GuestLume Privacy Policy

1. Who we are and what this policy covers

"GuestLume," "we," "our," and "us" mean GuestLume LLC, a Wyoming limited liability company, registered at 30 N Gould St, STE R, Sheridan, WY 82801, USA.

This policy applies only when GuestLume acts as a data controller — that is, where we decide why and how personal data is processed. That covers:

• Visitors to guestlume.com
• People who request a demo or contact our sales team
• Hotel staff who hold an admin account on app.guestlume.com
• Subscribers to our marketing communications

This policy does not cover personal data belonging to hotel guests collected through the in-room chat or website widget. For that data, GuestLume acts as a data processor working on behalf of the hotel — see Section 3 below.

2. What data we collect, why, and our legal basis

3. Guest data processed on behalf of hotels

When a hotel guest uses the in-room chat or the website chat widget, GuestLume processes that guest's personal data (such as name, room number, and message content) solely on behalf of, and under the instructions of, the hotel operating that chat. In that relationship:

• The hotel is the data controller for its own guests' personal data, and is responsible for telling its guests how their data is used — typically through the hotel's own privacy policy on its own website.
• GuestLume is the data processor. Our processing of guest data is governed by a separate Data Processing Agreement (DPA) between GuestLume and each hotel customer, not by this public policy.
• If you are a hotel guest with a question about how your data was used, please contact the hotel directly. If you are a hotel customer and need a copy of our DPA, contact us using the details in Section 10.

3a. Facebook Messenger and Instagram messages

A hotel can connect its Facebook Page and Instagram professional account to GuestLume. When a guest sends that hotel a message on Messenger or Instagram Direct, Meta passes us the message, the guest's Page- or Instagram-scoped ID and their public display name. We use this only to reply to the guest on the hotel's behalf, using the hotel's AI concierge or a member of hotel staff, and to show the conversation to that hotel's staff in their GuestLume inbox. We do not use this data for advertising, do not sell it, and do not share it with any other hotel. The hotel is the data controller for these conversations, as described in Section 3.

A hotel can disconnect Facebook and Instagram at any time in GuestLume. Guests can ask for their messages to be deleted by following the steps on our data deletion page.

4. Data retention

We keep personal data covered by this policy for as long as needed for the purpose it was collected for:

• Hotel admin accounts: for the duration of the hotel's contract with GuestLume, and for a reasonable period afterward for accounting and legal purposes.
• Sales and demo enquiries: up to 24 months from your last contact with us, unless you become a customer or ask us to delete it sooner.
• Marketing communications: until you unsubscribe or ask us to stop.
• Website analytics: as set out in our Cookie Policy.

We delete or anonymize personal data once it is no longer needed for these purposes, unless we are required to keep it for longer by law.

5. Data sharing, sub-processors, and international transfers

We do not sell personal data. We share it only with service providers who process it on our behalf to run the Service, including:

Because our infrastructure is based in the United States, personal data we process is transferred outside of your home country, including from Thailand and elsewhere. We select providers with appropriate security and contractual safeguards in place, and each provider is contractually restricted from using your data for any purpose other than providing services to us.

We may also disclose personal data where required by law or a valid request from a public authority.

6. Your rights

Subject to the personal data laws that apply to you, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Delete your personal data
• Object to, or ask us to restrict, certain processing
• Withdraw consent at any time, where we rely on consent
• Receive a copy of your data in a portable format

To exercise any of these rights, contact us using the details in Section 10. We may need to verify your identity before responding, and some requests may be limited where we have a legal obligation or legitimate reason to keep the data.

This section will be expanded with region-specific rights (for example, under the EU/UK GDPR) once GuestLume has customers or users in those regions.

7. Cookies and website analytics

guestlume.com uses cookies and similar technologies to operate the website, remember your preferences, and understand how visitors use our site. You can control cookies through your browser settings. Disabling cookies may affect how parts of the website function.

8. Children's privacy

The Service is intended for use by hotel staff and adult guests. We do not knowingly collect personal data directly from children through the accounts and interactions this policy covers. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time, including as we expand into new regions or as our practices change. We will update the "last updated" date at the top of this policy when we do. Significant changes will be communicated to hotel admin users by email.

10. Contact details

If you have questions about this policy, or want to exercise any of the rights described in Section 6, contact us at: