Security and data protection

What the Guest Service Desk never needs

The Guest Service Desk runs on your hotel's facts, a QR card in each room and a staff screen. It never needs:

• access to your PMS;
• financial files, such as OTA statements, bank lines or your profit and loss;
• access to your inbox;
• card data;
• any change to your phone system.

Other Clefs modules ask for data only if your hotel chooses to use them, and only for that module.

Where your data lives

Today our database runs in Singapore and AI processing runs in the United States. Regional hosting is available when your contract requires it. Moving the database does not move AI processing out of the United States, so guests are asked to consent to that transfer before the assistant starts.

• Database: Singapore (Neon).
• AI processing: United States (OpenAI).
• Regional hosting: available when a hotel's contract requires it, in a region agreed with the hotel.

For UK and EU hotels, a data processing agreement with standard contractual clauses is available on request.

How data moves

Guest consent

The guest assistant starts only after the guest consents, and each consent is stored separately, with the text version and language the guest saw. A guest can withdraw consent at any time.

• AI processing: the assistant answers the guest using AI.
• Transfer abroad: the guest's messages are processed outside the hotel's country (database in Singapore, AI in the United States).
• Recording: phone calls are recorded only if the hotel switches it on and the guest agrees.
• Profile memory: preferences are kept for a later stay only with the guest's agreement.
• Marketing: offers go only to guests who opted in, on the channel they agreed to, and only within set daytime hours.

Sub-processors

These providers process data on our behalf. The full list, with what each one receives, is also on the sub-processors page, which we update before a new provider starts.

How long data is kept

These are the defaults every hotel starts with. The hotel's owner can shorten most of them, within the legal minimums. Every night at 02:30 hotel time, expired data is deleted or anonymized in batches, and the deletion log records how many rows were removed, never what they contained.

Who at the hotel can see what

Every person signs in with their own account and a role: owner, GM, finance, revenue, department head, front desk, or a shared floor device where each staff member signs in to a shift with a PIN. Guest details are masked by role on every screen and every export, and an unknown role sees nothing.

Actions that move money (refunds, rate changes, OTA disputes) always need an approval from a person with the right role, whatever the automation settings.

Audit log

Every change is written to an append-only audit log in the same transaction as the change itself: who did it (a person, a staff device, the AI assistant or a system job), what changed, and why. Personal details in the log are reduced to field names and fingerprints.

• The database refuses edits and deletions of log entries.
• Entries are chained by hash per hotel, and the chain is verified every night.
• AI actions record the model and prompt version; a person correcting the AI is marked as an override.
• The owner and GM can search the log and export it from the console.

Guest rights and your data

Guests can ask to see, correct, erase, restrict or move their data, or object to its use, through the privacy request form. Requests reach the hotel's console with a due date, and a reminder runs daily until each one is closed.

The hotel owns its data. The owner can export all of it at any time, and at the end of a contract we export or delete it as the hotel chooses. Our terms as a processor are in the data processing agreement.