Privacy policy
Last updated: 10 October 2026
Who provides GuestMaker?
GuestMaker is a Hotelinking, S.L. product. Our address is Parc Bit, C/ Isaac Newton, Edificio Disset, 3rd floor, D9, 07121 Palma (Illes Balears), Spain. When a hotel uses GuestMaker to manage guest correspondence, the hotel determines the purposes of that processing and Hotelinking processes that correspondence on its instructions.
Connected email accounts
You connect a mailbox by authorizing GuestMaker through the email provider or by configuring a supported manual connection. For Gmail, GuestMaker requests access to your primary email address, permission to read email and permission to send email. It retrieves message headers, bodies, attachments and conversation identifiers to display incoming enquiries, apply the hotel's routing rules and send replies. The Gmail connector does not request permission to modify or delete Gmail messages or change their labels or read status.
What we store and why
GuestMaker stores connected-account identity and authorization credentials, email correspondence and identifiers, attachments, drafts, replies and operational records needed to provide and secure the service. Authorized hotel staff can access their workspace's correspondence. The application is hosted on Vercel; database and attachment storage use Supabase. Email attachments are stored privately and downloaded through an authenticated route that checks access to the relevant workspace.
Assistant processing
When the hotel enables assistant workflows, or a staff member explicitly requests an AI draft, relevant correspondence, attachment contents and hotel information can be sent to the configured AI service to classify enquiries, extract information or prepare replies. Current email workflows can use OpenAI or Anthropic for text and Google Gemini for image or PDF extraction. Off mode disables background assistant processing; staff can still explicitly request a draft. Draft mode requires staff approval before sending. Auto mode permits assistant replies according to the hotel's configuration and rules. AI-authored replies include an assistant authorship notice.
Google API data and Limited Use
GuestMaker's use and transfer to other applications of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google mailbox data is used only to provide the connected-email features described here. It is not sold, used for advertising or used to train generalized AI models. Transfers are limited to providing these features, security, legal obligations or other circumstances permitted by that policy. Human access is limited to authorized users and circumstances permitted by the policy, such as consented support, security investigation or legal obligations.
Disconnecting and revoking access
Disconnect a mailbox in Settings > Channels > Email Inbox to remove its connection and stop future synchronization through that connection. You can also revoke GuestMaker's access in your Google Account's third-party connections settings. Disconnecting does not erase correspondence already stored in GuestMaker, including attachments and drafts. Request deletion separately if you want stored data removed.
Retention and deletion requests
Correspondence may remain in active records or archives while needed to provide the hotel's service. Operational and security records have separate retention requirements. A mailbox disconnection is not a deletion request. Contact the hotel's administrator or our privacy contact to request access, correction, export or erasure. For hotel-controlled data, we coordinate the request with the hotel and explain any applicable retention obligation. Backup copies and provider operational records are subject to their separate retention and expiry arrangements.
Your rights and privacy contacts
Write to dataprotection@hotelinking.com for privacy questions or rights requests. Our Data Protection Officer can be contacted at dpo@grupox3.es. Depending on the applicable law, you may request access, correction, erasure, restriction or portability, object to processing or withdraw consent. You can also complain to your supervisory authority, including the Spanish Data Protection Agency (AEPD).
Hotelinking's general privacy policy provides further information about website and contact-form data, the legal basis for processing and your rights. Read the general privacy policy.
Google API Services User Data Policy · Manage Google Account connections