounts, on any device.
- A DPA with every tool that sees guest data: booking system, email, AI provider, and any service that sets these up for you.
- Minimum data. If the reply does not need the guest’s phone number or passport details, do not paste them.
- No special-category data without need. Allergies and accessibility needs are often necessary for the reply; a diagnosis rarely is.
- A person approves every message before it reaches a guest. This is good service as well as good practice.
Add the AI provider to the list of processors in your privacy notice, and keep a one-page record of which tools process guest data and why.
Where Hotelhand stands
We sign a DPA with every client before we touch anything. Drafts are written inside the client’s own accounts (their mailbox, their AI subscription), so guest data is not copied to ours, and nothing is sent to a guest without the owner’s approval.
Sources
- OpenAI Help Center: Data controls in ChatGPT
- OpenAI Help Center: How your data is used to improve model performance
- OpenAI: Enterprise privacy
- EUR-Lex: General Data Protection Regulation (EU) 2016/679, Articles 9 and 28
Read on 4 November 2026. This article is general information and not legal advice.
