Privacy Policy

Introduction

Guest It ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use and store information when you use our platform, including Guest It web portals, manager and staff systems, QR-code interfaces, and related services. It also covers this website, guestit.co.uk, including the contact form and the newsletter, and Guest It Welcome, our guest guides for holiday lets and short-term rentals, which has its own section below.

For the purposes of UK data protection law (including the UK GDPR), we act as a Data Controller for the data we process to operate the service. In many cases we also process data on behalf of venues (our customers). Where a venue controls the purpose and means of processing, it may act as Data Controller and we act as Data Processor. In the same way, a Guest It Welcome host is the Data Controller for what their guests send through the host's guide, and we are the host's Data Processor (see Hosts' guests).

General data protection enquiries: hello@guestit.co.uk
Named data protection contact: Louis Lusso (Co-founder & CTO), louis.lusso@guestit.co.uk
ICO registration: ZC095042
Address: Guest It LTD, Unit 26g-26m Springfield Mill, Bagley Lane, Farsley, West Yorkshire, United Kingdom, LS28 5LY

Data we collect

We collect information necessary to operate our platform and provide the services you request. This may include:

• Account and login data: names, usernames, access codes, roles, and authentication data linked to a venue or event.
• Contact information: email address, telephone number, and other details used for account setup, communications, alerts, or support.
• Operational data: information entered into checklists, audits, dockets, orders, forms, and logs created through our system (typically on behalf of venues).
• Usage and technical data: device type, IP address, browser details, diagnostic logs and activity data used for security and performance.
• Uploaded media: photos and digital signatures where you choose to upload them (for example, audits, dockets, evidence, or forms).
• Staff and workforce data: where you use our staffing features, we may collect date of birth, nationality, right-to-work status, bank details (account number, sort code, bank name) for payment purposes, and location data (GPS coordinates) recorded at shift clock-in and clock-out.
• Guest interaction data: where guests use QR-code chatbots, we may collect name, email address, and phone number as provided by the guest, along with feedback, survey responses, and marketing preferences.
• Website enquiries and newsletter: the name, email address, company, phone number and message you send through the contact form, and the email address, sign-up page and time of consent for the newsletter.

What Guest It Welcome collects from hosts and their guests is set out in Guest It Welcome.

How we use your data

We use your data to:

• Provide, operate and maintain the Guest It platform.
• Authenticate users and manage secure access for staff, managers and authorised users.
• Record operational data (for example, checklists, audits, orders and reports) and make it available to the venue.
• Send service messages such as confirmations, alerts and operational notifications via email or SMS (where enabled).
• Generate AI analytics, summaries and insights from operational data to help venues improve their operations (see AI & automated processing).
• Process guest interactions through AI chatbots to provide information and collect feedback.
• Record staff shift attendance, including GPS location at clock-in and clock-out, for workforce management purposes.
• Deliver push notifications through mobile applications (where enabled by the user).
• Reply to enquiries sent through the contact form, and send the monthly newsletter to people who have subscribed to it. Every newsletter carries an unsubscribe link.
• Monitor and improve reliability, usability and security.
• Comply with legal obligations and protect the integrity of our systems.

We do not sell personal data or share it with advertisers.

Legal basis

We process personal data under one or more lawful bases under UK GDPR:

• Contract: where processing is necessary to provide the services to a venue or user.
• Legitimate interests: to operate the service securely, prevent misuse, and improve performance.
• Consent: where you choose to submit data (for example, surveys or guest submissions), and consent is the appropriate basis.
• Legal obligation: where we must retain or provide information to comply with law.

Storage & security

We use appropriate technical and organisational measures designed to protect personal data against loss, misuse, and unauthorised access. This includes access controls, encryption in transit where applicable, and security monitoring.

Files such as images or signatures may be stored in secure cloud storage (for example, AWS S3) and linked to the relevant record.

Retention

We keep personal data only for as long as necessary for the purposes described in this policy, or as required by law. Specific retention periods include:

• Account data: retained for the duration of the venue's contract with us, plus 12 months after termination.
• Operational data (checklists, audits, orders, logs): retained for the duration of the venue contract plus any period required for compliance or record-keeping (typically up to 24 months).
• Guest interaction data (chatbot submissions, feedback): retained for 12 months from the date of the interaction (for service quality, debugging, abuse detection, and investigation of guest complaints from past events), unless the venue requires longer retention for compliance.
• Staff workforce data: retained for the duration of the staffing relationship plus the period required by employment and tax law (typically up to 6 years for financial records).
• Technical and usage logs: retained for up to 12 months for security and diagnostic purposes.
• Newsletter subscriptions: until you unsubscribe. Contact form messages are emailed to us and are not stored on the platform.
• Guest It Welcome: see How long we keep Welcome data.

