Last updated: 13 September 2026
Introduction
HOTEL Ready is a platform for training hotel staff through AI-simulated conversations. This policy explains what personal data we collect, why we collect it, the legal basis for each use, how long we keep it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
Who We Are
HOTEL Ready is operated by Hotel Consult Ltd, Vitoshka Zornitsa Street, 1415 Sofia, Bulgaria. For anything in this policy you can reach us at hello@hotel-ready.com or on +359 899 823 448.
Two Roles: When We Decide, and When Your Employer Does
For visitors to this website, for pilot and demo requests, and for manager and administrator accounts, Hotel Consult Ltd decides how and why your data is used — we are the data controller.
For staff training data inside the app it works differently: your employer (the hotel or school that gave you access) is the controller, and we process that data on their behalf and on their instructions as a data processor, under a data processing agreement in line with Article 28 GDPR. If you are a staff member and want something changed or deleted, start with your manager or administrator — we help them respond, and you can always write to us too.
What We Collect, Why, and on What Legal Basis
- Pilot and demo requests — email address, password (stored hashed), country, and the department you choose. Used to create your trial account and talk to you about it. Legal basis: steps taken at your request before entering a contract (Art. 6(1)(b) GDPR).
- Manager and administrator accounts — the email address used to sign in, plus the IP address and browser data recorded at login. Used to run your account and keep it secure. Legal basis: performance of the contract (Art. 6(1)(b)) and our legitimate interest in protecting the service against misuse (Art. 6(1)(f)).
- Staff profiles and training results — first name, last name, department, job title, a PIN code for login (stored only in hashed form, never in plain text), and training results and progress. Used to deliver the training your employer signed up for. Processed on behalf of your employer, the controller; their basis is typically the employment relationship and their legitimate interest in staff training.
- Support chat and direct contact — whatever you send us by chat, email, phone, Viber or WhatsApp. Used to answer you. Legal basis: our legitimate interest in responding to enquiries (Art. 6(1)(f)).
- Website analytics and advertising — only with your consent (Art. 6(1)(a)); see the cookies section below.
- Billing data of customers — kept because tax and accounting law requires it (Art. 6(1)(c)).
Audio Recordings and Conversations
Voice recordings are never stored — not on your device and not on our servers. When you answer by voice, the recording passes through our server to ElevenLabs to be transcribed, and only the resulting text is kept. Text conversations from the simulations are stored only on your device (in the browser's local storage), for up to 30 days; during a session they pass through our server to Anthropic to generate the guest's replies and your score. You can delete them at any time from the device itself.
AI Transparency and Automated Decisions
The guest you practise with is artificial intelligence — that is always visible and never disguised. The scores and feedback after a conversation are generated automatically, but they exist purely as training feedback: the app takes no decision about you with legal or similarly significant effects. Any decision your employer makes about your work is theirs, made by people — not by HOTEL Ready (Art. 22 GDPR).
Processors and Third Parties
We use a small number of service providers, each bound by a data processing agreement and receiving only what its job requires:
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Anthropic (Claude AI) | Generates the virtual guest's dialogue and evaluates performance | Only the scenario and conversation text — never your name or PIN | USA — EU–US Data Privacy Framework |
| ElevenLabs | The guest's voice, and transcribing spoken answers | The text to be read aloud and, when you answer by voice, your voice recording — never your name or PIN; we don't store the recording | USA — EU standard contractual clauses |
| Supabase | Database for organisations, staff and training results | The account and training data described above | Hosted in the EU |
| Vercel | Website hosting | Technical request data (e.g. IP address) needed to serve pages | USA — EU–US Data Privacy Framework |
| Resend | Sends our emails — account approval, reminders and department reports | Name, email address, hotel name and the email itself — department reports carry totals per department, never staff names | USA — EU–US Data Privacy Framework |
| Stripe | Subscription payments | Organisation name and billing email — card details are entered on Stripe's own payment page and never reach us | Ireland (EU); USA — EU–US Data Privacy Framework |
| Google (Analytics 4, Ads) | Visit statistics and advertising measurement | Only with your consent — see cookies below | USA — EU–US Data Privacy Framework |
| tawk.to | Live support chat on the website | Your messages and basic technical data — only if you open the chat | USA — EU standard contractual clauses |
Where data leaves the EU/EEA, the transfer is protected by an EU adequacy decision (the EU–US Data Privacy Framework) or by the European Commission's standard contractual clauses. We never sell personal data.
