Privacy at Hotel Revenue Co.
Hotel Revenue Co. is designed around a simple rule: use personal data only when it has a legitimate service purpose, keep guest context separate from unnecessary private information, and make human judgement—not surveillance—the centre of the product.
1. Who we are
Hotel Revenue Co. is a hospitality technology service currently in the process of incorporating its operating company in the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates. The DIFC operating company has not yet completed incorporation. Until incorporation is complete, this policy describes the processing actually carried out under the Hotel Revenue Co. name. Before the DIFC company begins contracting as the operator, this policy will be updated with its registered legal name, registered address and licence details.
Privacy enquiries and data-rights requests can currently be sent to vasconcelos@altavella.com. A statutory Data Protection Officer has not yet been appointed. If a DPO, an EU representative under Article 27 GDPR, or another mandatory privacy representative is appointed or becomes required, their details will be added here before the relevant processing begins.
Once incorporated, the DIFC operating company is intended to be subject to the DIFC Data Protection Law No. 5 of 2020 and its regulations. Where the EU General Data Protection Regulation (GDPR), UK GDPR or another privacy law applies to a particular processing activity, we will also comply with that law.
2. When Hotel Revenue Co. is controller and when the hotel is controller
Our own activities. Hotel Revenue Co. acts as controller for personal data used for the public website, demo and commercial enquiries, our own business contacts, customer-user account administration, authentication, service security, abuse prevention, legal compliance and our own corporate administration. In those cases, we determine why and how the relevant personal data is processed.
Hotel guest and operational data. For guest reservation data, stay context, operational signals, candidate and validated Moments, guest-validation requests, interventions, organisational learning and programme-level RevEmo information inside a customer workspace, the participating hotel normally acts as controller and Hotel Revenue Co. acts as its processor. The hotel determines the purpose, lawful basis, permitted users and retention period for that data, and Hotel Revenue Co. processes it under the hotel’s instructions and the applicable Data Processing Agreement.
If you are a hotel guest, the hotel’s own privacy notice remains the primary notice for the hotel’s use of your reservation and stay data. We assist the hotel in meeting its privacy obligations and in responding to rights requests concerning data we process for it.
3. Personal data we collect directly
Website and demo requests. When you request a demo or contact us, we collect the name, email address, company or hotel information and message you submit. The form contains a privacy acknowledgement so you can review this policy before sending your request. We may also process limited technical information such as IP address and request timing for rate limiting, security and abuse prevention.
Customer-user accounts. For hotel staff and other authorised users we process account identifiers, name, business email, password hash, role and access scope, session and authentication information, login timestamps, password/reset status and relevant security or audit events. We do not store plaintext passwords.
Guest validation responses. A guest who receives a validation request provides the surname on the reservation, a structured answer about whether the recorded service action meaningfully affected their experience, and may voluntarily add an optional note. We also record limited technical evidence about the response, such as a coarse network range, country indicated by the hosting edge and browser/user-agent information, to protect the integrity of the validation record.
The optional validation note is voluntary. Guests should avoid including health, medical, dietary, religious, biometric or other highly sensitive information unless they deliberately want that information communicated to the hotel. If such information is volunteered, it is processed as part of the validation response under the hotel controller’s instructions and applicable law.
4. Personal data we receive from hotels and other sources
Some personal data is not collected from the individual by Hotel Revenue Co. directly. A participating hotel may provide or authorise the import of reservation and operational information from its own systems or approved service providers. Depending on the hotel’s configuration, this can include pseudonymous stay context, reservation contact information used for guest validation, and a limited reservation-prefill set such as given name and title, preferred language, country of residence, arrival and departure dates, room type, market segment and rate type, party size, booking channel, VIP or loyalty status, repeat-stay information, company or travel-agent linkage, an explicit occasion marker, disclosed room or amenity preference codes and communication preferences.
Reservation surname and email are stored separately from the staff-facing stay context and are used for guest-validation delivery and reservation-surname verification. They are not returned to staff-facing workspace or Ask Hotel Revenue Co. responses.
Reservation imports are deliberately allowlisted. We do not intend to import free-text reservation notes or traces, dietary, allergy, accessibility, mobility, medical or health information, dates of birth or age, payment or card information, folio balances, deposits or credit information, passport, national-ID or other document numbers, loyalty balances or points, or other financial-spend data. The importer is designed to discard those fields rather than retain them.
Operational evidence may also be supplied by the hotel from systems such as PMS, CRM, POS, housekeeping, maintenance, guest communications, surveys, reviews or other approved hotel systems when integrations exist. The production architecture supports such integrations, but an OPERA/OHIP connector is not currently active. At present, reservation-prefill data visible in the demonstration environment comes from demo or manual-import stays.
Hotel Revenue Co. may also use aggregated public reputation information, such as public review scores and themes, as a baseline or demonstration context. We do not need reviewer identity for that purpose.
5. Why we process personal data and our legal bases
We process personal data only where an applicable lawful basis exists. Where the GDPR applies, the principal bases are the following.
Responding to enquiries and developing B2B relationships. We use demo-request and business-contact information to answer enquiries, arrange demonstrations, prepare proposals and maintain relevant business follow-up. We rely primarily on our legitimate interest in developing and managing business relationships and, where applicable, steps requested before entering a contract. Where electronic-marketing law requires consent for a particular communication, we will ask for it. You can object to direct marketing at any time.
Providing and securing the service. Customer-user account, authentication, access-control, technical and security data is processed as necessary to provide the contracted service, administer authorised users, protect accounts and systems, prevent abuse, investigate incidents and establish or defend legal claims. Depending on the context, this is based on contractual necessity, legitimate interests and/or legal obligations.
Hotel guest and operational data. Where Hotel Revenue Co. acts as processor, the participating hotel is responsible for determining the lawful basis for processing guest data. Hotel Revenue Co. processes that data only to provide the service and follow the hotel’s documented instructions, subject to the DPA and applicable law.
Future optional guest profile. Hotel Revenue Co. does not currently operate a cross-hotel portable guest profile. If such a feature is launched, it will be opt-in, based on explicit guest choice where consent is the appropriate basis, and accompanied by a just-in-time notice explaining the information involved, the scope chosen by the guest and how consent can be withdrawn. No dormant database groundwork is treated as an active profile.
Legal and regulatory compliance. We may process information where necessary to comply with law, respond to lawful requests, maintain required records, or establish, exercise or defend legal claims.
6. Guest validation
Staff can record a candidate Moment but cannot mark it as guest validated. When a permitted staff member requests validation, Hotel Revenue Co. creates a one-time token, stores only its hash, and sends the validation link directly to the email address associated with the reservation. Staff do not see or receive the link; they see only the request status, a masked address and the eventual outcome.
The link expires after 7 days, works once, and closes after repeated incorrect surname attempts. A browser carrying a valid Hotel Revenue Co. staff session is refused. The guest is shown only the property, the recorded service action and its date, and is asked for the surname on the reservation before responding.
This is evidence from the reservation contact, not proof of legal identity. Anyone who can access the reservation email and knows the surname on the booking may be able to respond. Shared, agency or hotel-managed reservation addresses can therefore weaken the assurance that the person responding is the person who stayed.
7. AI, profiling and automated analysis
Hotel Revenue Co. uses automated analysis to help authorised hotel staff interpret operational evidence. The Signal Engine may identify patterns, risks, opportunities or Potential Moments from the information available in the workspace. Ask Hotel Revenue Co. uses an AI model to answer staff questions using a scoped set of workspace evidence.
When Ask Hotel Revenue Co. is enabled, relevant workspace context may be sent through Vercel’s AI Gateway to OpenAI for inference. The Ask context can include hotel, signal, Potential Moment, Moment, intervention, memory and programme information permitted for the signed-in user’s scope. Reservation email addresses and reservation surnames are not included in the Ask context.
Hotel Revenue Co. does not currently use identifiable guest workspace data to train its own AI models or to create an independent cross-hotel guest profile. We do not opt customer API content into third-party model training. OpenAI’s business/API services state that business/API inputs and outputs are not used to train OpenAI models by default. Information that has been irreversibly anonymised so that an individual is no longer reasonably identifiable may be used for statistics, research, benchmarking and product improvement.
The Signal Engine and Ask Hotel Revenue Co. are decision-support tools. They do not make solely automated decisions that produce legal or similarly significant effects on guests. Hotel staff remain responsible for deciding whether and how to act. RevEmo is a programme-level service-economics measure; it is not an individual guest credit score, eligibility score or automated decision about a guest.
8. Who receives personal data
We disclose personal data only as needed for the purposes described in this policy, under appropriate contractual and security arrangements. Current service providers include Vercel for hosting, serverless execution and AI Gateway infrastructure; Neon for managed PostgreSQL database services; Resend for transactional email, including password/reset and guest-validation delivery; and OpenAI for AI inference used by Ask Hotel Revenue Co. when enabled.
These providers may use their own authorised subprocessors. We may also disclose information to professional advisers, auditors, insurers, prospective transaction counterparties under confidentiality, or public authorities where disclosure is legally required or reasonably necessary to protect legal rights.
We do not sell hotel guest personal data. We do not use guest data for third-party advertising, and the current public website does not use advertising trackers.
9. International transfers
Hotel Revenue Co. is intended to be operated from the DIFC in the United Arab Emirates and uses service providers that may process data in other countries. Personal data may therefore be accessed or processed outside the country in which the individual or hotel is located.
Where the GDPR or UK GDPR applies and personal data is transferred to a country that is not covered by an applicable adequacy decision, we will use an available lawful transfer mechanism, such as the European Commission’s Standard Contractual Clauses, the UK transfer addendum or another valid safeguard, together with supplementary technical or organisational measures where appropriate. Our service providers maintain their own transfer mechanisms and data-processing terms.
Where DIFC Data Protection Law applies to an export from the DIFC, transfers will be made in accordance with the DIFC rules on adequate jurisdictions, contractual safeguards or other permitted transfer grounds.
