Privacy Policy
Version: October 12, 2026
This policy explains what personal information Hotelwright holds, where it comes from, what it is used for, who helps us handle it and how long we keep it.
Who we are and our role
Hotelwright is run by [Company legal name], [Mailing address].
Hotels and venues (our customers) use the Service to plan and staff events. For the information a hotel puts into the Service about its staff, its clients and its guests, the hotel decides what is collected and why. The hotel is in charge of that information (the controller, or the business under California law), and we handle it only for the hotel and on its instructions (as its processor or service provider).
For the contact and billing details of the people who sign up and manage an account, we decide how that information is used, and this policy applies to it directly.
What we hold
Account details: name, email address, language, sign-in records and two-factor settings.
Staff details the hotel enters or imports: names, email addresses, phone numbers, roles, employment type and seniority, the hotel's own employee or payroll IDs, the staffing agency for agency workers, availability, shifts, hours, preferred language, and whether a person agreed to receive texts. Most of this comes from the hotel (the employer). Staff add some of it themselves in the app: their availability, their phone number and their answers to shift offers, including a short reason from the hotel's list when they call out or decline (for example "Sick" or "Transportation").
Event orders and other files the hotel uploads. These can include its clients' names and contact details, pricing, and special-meal notes for guests.
Notifications sent through the Service by email and in the app; a history of changes to events, staffing and shifts (who changed what, and when); and simple usage counts, such as how many pages AI has read.
Billing: Stripe collects card details on its own pages. We never see or store card numbers. Stripe tells us the plan, whether payments succeeded and the invoices.
Technical logs, such as IP addresses, browser type and error records, kept by our hosting providers for security and troubleshooting.
How we use it
We use the information to run the Service for the hotel, to bill for it, to keep it secure and fix problems, and to answer support questions.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for advertising of any kind.
Mobile numbers and text messages
We do not share mobile numbers or text-message consent with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data is used only to send the shift texts you agreed to.
We do not send texts today; the Service only records each person's choice. The text message terms explain how texts will work.
AI reading
AI reading is on by default for a new hotel, and a manager can switch it off in Settings. While it is on, uploaded event-order pages, including change notices, are sent to Anthropic, PBC to be read into fields; a separate switch sends menu text for translation suggestions. Staff records are never sent; an event order may show printed names such as the catering contact. The AI processing disclosure has the details.
How long we keep it
While an account is active, we keep its information so the hotel can use it. Notifications are deleted 13 months after they are sent.
If a manager cancels, the account stays read-only for 90 days so the hotel can export everything. Then we delete the hotel's data and files, and the sign-ins of people who belonged only to that hotel.
If a trial ends without a plan, or editing is paused because payments stopped, we keep the data read-only so nothing is lost, until a manager asks us to delete it.
Stripe keeps billing records (the customer record and invoices) for as long as tax law requires, even after the rest is deleted. Our providers' backups roll off within their backup window, currently up to 7 days.
A hotel can deactivate a person, which only ends their access; their records stay. A hotel can also anonymise a person, which removes their contact details and replaces their name, so past schedules no longer identify them.
Security
The security summary describes how we protect information.
Your choices and requests
If you work for a hotel that uses the Service, please send requests to see, correct or delete your information to the hotel. We help the hotel answer them. If you write to us, we pass your request to the hotel.
Account holders can write to support@hotelwright.com to see, correct or delete their account information.
California residents: we act as a service provider to the hotel for staff and guest information, and we do not sell or share it. You can use your California privacy rights through the hotel, and you will not be treated differently for doing so.
Hotels can ask us for a short notice to give their staff when their information is first collected, describing the Service and this policy.
Where the information is
The Service is offered to hotels and venues in the United States. We store your information in the United States; some providers may process it elsewhere under their own data-protection terms.
Children
The Service is for businesses and their staff. It is not meant for children, and we do not knowingly collect information from children under 13.
Changes to this policy
If we change this policy in a way that matters, we tell account managers by email and in the app before the change takes effect. The version date at the top shows when it last changed.
Contact
Privacy questions: support@hotelwright.com. By post: [Company legal name], [Mailing address].