Operational data may also be retained at the request of the venue for record-keeping and regulatory compliance. When data is no longer needed, it is securely deleted or anonymised.

Sharing & sub-processors

We may share limited personal data:

• With the venue or organisation that manages your account (for example, managers viewing operational logs).
• With trusted sub-processors who help us deliver the service, under contractual confidentiality and security obligations.
• If required by law, regulation, or to respond to lawful requests.

Sub-processors

We use the following third-party service providers to operate the platform:

• Amazon Web Services (AWS) — cloud hosting, RDS PostgreSQL, S3 storage, ElastiCache (Redis), SES email delivery, CloudFront content delivery, Location Service. Production data is processed in the UK (eu-west-2, London), with cross-region backup snapshots in the EU (eu-west-1, Ireland).
• OpenAI — AI analytics, summaries and chatbot inference, and for Guest It Welcome, drafting guide text from house manuals and answering guests' questions (see AI in Welcome). United States.
• Twilio — SMS and phone number verification. United States.
• Google Cloud — chatbot translation via Google Cloud Translate. United States.
• Google Analytics — page-view statistics for the public website, set only if you allow analytics on the cookie banner. United States.
• Microsoft 365 — internal mail, OneDrive and SharePoint. European Union.
• Sentry — application error monitoring. Our account is hosted in Sentry's European Union data region. Error reports from Guest It Welcome are set up to leave out form contents and the data Welcome's own code is working on at the time, such as guide content and guest messages.
• Expo — mobile push notifications and over-the-air updates. United States.
• Stripe — payment processing for venues' card payments, and subscription billing for our own products, including Guest It Welcome (Stripe Payments Europe Ltd / Stripe Payments UK Ltd). Ireland and United Kingdom.

When you provide personal data in connection with the payment services, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.

Our public website and the Guest It Welcome host dashboard load fonts from Google Fonts, and the host dashboard and the Welcome feedback form load icons from Cloudflare's cdnjs. To download these files your browser sends your IP address to Google or Cloudflare. They set no cookies.

We maintain contracts with all sub-processors that include appropriate data protection obligations. If you are a venue customer and require a full sub-processor list for your records, please contact us at hello@guestit.co.uk.

AI & automated processing

We use artificial intelligence to help venues improve their operations. This includes generating summaries, analytics, and insights from operational data such as guest feedback, sales figures, kitchen operations, and staffing performance.

AI processing is carried out using OpenAI's API. When we send data to OpenAI for analysis:

• We send only the operational data necessary for the specific analysis (for example, aggregated feedback comments or sales totals).
• We do not send data for the purpose of training AI models. Our API usage agreement with OpenAI specifies that data sent via the API is not used for model training.
• Results are returned to the platform and made available to authorised venue users.

The legal basis for AI processing is legitimate interests — specifically, our interest in providing valuable operational insights to venues as part of the service. No solely automated decisions with legal or similarly significant effects are made about individuals.

Guest It Welcome sends OpenAI more than aggregated data; see AI in Welcome.

International transfers

Your data is primarily stored in the UK (AWS eu-west-2, London), with cross-region backup snapshots in the EU (AWS eu-west-1, Ireland). However, some of our sub-processors are based in the United States, which means personal data may be transferred outside the UK.

The following services involve transfers to the United States:

• OpenAI — AI analytics, summaries and chatbot inference
• Twilio — SMS and phone number verification
• Google Cloud — chatbot translation via Google Cloud Translate
• Google Analytics — public website page-view statistics, only if you allow analytics on the cookie banner
• Expo — mobile push notifications and over-the-air updates

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. These may include the UK International Data Transfer Agreement (UK IDTA), Standard Contractual Clauses (SCCs) approved by the ICO, or reliance on the service provider's participation in recognised data protection frameworks.

If you require further details about the safeguards in place for any specific transfer, please contact us at hello@guestit.co.uk.

Guest It Welcome

Guest It Welcome is our product for holiday lets and short-term rentals: hosts build a digital guest guide for each property and share it with their guests. This section covers what is different about Welcome. The Guest It Welcome terms are our contract with hosts; their Schedule 1 is the data processing agreement for guests' data. Welcome questions can go to support@guestit.co.uk.