10. How long we keep personal data
We apply storage limitation: personal data is retained for as long as it remains reasonably necessary for the purpose for which it was collected, for a compatible lawful purpose, to comply with legal or contractual duties, or to establish, exercise or defend legal claims. We do not treat the mere existence of a theoretical legal maximum as a reason to keep identifiable personal data indefinitely.
Demo and commercial enquiries. We normally retain B2B lead and correspondence records for up to 36 months after the last meaningful commercial interaction. If a prospect becomes a customer or an active transaction remains under discussion, relevant records may be retained for the duration of that relationship and thereafter for legal, accounting, compliance or dispute purposes. A person who objects to direct marketing will be removed from active marketing, while a minimal suppression record may be kept so we can respect the objection.
Customer-user accounts and security records. Account data is retained while the account and customer relationship are active and thereafter for as long as reasonably necessary for offboarding, security, audit, contractual compliance and legal claims. Password-reset and invite links are one-time and time-limited.
Hotel guest and workspace data. The hotel controller determines the applicable retention period in its agreement and processing schedule. Hotel Revenue Co. does not set a separate independent commercial retention period for guest reservation or operational data processed solely on the hotel’s behalf. On termination or instruction, data will be returned or deleted in accordance with the DPA, subject to legal requirements and normal provider backup/deletion cycles.
Validation data. Guest-validation links expire after 7 days and only the token hash is stored. The validation outcome, optional note and related audit evidence are retained according to the hotel controller’s workspace retention instructions.
Future consent-based profile. If an optional portable guest profile is launched, its retention period and inactivity rules will be disclosed before opt-in. Consent will be withdrawable, and withdrawal will stop future consent-based processing subject to any data that must lawfully be retained for another reason.
Information that has been irreversibly anonymised and no longer constitutes personal data may be retained for research, statistical analysis, benchmarking and product improvement.
11. Cookies, browser storage and analytics
The public Hotel Revenue Co. website currently does not use advertising cookies or third-party analytics cookies, and we do not currently run Google Analytics, advertising pixels or behavioural advertising trackers.
When an authorised user signs in, Hotel Revenue Co. uses a strictly necessary secure session cookie to authenticate the user and enforce access control. The session is signed, HttpOnly, Secure and SameSite=Lax and currently has an eight-hour lifetime. This cookie is necessary to provide the signed-in service and is not used for advertising.
Hosting and security infrastructure may process ordinary request metadata such as IP address, user-agent, timestamps and diagnostic information for delivery, security, fraud prevention and troubleshooting. If we introduce optional analytics or non-essential cookies in the future, we will update this policy and deploy the consent controls required by applicable law before using them.
12. Demo form and marketing
The demo form asks for a privacy acknowledgement, not consent to all future processing. We use the details to answer the request and may keep appropriate B2B contact details for relevant follow-up and business-development communications where permitted by law. You can ask us to stop marketing communications at any time. Where consent is legally required for a channel or jurisdiction, we will obtain it before sending that marketing.
13. Security
We use technical and organisational safeguards designed for the nature of the service, including server-side authentication, password hashing, signed secure cookies, role/property/department access controls, scoped APIs, audit trails, encrypted transport, managed cloud infrastructure and separation of reservation contact information from staff-facing guest context. Access is limited according to role and operational need.
No internet service can guarantee absolute security. Hotels and authorised users must also protect their credentials, configure access appropriately and avoid uploading information outside the agreed processing scope.
14. Your rights
Depending on the law that applies, you may have the right to request access to your personal data, rectification of inaccurate information, erasure, restriction of processing, data portability, and to object to certain processing, including direct marketing and processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
We may need reasonable information to verify identity before acting on a request. If Hotel Revenue Co. is processing guest data only as a processor for a hotel, the hotel is normally responsible for deciding the request. You may contact the hotel directly or contact us and we will assist or route the request as required.
Where applicable, you also have the right to lodge a complaint with a competent supervisory authority. Once the DIFC operating company is incorporated and DIFC law applies, complaints may be made to the DIFC Commissioner of Data Protection. Where the GDPR applies, you may also complain to the competent data-protection authority in the relevant EU/EEA Member State, including the authority where you live, work or where an alleged infringement occurred.
15. Children
Hotel Revenue Co. is a B2B hospitality service and is not directed to children. Hotels may nevertheless hold reservation information relating to families and minors. Where such data is processed in a workspace, the hotel remains responsible for ensuring it has an appropriate lawful basis and for limiting the information supplied to what is necessary. Any future guest-controlled profile for minors would require an age-appropriate design and any parental or guardian authorisation required by applicable law before launch.
16. Changes to this policy
We may update this policy when the company is incorporated, when the product, subprocessors or legal requirements change, or when a new processing purpose is introduced. Material changes will be communicated through an appropriate channel before they take effect where the law requires it. The current version will always be published on this page.
17. Contact
For privacy questions, rights requests or objections to marketing, email vasconcelos@altavella.com. Until incorporation is complete, this is the primary privacy contact for Hotel Revenue Co.
Effective · 3 October 2026 · Pre-incorporation privacy notice