Website Analytics, Advertising and Cookies
On hotel-ready.com we use Google Analytics 4, a service of Google LLC, to understand how visitors find and use the site — pages viewed, approximate location (IP addresses are anonymised), device and browser type, and the source that brought you here. We use this to improve the site and to measure our advertising.
Analytics and advertising cookies run only with your consent. On your first visit a banner lets you accept or reject them — rejecting is as easy as accepting, and the site works identically either way. If you reject, we set no analytics cookies and store no identifiers that could recognise you or link your visits together. Google still receives a basic cookieless signal that a page was viewed, including your anonymised IP address and browser type, which is used only to estimate overall traffic and advertising performance — it cannot be traced back to you. You can change your choice at any time via the "Cookie settings" link in the footer. Analytics data is retained for 14 months.
If you accept, Google may also link your visits to your Google account where you are signed in and have allowed ad personalisation. This lets us understand how visitors use the site across their devices, and lets us show HOTEL Ready ads to people who have visited before. And if you submit the pilot form after accepting, we send Google a hashed (unreadable) version of your email address so it can measure which ads led to sign-ups (Enhanced Conversions). You can review and delete this activity at any time in your Google account, and you can withdraw consent through the "Cookie settings" link in the footer.
Google may process this data outside the EU under the EU–US Data Privacy Framework. For details see Google's privacy policy. Analytics applies to this website only — training data in the HOTEL Ready app itself is stored in the EU as described above and is never shared with Google.
The cookies and storage we use
| Name | Purpose | Lifetime | Set |
|---|---|---|---|
| hr_consent (browser storage) | Remembers your cookie choice | Until you delete it | Always — strictly necessary |
| hr_lang | Remembers your language (EN/BG) | 12 months | When you switch language |
| _ga, _ga_KM6LJ14QHH | Google Analytics — distinguishes visitors and sessions | Up to 24 months | Only with your consent |
| tawk.to (twk_*) | Keeps your support chat session | Session, up to 6 months | Only if you open the chat |
Data Storage and Retention
Staff profiles are stored locally on the device on which they were created. Data on organisations, staff, and training results is stored in a secure database (Supabase) hosted in the EU, accessible only to authorised managers and administrators of the respective organisation. We keep personal data no longer than needed:
- Trial accounts that don't become customers — deleted or anonymised no later than 12 months after your last activity.
- Customer accounts — for the duration of the contract; billing records as long as Bulgarian tax and accounting law requires (up to 10 years).
- Staff training data — for as long as your employer's subscription instructs; deleted or returned within 30 days of the contract ending.
- Login and security logs — 12 months.
- Analytics data — 14 months. Support chats — up to 24 months.
Security
PIN codes and passwords are stored hashed (bcrypt) — neither we nor administrators can see them once created. A forgotten PIN can be reset, but never recovered in its original form. All traffic to the site and the app is encrypted (HTTPS), and access to the database is limited to the people who genuinely need it.
Your Rights
Under the GDPR you have the right to access the data we hold about you, to have it corrected or deleted ("right to be forgotten"), to restrict or object to its processing, to receive it in a portable format (data portability), and to withdraw consent at any time — withdrawing is as easy as giving it and doesn't affect what happened before.
To exercise any of these rights, write to hello@hotel-ready.com — or, for staff training data, start with the manager or administrator of your organisation, since your employer is the controller of that data. We respond within one month.
Complaints
If you believe we've handled your data wrongly, we'd like the chance to fix it — but you also have the right to complain to a supervisory authority. Ours is the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg. If you live elsewhere in the EU, you can contact the authority in your own country instead.
Children
HOTEL Ready is a workplace and vocational training tool. It is not directed at children, and we do not knowingly process data of anyone under 16.
Changes to This Policy
When we change this policy, we publish the new version here with an updated date at the top. For significant changes we notify account holders by email.
Contact
Hotel Consult Ltd · UIC 204073745 · Vitoshka Zornitsa Street, 1415 Sofia, Bulgaria · hello@hotel-ready.com · +359 899 823 448