Security and data.
Your guests trust you with their names, dates, children’s ages and sometimes their health. This page explains exactly how we handle that trust, in plain words. The legal detail is in the data processing agreement and the privacy notice.
Your accounts, not ours
Drafts are written inside your own mailbox, booking system and AI subscription. Guest data is not copied into Hotelhand systems.
A signed DPA first
We sign a data processing agreement under Article 28 GDPR before we touch anything that contains guest data.
Named access, no shared passwords
We work through a named user you create for us, with the rights the job needs. You can switch it off at any time.
A person approves every message
Nothing reaches a guest or a review site without your Approve. The Monday report is the only thing sent on its own, and only to you.
Business AI plans only
Guest data goes only into business or API plans of the AI provider that do not train on your content by default and offer a DPA. Never into personal accounts.
Minimum data
Automations read what a reply needs. Passport, card and payment details are never part of a prompt.
The facts, in one table.
Ask us for anything that is not here. We answer in writing.
| Company | MARK Inc Ltd, Sofia, Bulgaria (EU), VAT BG206058140 |
|---|---|
| Applicable law | GDPR (EU) 2016/679; EU AI Act transparency rules for AI-drafted content |
| Role in your hotel | Processor, under a written DPA (Art. 28 GDPR) |
| Where drafts are written | In your own mailbox and AI subscription |
| Human approval | Every guest message and review reply |
| Model training on your data | No, and business terms configured to exclude it |
| Website data storage | Cloudflare, EU jurisdiction; backups in the EU |
| Our own access | Two-factor sign-in, named users only |
| Website | HTTPS only with HSTS, bot protection on forms, no tracking or advertising cookies |
| Service providers | Cloudflare, Google, Stripe, Skool, and the AI providers named in your DPA. Full list in the privacy notice |
| Transfers outside the EU | EU–US Data Privacy Framework or standard contractual clauses |
| The DPA | Sent on request before you buy, and signed before we start |
Questions owners ask.
For a copy of the DPA, write to [email protected].
Who is the controller and who is the processor?
You are the controller of your guests’ data. When we set up or run Hotelhand in your hotel, MARK Inc Ltd acts as your processor under the data processing agreement. For the data we collect on this website, MARK Inc Ltd is the controller; see the privacy notice.
Which AI provider sees guest data?
The one you subscribe to, under your own business or API account: typically ChatGPT Business or Claude Team, or the API of OpenAI or Anthropic. The DPA lists the exact configuration for your hotel.
Do you train AI models on my data?
No. We do not train models, and we configure your tools so that your content is not used for training by the provider wherever business terms allow it.
Where is data from this website stored?
Free-check requests are stored with Cloudflare in its EU jurisdiction, with backups in the EU. Access is limited to Hotelhand staff signing in with two-factor authentication.
What happens when I leave?
You remove our user from your systems; the automations stay yours. At the end of the agreement we delete or return your data as the DPA sets out, except records we must keep by law, such as invoices.
What if something goes wrong?
We tell you without undue delay if we become aware of a personal data breach affecting your data, with what happened, what data is affected and what we are doing about it, so you can meet your own obligations.
Read more.
The EU AI Act transparency rules
What Article 50 means for hotel emails, chatbots and review replies.
Start with the free check.
Paste your website. Within 24 hours you know what AI assistants say about your hotel and the three fixes that matter most.