Privacy Policy

StayPilot ("we", "us", or "our") operates the StayPilot hotel management platform at staypilot.com and related services (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information about you when you use our Service.

By using StayPilot, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

When you register for or use StayPilot, we may collect:

• Account information: name, email address, password (stored hashed)
• Hotel profile details: hotel name, address, phone number, website
• Billing information: credit card details (processed via Stripe; we do not store card numbers)
• Communications you send us via email or contact forms

When hotel operators use our platform to manage bookings, we process guest data on your behalf as a data processor. This may include guest names, email addresses, phone numbers, and booking details. You, the hotel operator, are the data controller for this information.

When you access the Service, we automatically collect:

• Log data: IP address, browser type, pages visited, time and date, referring URL
• Device information: device type, operating system, browser version
• Usage data: features used, session duration, click patterns
• Cookies and similar tracking technologies (see our Cookie Policy)

We use the information we collect to:

• Provide, maintain, and improve the StayPilot platform
• Process transactions and send billing confirmations
• Send service notifications, security alerts, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze usage patterns and trends to improve the Service
• Detect, investigate, and prevent fraudulent transactions and other illegal activities
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for behavioral advertising targeting.

We share your information only in the following circumstances:

• Service Providers: We work with third-party vendors (e.g., Stripe for payments, SendGrid for email delivery, AWS for hosting) who process data on our behalf under strict data processing agreements.
• Legal Requirements: We may disclose information if required by law, court order, or government authority, or to protect the rights, property, or safety of StayPilot, our users, or others.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, user data may be transferred as part of that transaction. We will notify you via email prior to such a transfer.

We retain your account data for as long as your account is active or as needed to provide the Service. Hotel booking and guest data is retained for a minimum of 7 years for tax and legal compliance purposes unless a shorter period is required by applicable law.

You may request deletion of your account and data at any time by contacting us at privacy@staypilot.com. Note that some data may be retained for legal compliance purposes even after account deletion.

We implement industry-standard security measures to protect your data, including:

• TLS/SSL encryption for all data transmitted between your browser and our servers
• Passwords stored using bcrypt hashing with salt
• Regular security audits and penetration testing
• Access controls limiting employee access to personal data on a need-to-know basis
• Payment card data handled exclusively by PCI-DSS certified processors (Stripe)

No method of transmission over the internet or method of electronic storage is 100% secure. While we use commercially acceptable means to protect your data, we cannot guarantee absolute security.

Depending on your location, you may have the following rights under applicable data protection law (including GDPR for EEA residents):

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests

To exercise any of these rights, email privacy@staypilot.com. We will respond within 30 days.

We use cookies and similar tracking technologies. For detailed information on the cookies we use, please see our Cookie Policy.

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we discover we have collected data from a child under 16, we will delete it immediately.

Your data may be transferred to and processed in countries other than your own. Where we transfer data outside the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by placing a notice on our website. The "Last Updated" date at the top of this policy reflects the most recent revision.