Privacy Policy

At DigiStay, we value your privacy and are committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website, submit an enquiry, request a demo, or interact with our services.

By using our website, you agree to the practices described in this Privacy Policy.

1. Who We Are

DigiStay is a hospitality technology platform that provides software and digital solutions for hotels, resorts, homestays, vacation rentals, and other accommodation businesses.

In this Privacy Policy, "DigiStay," "we," "us," and "our" refer to DigiStay Technologies.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information collected through:

• Our website
• Contact and enquiry forms
• Demo requests
• Newsletter or marketing subscriptions
• Other direct interactions with us through the website
• Google account data, where a hotel connects its Google Business Profile to DigiStay (see Section 8)

Except where this Privacy Policy states otherwise — in particular Section 8, which governs data obtained from Google APIs — this Privacy Policy does not automatically apply to guest or hotel operational data processed by DigiStay on behalf of its business customers through its software platform; that data is governed by the separate agreement or platform-specific privacy notice in place with the relevant business customer.

3. Information We Collect

3.1 Information You Provide Directly

• Full name
• Email address
• Phone number
• Company / hotel / property name
• Job title
• Property location
• Number of rooms or business details
• Any other voluntarily submitted information

3.2 Automatically Collected Information

• IP address
• Browser type and version
• Device type and operating system
• Geographic location (approximate)
• Referral source
• Pages visited and time spent on pages
• Clicks and browsing behaviour
• Date and time of access

3.3 Cookies and Tracking Technologies

We use cookies and similar tracking technologies for website functionality, understanding usage patterns, improving performance, remembering your preferences, and supporting analytics and marketing efforts.

4. How We Use Your Information

We use the information we collect to:

• Respond to enquiries and demo requests
• Contact you regarding our products and services
• Provide information about our solutions, features, and updates
• Improve our website, content, and user experience
• Analyse website traffic and usage trends
• Maintain the security of our website and systems
• Manage business relationships
• Send newsletters and marketing communications (where permitted)
• Comply with legal obligations

5. Legal Basis for Processing

We process your personal information based on one or more of the following legal grounds:

• Consent, where you have given clear consent for us to process your data for a specific purpose
• Performance of a contract, where processing is necessary to fulfil a contract or take steps at your request before entering into a contract
• Legitimate business interests, where processing is necessary for our legitimate interests, provided those interests are not overridden by your rights
• Compliance with legal obligations, where we are required to process your data to comply with applicable laws

6. How We Share Your Information

We do not sell your personal information. We may share your information with:

• Internal teams within DigiStay
• Service providers (CRM, analytics, hosting)
• Technology partners
• Professional advisers
• Regulatory authorities (where required by law)
• Business partners and affiliates

All sharing is subject to appropriate safeguards and data protection measures.

7. Customer Data and Platform Usage

Where DigiStay processes information on behalf of hotel customers, that data is controlled by the respective customer. DigiStay acts as a service provider and data processor in such cases. Guests should contact the relevant hotel directly for privacy-related requests. Section 8 applies in addition to this section and describes how DigiStay handles data obtained from Google APIs.

8. Google Account Data (DigiStay Reviews)

DigiStay Reviews is an optional feature that lets a hotel connect its own Google Business Profile so that the Google reviews for its property can be read, replied to, and reported on inside DigiStay. This section describes how DigiStay handles data obtained through Google APIs. It applies whenever a hotel connects a Google account to DigiStay, and it applies in addition to the rest of this Privacy Policy.

8.1 Google Data We Access

When an authorised user at a hotel connects a Google Business Profile, DigiStay requests only the following Google OAuth scopes:

• https://www.googleapis.com/auth/business.manage — to list the Business Profile accounts and locations that the connecting user manages, to read the reviews published on the locations they choose to connect, and to post or update a reply to those reviews when instructed to do so.
• email — to record which Google account was used to make the connection, so that hotel staff can see who connected it and so that the correct account is shown when the connection is renewed or disconnected.

We request no other Google scopes. We do not access Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, or any other Google service.

8.2 What We Store

Against the hotel property record, we store:

• the identifiers and names of the Business Profile accounts and locations the user chose to connect;
• for each review, the reviewer display name and profile photo URL exactly as Google supplies them, the star rating, the review text, the time it was published, and any reply already present on it;
• the reply text sent back to Google;
• the email address of the connecting Google account; and
• the OAuth tokens required to keep the connection working.

Reviewer names, photos and review text are content that Google already publishes on the hotel's public Business Profile. We store a copy so that reviews can be displayed, searched and reported on inside DigiStay.

8.3 How We Use Google Data

Google user data is used only to provide the DigiStay Reviews feature to the hotel that connected the account, specifically to:

• display that hotel's Google reviews inside its own DigiStay dashboard;
• calculate rating, volume and sentiment statistics for that hotel;
• draft and publish replies to those reviews; and
• notify the hotel's staff when a new review arrives.

Where a hotel also uses DigiStay as its property management system, a review may be matched to a past reservation at that same property so that staff can see which stay a review refers to. That match is made only within the hotel's own data, and it is removed after 24 months as described in Section 8.6.

We do not use Google user data for advertising. We do not sell or license it. We do not use it to build profiles for any purpose unrelated to this feature, and we do not use it to train generalised artificial intelligence or machine learning models.

8.4 Reply Drafting and Automatic Replies

If a hotel enables reply drafting, the text of the review is sent to Microsoft Azure OpenAI Service so that a suggested reply can be generated and returned to DigiStay. Under Microsoft's terms for that service, content submitted to it is not used to train Microsoft or OpenAI models and is not shared with other customers. Reply drafting can be turned off at any time in the hotel's DigiStay review settings.

No reply is published to Google unless a person at the hotel sends it, or unless that hotel has explicitly changed its review settings to publish replies automatically. The setting DigiStay ships with is draft only, which publishes nothing to Google.

8.5 How We Share Google Data

We share Google user data only with:

• the hotel that connected the Google account, and the DigiStay users that hotel has authorised on that property;
• Google, when publishing a reply on the hotel's behalf;
• our cloud hosting provider, which stores the data on our behalf; and
• Microsoft Azure OpenAI Service, where reply drafting is enabled, and only for the review text described in Section 8.4.

We do not transfer Google user data to any other third party.

8.6 Security, Retention and Deletion

OAuth refresh tokens are encrypted with AES-256-GCM before being written to our database, using versioned keys so that a key can be rotated without breaking existing connections. Access to review data inside DigiStay is limited to the users a hotel has authorised on that property.

Twenty-four months after a review is published, DigiStay automatically removes the reviewer identity held against it: the reviewer name is replaced, the stored profile photo reference is deleted, and any link between that review and a specific reservation is severed. The star rating and the review text are retained so that the hotel keeps its rating history.

8.7 Revoking Access

A hotel can disconnect its Google account at any time from the review settings in DigiStay. On disconnection, DigiStay revokes its access with Google first and only then marks the connection as revoked and erases the stored tokens. If Google cannot be reached, the connection is held in a pending state, collection of new data stops immediately, and revocation is retried rather than being reported as complete. Access can also be revoked directly from the Google account permissions page at https://myaccount.google.com/permissions.

To request deletion of Google data already held in DigiStay, contact us using the details in Section 18.

8.8 Limited Use

DigiStay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

10. Data Security

We implement reasonable technical and organisational measures to protect your personal information, including:

• Secure hosting infrastructure
• Access controls and authentication
• Encryption of data in transit and at rest
• Firewalls and intrusion detection
• Regular security monitoring and audits

11. International Data Transfers

Your information may be stored and processed in countries other than your own. Where we transfer data internationally, we ensure that reasonable protections and safeguards are in place in accordance with applicable data protection laws.

12. Your Rights

Depending on your location and applicable laws, you may have the following rights regarding your personal information:

• Right to access your personal data
• Right to correction of inaccurate or incomplete data
• Right to deletion of your personal data
• Right to object to or restrict processing
• Right to withdraw consent at any time
• Right to data portability
• Right to opt out of marketing communications

To exercise any of these rights, please contact us using the details provided below.

13. Marketing Communications

We may send you marketing communications such as product updates, feature announcements, and newsletters. You can opt out of these communications at any time by clicking the unsubscribe link in any email or by contacting us directly.

14. Cookies Policy

Cookies are small text files stored on your device when you visit our website. We use cookies for:

• Website functionality and navigation
• Analytics and performance monitoring
• Remembering your preferences
• Security purposes
• Marketing and advertising

Third-party tools integrated into our website may also use cookies in accordance with their own privacy policies. You can manage cookie preferences through your browser settings.

15. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites you visit.

16. Children's Privacy

Our website and services are not directed toward children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we do, we will revise the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us: