Privacy Policy

We are Bookeva (legal entity name, legal form, registered address and registration number [owner to confirm]). You can reach us at info@bookeva.com.

We have two roles:

• Controller for our own data: the accounts of hotel owners and staff, billing contacts, support conversations, legal acceptance records, and visitors to our website.
• Processor for guest data: the reservations, contact details, messages, payments, invoices and door access of guests, which each hotel keeps in Bookeva. The hotel is the controller and decides why and how that data is used. We act only on its instructions.

• Account: email address, password (stored only as a secure hash by our sign-in provider), optional authenticator setup, and preferences such as language and theme.
• Organisation and role: the organisation you belong to, your role and what you are allowed to do, and invitations.
• Activity: a record of important actions, such as changes to reservations, money, access or settings, with who did them and when.
• Billing: the billing contact, VAT details and subscription history. Card details are entered directly into Stripe; Bookeva never sees or stores card numbers.
• Support: the messages you send us and our notes on the request.
• Legal acceptance: which version of these terms and this policy you accepted, where, and when. We do not store your IP address for this.
• Security and technical data: a keyed hash of your IP address for rate limiting, short-lived request logs at our hosting provider, and error reports with personal data removed.
• Setup and help: files you upload to import your hotel's setup, and questions you ask the help assistant.

When you ask us for a call with the form on our website, we keep:

• your email address;
• your name and your hotel's name, if you give them;
• your question;
• the days you prefer for the call;
• the time you sent the form, and whether we have contacted you.

We use these details only to answer you and arrange the call. Our legal basis is taking steps at your request before a possible contract (GDPR Art. 6(1)(b)) and, where no contract follows, our legitimate interest in answering people who write to us (Art. 6(1)(f)).

The details reach the Bookeva team by email, through our email provider (Resend, listed below). Nobody else receives them. To stop abuse of the form we keep a keyed hash of your IP address and of your email address for up to two days; never the address itself.

We delete a request 12 months after we mark it as contacted or done, and in any case 18 months after you sent it. You can ask us to delete it sooner (see Your rights).

What a hotel keeps depends on how it uses Bookeva. It can include:

• Reservation details: names, stay dates, room, number of guests, rate, source channel and booking references.
• Contact details: email address and phone number, from the guest or from the booking channel.
• Registration details the hotel asks for, such as nationality, date of birth and the type and last digits of an identity document. Bookeva does not store images of identity documents.
• Messages between the guest and the hotel, including messages from booking channels.
• Payments and invoices: amounts, payment status, invoices and credit notes. Card details stay with Stripe in the hotel's own Stripe account.
• Door access: the access code for a stay and when it is valid. Codes are shown only to hotel staff and to the guest in their stay page, and never written to logs.
• The stay page: a private link and one-time codes that let a guest see their stay, register and request extras. We store only secure hashes of these links and codes.

Guests: the hotel is responsible for telling you how it uses your data. Ask the hotel first; you can also write to us (see Your rights).

For our own data we rely on these legal bases under the GDPR:

• Contract: to create and run your account and organisation, bill the subscription and give support.
• Legal obligation: to keep invoices and accounting records and to answer lawful requests from authorities.
• Legitimate interests: to keep Bookeva secure, prevent abuse, fix errors and improve the product, in ways you would reasonably expect.
• Consent: only where the law requires it; you can withdraw it at any time.

We do not sell personal data and we do not use guest data for our own purposes, advertising or training AI models.

We use these providers (sub-processors) to run Bookeva. Each is bound by a contract that protects the data.

Booking channels such as Booking.com, Airbnb and Expedia are not our sub-processors. They are the hotel's partners, and data is exchanged with them on the hotel's instruction and under their own policies.

We may also disclose data when the law requires it, or to protect the rights and safety of guests, hotels or Bookeva.

We will update this list before we add or replace a sub-processor.

Bookeva's database and files are stored in the European Union, in Paris. Some providers above may process data outside the European Economic Area. Where they do, we rely on an adequacy decision or on the European Commission's standard contractual clauses, with extra safeguards where needed.

The transfer basis for each provider is [owner to confirm].

• Issued invoices and credit notes are kept for the retention period the law of the hotel's country requires, even after other data is erased.
• Other guest data is kept while the hotel uses Bookeva, for as long as the hotel's own settings say (for example its registration retention), and is erased when the hotel or the guest asks and the law allows.
• When an organisation is closed, it is locked at once and its data is deleted 30 days later, except issued invoices and credit notes.
• Owner and staff accounts are kept while the account is active and deleted when the account is removed. Activity records about changes a person made may keep that person's name for as long as the organisation exists.
• Legal acceptance records are kept for as long as the agreement lasts and for the period after it in which a claim can be made [owner to confirm].
• Request logs and error reports are kept for a short time, normally no longer than 90 days [owner to confirm].
• Website call requests are deleted 12 months after we mark them as contacted or done, and in any case 18 months after they were sent.
• Backups are kept for a limited time and then deleted: our database provider keeps its backups for up to 7 days, and our encrypted off-site copies of the database and stored files are kept for 30 days. Data deleted from Bookeva, including a closed organisation's data, stays in these backup copies until they expire, normally no more than 30 days later, and is used only to restore the service.

• Data is encrypted in transit and at rest.
• Each hotel's data is separated from every other hotel's by access rules in the database itself, and these rules are tested.
• People see only what their role allows. Bookeva staff access is limited, requires two-step sign-in and is recorded.
• Bookeva never stores card numbers, identity document images, or door codes in logs.
• Error reports have personal data removed before they leave Bookeva.
• Our database provider keeps encrypted backups, and we keep encrypted off-site copies in the European Union with a separate provider, so data can be restored after a failure.

Under the GDPR you can ask for access to your data, correct it, have it erased, restrict or object to its use, and receive a copy in a portable format. Where we rely on consent you can withdraw it at any time.

Owners and staff: write to info@bookeva.com. We answer within one month.

Guests: please contact the hotel you stayed with, because it decides how your data is used. If you write to us at info@bookeva.com, we pass your request to the hotel without undue delay and help it answer. We cannot hand guest data to anyone without the hotel's instruction unless the law requires it.

You can also complain to a data protection authority, for example where you live or work. In France this is the CNIL (cnil.fr).

The Bookeva app uses only the cookies it needs to work: your sign-in session, language, theme, the hotel you last opened and a few security preferences. We do not use advertising cookies. See the cookie policy for details.

AI drafts receive the minimum needed for the task: the text of a setup file you upload or the question you ask. We do not send guest records to AI providers, and nothing an AI drafts changes your data until a person confirms it.

Bookeva is a business tool and is not meant for children.

We may update this policy. Each version has a number and an effective date at the top of this page. For a change that matters, we tell owners and staff in Bookeva, and owners are asked to accept the new version.

Questions or requests: info@bookeva.com. Postal address: Bookeva (legal entity name, legal form, registered address and registration number [owner to confirm]).