Hosts

We are the Data Controller for the data we hold about hosts:

• Account details: your name or business name, email address, phone number and password (stored only as a secure hash).
• Your properties and guides: property names and addresses, and everything you put in a guide, including wifi details, door or key-safe codes, contact details and photos.
• House manuals you upload: we read the text once to draft your guide and do not keep the file. The text goes to OpenAI to draft the sections (see AI in Welcome).
• Calendar and earnings: the calendar (iCal) link you give us, and the booked date ranges, event titles and reservation references in it; and the rows you import from an earnings export (dates, nights, amounts, fees, confirmation codes and listing names; we do not import guests' names).
• Billing: your subscription, plan, invoices and payment status. Card payments are handled by Stripe; we never see or store your full card number.
• Plaque orders (only while plaques are on sale): the delivery name, address and email address for your order.
• Your acceptance of our terms: which version of the Welcome terms and of this policy you accepted, when, and the IP address and browser you used.
• Support: the emails you send us and our replies.

We use this data to provide Welcome and bill you for it, and to send you service emails such as your signup confirmation, a reminder before your free trial ends and messages about payments (contract); to keep Welcome secure, prevent misuse, improve it and keep a record of what you agreed to (legitimate interests); and to keep accounting records (legal obligation).

Hosts' guests

For the feedback, messages and AI concierge questions guests send through a host's guide, the host is the Data Controller and we are the host's Data Processor, acting only on the host's instructions. The guest privacy notice, linked from every guide, explains what happens to them. On our demo guide, which has no real host, we are the Data Controller.

AI in Welcome

Welcome sends OpenAI more than the aggregated data described in AI & automated processing: the text of a house manual a host uploads (which can include door codes and phone numbers), the text of a section a host asks us to polish, and, for the AI concierge, the guide's content, the host's notes and the guest's questions. OpenAI processes this in the United States to produce the draft or the answer. We send it with storage switched off; OpenAI may keep API data for up to 30 days to detect abuse, then deletes it unless the law requires otherwise, and does not use it to train its models. Hosts check AI drafts before anything is published, and guests are told when they are talking to an AI.

How long we keep Welcome data

• Host accounts, properties and guides: while the subscription lasts and for 12 months after it ends, so a host can come back; then deleted, or sooner if the host asks.
• Billing and payment records: for as long as the law requires us to keep accounting records.
• Records of accepted terms: for 6 years after the account ends, the time within which a claim about the contract can be brought.
• Guest feedback: answers are deleted 12 months after they are given. A name and email address a guest leaves with feedback are kept until the host's Welcome data is deleted, or sooner if the guest or the host asks.
• AI concierge conversations: 90 days after the last message.
• Guest messages: passed to the host by email; we do not keep a copy.
• AI drafts and earnings imports in progress: held in the host's signed-in session until they are applied, imported or discarded, or the session ends.
• Welcome waitlist: if you joined the waitlist, we email you once when Welcome opens and then delete your address. We do not add it to our newsletter.

Your rights

Under UK GDPR, you may have the right to:

• Access your personal data.
• Request correction of inaccurate data.
• Request deletion (where applicable).
• Object to processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Request data portability (where applicable).

To exercise any of these rights, email hello@guestit.co.uk. We will respond within one month in accordance with UK GDPR. We may need to verify your identity before responding.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated: ico.org.uk/make-a-complaint.

Cookies

We use cookies that are necessary for the website and platform to function (for example, authentication and session management). If you allow analytics on the cookie banner, the public website also sets Google Analytics cookies; the manager, staff and vendor portals, guest QR pages and Guest It Welcome guest guides do not. We do not use advertising cookies that track personal behaviour across third-party websites. The cookies, how long they last and how to withdraw consent are listed in our Cookie Policy.

Children's privacy

Guest It is designed for venue staff, managers and authorised users, and Guest It Welcome hosts must be 18 or over. Welcome guest guides can be read by anyone staying at a property and do not ask for an account. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us and we will take steps to delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Updates will be posted on this page and the "Last updated" date will change accordingly.

Contact

If you have questions about this policy or your data, contact us:

• General data protection enquiries: hello@guestit.co.uk
• Named data protection contact: Louis Lusso (Co-founder & CTO), louis.lusso@guestit.co.uk
• ICO registration: ZC095042
• Address: Guest It LTD, Unit 26g-26m Springfield Mill, Bagley Lane, Farsley, West Yorkshire, United Kingdom, LS28 5LY