Privacy policy

• For the accounts of hotel staff (the admin), the controller is [Razón social], [Domicilio social], [legal@agencyvyral.com].
• For guests' data (orders, requests, feedback), the controller is the hotel. We process that data only on the hotel's behalf and on its instructions, under a data processing agreement (Article 28 GDPR). The hotel's own privacy notice is linked at the foot of its guest page and at checkout.

• Account: name, email address, the hotels you belong to and your role.
• Signing in: sessions with the device's IP address and browser, and one-time codes (stored hashed, valid 15 minutes).
• Activity: an audit log of changes made in the admin (who, what, when), so the hotel's owners can see it.
• Notifications: if you turn them on, your browser's push address.
• Emails we send you: a copy of each email is kept for 30 days, to check delivery.

• To provide the service the hotel contracted and let you sign in: performance of a contract (Article 6.1.b GDPR).
• To keep the service secure (rate limits, audit log, preventing abuse): our legitimate interest (Article 6.1.f).
• To keep invoices and records the law requires: legal obligation (Article 6.1.c).

We don't sell data, use it for advertising or build profiles.

• Sessions end after 30 days without use; rate-limit counters (which hold IP addresses) are deleted within a day.
• Account data stays while your account and the hotel's contract last, then is deleted, except what the law requires us to keep (for example invoices, 6 years under the Spanish Commercial Code).
• Sent emails are deleted after 30 days.

When you open a hotel's page and order, make a request or leave feedback, the hotel decides what is asked and why; read its privacy notice for the details. On its behalf we:

• keep your name, phone, email, room and notes only as long as the hotel set (90 days unless it changed it), then remove them every night, keeping only totals and times for the hotel's reports;
• count page opens without any personal data: no tracking cookies, no analytics, no advertising;
• store a few things only in your own browser (your cart, your reading options), listed in the cookie policy.

Messages you send by WhatsApp or SMS go from your own app to the hotel; we don't see them.

The providers that run the service for us (hosting, database, email and, only when used, the bot check, maps and notifications), listed on the Subprocessors page with where they process data and the safeguards for transfers outside the EU. Support staff of Agency Vyral may see an account's data when a customer asks for help. We share data with authorities only when the law requires it.

You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format: write to [legal@agencyvyral.com]. Guests should write to the hotel first; we help the hotel answer.

If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD, aepd.es).

Connections are encrypted (HTTPS). Sign-in uses one-time links and codes, not passwords. Stay PINs are stored hashed and never written to logs. Access within each hotel follows roles (staff, manager, owner).