Privacy Policy

Who we are

Guestfix Sh.P.K. ("Guestfix", "we", "us") makes Guestfix, a property management system for hotels, and runs this website. Our registered address is [registered address], and our business registration number (NUIS) is [NUIS]. You can reach us about privacy at [privacy email].

Two kinds of personal data

We handle personal data in two different roles, and this policy explains both.

• Visitors and customers: when you visit this website, contact us, book a demo or open an account, we decide how your data is used. We are the "controller".
• Hotel guests: when a hotel uses Guestfix, it stores its guests’ details (such as names, contact details and bookings) in Guestfix. The hotel decides how that data is used and is the controller; we process it only on the hotel’s instructions, as its "processor".

If you stayed at a hotel that uses Guestfix and have a question about your data, please contact that hotel first. We will help the hotel answer you.

What we collect

We only collect what we need to run the website and the service.

• Details you give us: your name, hotel name, email address, phone number and message when you fill in a contact, demo or sign-up form.
• Account details: the name, email address and role of each person who uses your Guestfix account, and the settings of your property.
• Billing details: the plan you are on and your invoices. Card payments are handled by our payment providers; we do not store full card numbers.
• Technical data: your IP address, browser and device type, and logs of how the service is used, which we need to keep it secure and working.
• Cookies: see "Cookies" below.

Why we use it

We use personal data only for these purposes, each with a legal basis:

• To provide the service you signed up for and support you (to perform our contract with you).
• To answer your enquiry or set up a demo or a free migration (at your request, before a contract).
• To bill you and keep accounting records (to meet our legal obligations).
• To keep the service secure and prevent misuse (our legitimate interest).
• To understand how the website is used and which pages lead to enquiries, with Google Analytics, unless you refuse analytics cookies (our legitimate interest).

We do not sell personal data, and we do not use hotel guests’ data for our own marketing.

Cookies

This website uses cookies that are needed for it to work, such as remembering your cookie choice. Analytics cookies from Google Analytics are used unless you refuse them in the cookie banner; personalisation cookies are used only if you accept them. You can change your choice at any time with "Cookie settings" at the bottom of every page.

Who we share it with

We share personal data only with service providers that help us run Guestfix, under contracts that require them to protect it, and only as far as each one needs:

• Hosting and file storage: [hosting provider], where the service and uploaded files are stored.
• Email delivery: [email provider], to send account, booking and notification emails.
• Card payments: Stripe, RaiAccept and CaSys (cPay) through the hotel’s bank, when payments are taken through Guestfix.
• Booking channels: our channel connection partner, Channex, and the booking sites a hotel chooses to connect (such as Booking.com or Airbnb), to send availability and prices and receive bookings.
• AI assistant: OpenRouter and the AI model providers it routes to, only for the questions and data a hotel’s staff send to the assistant.
• Messaging: WhatsApp and Telegram, only if a hotel connects them to receive notifications or use the assistant there.
• Website analytics: Google Analytics, to count visits, pages viewed and enquiries sent, unless you refuse analytics cookies.
• Spam protection: Cloudflare Turnstile, which checks that a contact, demo or integration form is sent by a person, using technical data such as your IP address and browser.

We may also disclose data where the law requires it, for example to a court or a public authority.

International transfers

Some of these providers store or process data outside Albania and the European Economic Area. Where that happens, we rely on recognised safeguards, such as the European Commission’s standard contractual clauses or an adequacy decision, so your data keeps the same level of protection.

How long we keep it

We keep personal data only as long as we need it:

• Account data: for as long as your account is open, then for [number] years for legal and tax records.
• Enquiries and demo requests that do not lead to an account: [number] months.
• Hotel guests’ data: as the hotel instructs. When a hotel’s contract ends, we delete or return its data within [number] days, unless the law requires us to keep it.

How we protect it

Data is sent over encrypted connections, access inside Guestfix is limited by each user’s role, and only staff who need access to support you can see customer data. No system is perfectly secure, but we work to prevent loss, misuse and unauthorised access, and we will tell you and the authorities about a serious breach as the law requires.

Your rights

Under the Albanian data protection law and, where it applies, the EU General Data Protection Regulation, you can ask us to:

• see the personal data we hold about you and get a copy of it
• correct it if it is wrong, or delete it
• restrict or object to how we use it
• send it to you or another provider in a common format
• withdraw a consent you gave, at any time

To use these rights, write to [privacy email]. We will answer within one month. You can also complain to the Information and Data Protection Commissioner of Albania, or to the data protection authority of the EU country where you live.

Children

Guestfix is a business service. The website and the service are not meant for children under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy when our service or the law changes. We will post the new version on this page with a new date, and tell account holders by email about important changes.