Privacy Policy

1. Introduction

HotelFlow PMS ("we", "our", or "us") operates the cloud-based property management system, self-check-in kiosks, and booking platform hosted at hotelflow.live and associated property portals. We respect your privacy and are committed to protecting the personal data of our hotel partners, staff, and guests.

2. Information We Collect

We collect information to provide, maintain, and secure our hospitality services, including:

• Account & Registration Details: Name, business email, property name, room count, phone number, and physical property address.
• Google User Data (via Google Single Sign-On / OAuth): When you choose to sign in or request a demo using Google, we access your basic Google profile information, specifically your name, email address, profile picture URL, and Google user ID (subject to your explicit consent).
• Reservation & Guest Data: Guest contact information, stay dates, room allocations, check-in timestamps, and vehicle details submitted for hotel check-ins.
• Payment & Transaction Records: All credit card payments and security deposits are processed directly through PCI-DSS Level 1 certified gateways (Square and Stripe). We never store raw card numbers on our servers.

3. How We Use Google User Data

Google user information obtained through Google OAuth 2.0 is used strictly for the following purposes:

• To verify your identity and authenticate your access to HotelFlow PMS dashboards and interactive demo sandboxes.
• To auto-populate your verified name and email in demo inquiries and account management.
• To dispatch security notices, login alerts, and multi-factor authentication (2FA) codes.

4. Data Sharing and Third-Party Disclosures

We do not sell, rent, or trade your personal information. Data is only shared with trusted infrastructure providers necessary for operational execution:

• Cloud Infrastructure: Amazon Web Services (AWS) Lightsail hosting with enterprise TLS 1.3 encryption.
• Payment Processing: Square Inc. & Stripe for PCI-DSS compliant credit card transactions.
• Telephony & SMS: Twilio Inc. for automated reservation confirmations and management security alerts.

5. Data Retention & Security

We implement strict technical and organizational safeguards including encrypted HTTPS data transit, parameterized database queries, role-based access control (RBAC), and automated session expirations. Personal data is retained only as long as necessary to fulfill operational, accounting, and legal requirements.

6. Your Rights & Data Deletion

You have the right to access, rectify, or request deletion of your personal account information at any time. To request data deletion or revoke Google OAuth access, contact our compliance team: