Privacy Policy

This policy applies to three categories of individuals:

• Hotel Clients (Businesses): Companies and individuals who subscribe to Shadowbook to manage guest communications and reservations.
• Hotel Guests (End Users): Guests who interact with a hotel's Shadowbook-powered AI concierge via WhatsApp, Instagram, Facebook Messenger, or other channels.
• Website Visitors: Anyone who visits app.shadowbook.online or related Shadowbook web properties.

We collect data in the following categories depending on how our platform is used:

We use the data we collect exclusively for the following purposes:

• Delivering the Shadowbook AI concierge service — routing, reading, and responding to guest messages across all connected channels
• Syncing reservation data from connected PMS to personalise AI responses and anticipate guest needs
• Providing the Shadowbook dashboard — displaying KPIs, conversation history, reservation timelines, and channel statuses to hotel staff
• Sending automated check-in reminders, upsell suggestions, and service updates to guests via the hotel's connected channels
• Configuring and maintaining webhook subscriptions to receive real-time events from Meta platforms and PMS providers
• Authenticating hotel clients via OAuth and maintaining secure API token refresh cycles
• Improving our AI model responses and platform reliability using aggregated, anonymised usage data
• Complying with legal obligations and enforcing our Terms of Service

We do not use any data for advertising, data brokering, profiling for third parties, or any purpose not described above.

We do not sell your data. We share data only with the service providers necessary to operate Shadowbook:

All third-party providers are contractually bound to process data only as instructed and in compliance with applicable data protection laws.

Shadowbook's use of data obtained via Meta's APIs (WhatsApp Business API, Instagram Graph API, Facebook Graph API) is strictly governed by Meta's Platform Terms and Developer Policies. In particular:

• We access Meta platform data only on behalf of the hotel client who granted explicit permission via Meta's OAuth or Embedded Signup flow
• Meta platform data is not used to build audience profiles, serve advertisements, or shared with any ad networks
• Message content obtained through Meta APIs is stored only as long as necessary to deliver the service and is not used to train AI models without explicit consent
• Hotel clients may revoke Shadowbook's access to their Meta assets at any time through their Meta Business Settings or via the Shadowbook Settings panel, which will trigger immediate token revocation and data deletion
• We comply with all applicable Meta Platform Terms including restrictions on data portability and data retention

• Active account data: Retained for the duration of the subscription and up to 90 days after account termination
• Guest conversation data: Retained for up to 12 months after the last interaction, then anonymised or deleted
• PMS reservation data: Retained for up to 12 months after check-out date
• Voice recordings: Deleted within 30 days of processing
• Technical logs: Retained for 90 days for security and debugging purposes
• Deleted account data: Permanently purged within 30 days of account deletion request

We implement industry-standard and enterprise-grade security measures to protect your data:

• All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
• All data at rest is encrypted using AES-256 encryption via our cloud providers
• OAuth tokens and API credentials are stored encrypted and never logged in plaintext
• Access to production databases is restricted to authorised personnel via role-based access control
• Webhook endpoints are secured with signature verification to prevent spoofed events
• Regular security reviews and dependency audits are conducted

In the event of a data breach that affects your personal data, we will notify affected parties in accordance with applicable law, and no later than 72 hours after becoming aware of the breach where required by GDPR.

If you are in the European Economic Area (EEA), United Kingdom, or other jurisdictions with similar data protection laws, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Request your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at support@shadowbook.online. We will respond within 30 days.

Hotel guests should contact the hotel directly for requests related to reservation data, as the hotel is the data controller for guest information.

Shadowbook uses essential cookies only — strictly necessary for authentication sessions and security. We do not use tracking cookies, advertising pixels, or third-party analytics that track individuals across websites.

• Session cookies: Required to maintain your logged-in state on the dashboard
• Security cookies: Used for CSRF protection

Shadowbook is a B2B platform designed for hotel and hospitality businesses. We do not knowingly collect data from children under the age of 13. If you believe a child has provided personal data to us, please contact us and we will promptly delete it.

Shadowbook operates globally and your data may be processed and stored in servers located outside your country of residence, including within the European Economic Area, United States, and other countries where our cloud providers operate. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses (SCCs) where applicable.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and notify active hotel clients via email or in-app notification. Continued use of Shadowbook after the effective date constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy: