Privacy notice.
Version 1 · effective 4 November 2026
1. Controller
MARK Inc Ltd, 11 Akad. Zhak Natan Street, 1700 Sofia, Bulgaria, company number 206058140, is the controller for the personal data described in this notice. Contact: hello@hotelhand.ai.
2. What we collect and why
| When | Data | Purpose and legal basis | Kept |
|---|---|---|---|
| Free AI Visibility Check | Website or listing address, email, property type, the page you sent the form from, the date and time, your country (derived from your connection, not stored as an IP address), your browser’s user-agent, and the report we produce | To produce and send the report (performance of a contract, Art. 6(1)(b) GDPR) and to repeat it on request; country and user-agent to detect abuse (legitimate interest, Art. 6(1)(f)) | 90 days after the last report, unless you become a client |
| Bot check on the form | Technical signals from your browser and your IP address, processed by Cloudflare Turnstile to tell people from automated scripts | To protect the form from spam and abuse (legitimate interest, Art. 6(1)(f)) | Not stored by us; Cloudflare processes it under its own terms |
| Buying a service | Name, company, address, VAT number, email, what you bought; payment is handled by Stripe, we do not see card numbers | Contract and invoicing (Art. 6(1)(b)); accounting obligations (Art. 6(1)(c)) | 10 years for accounting records under Bulgarian law |
| Club | Email and name for your invitation; activity on the community platform is governed by Skool’s notice | Contract (Art. 6(1)(b)) | While you are a member, then 12 months |
| Setup and Managed | Your hotel’s data, and guest data inside your accounts | Guest data is processed on your behalf as processor under a data processing agreement; your own data under the contract | As instructed in the agreement; our own records 10 years |
| Email to us | Your address and what you write | To answer (legitimate interest, Art. 6(1)(f)) | 24 months |
| Visiting the site | Standard request data (IP address, browser, page requested) handled by our hosting provider to deliver the site and keep it secure; if we enable statistics, only aggregated page counts without cookies (Cloudflare Web Analytics) | To deliver and protect the site and understand which pages are read (legitimate interest, Art. 6(1)(f)) | Short-lived security logs at Cloudflare; statistics aggregated only |
3. Cookies and similar technologies
hotelhand.ai uses no advertising, tracking or analytics cookies, and no third-party trackers. We do not use Google Analytics, Meta pixels or similar tools. Because we only use what is strictly necessary to run and protect the site, we do not ask for consent; the notice you see on your first visit is there to tell you this.
| Name | Type and provider | Purpose | Duration |
|---|---|---|---|
| hh-notice | Local storage in your browser, hotelhand.ai | Remembers that you closed the cookie notice, so it is not shown again | Until you clear your browser data |
| hh-pricing | Local storage in your browser, hotelhand.ai | Remembers your choices on the pricing page (currency, and hotel or holiday rental) | Until you clear your browser data |
| Turnstile | Cloudflare, loaded from challenges.cloudflare.com only when you open the free-check form | Security: checks that the form is sent by a person, not a script. Cloudflare may store technical data needed for this check | For the check only |
| Security cookies, if any | Cloudflare (hosting and security) | Cloudflare may set strictly necessary security cookies (such as __cf_bm or cf_clearance) when it needs to protect the site from attacks | Up to 30 minutes for __cf_bm; longer only after a security challenge |
Local storage never leaves your browser and is not sent to us. When checkout opens, the payment page is operated by Stripe on its own domain and may set cookies required for payment and fraud prevention; see Stripe’s privacy notice. You can delete cookies and local storage at any time in your browser settings.
4. Who receives data
Service providers who process data for us under contract:
- Cloudflare: hosting of the site, security (firewall, rate limiting, Turnstile), storage of free-check requests (in the EU), and email forwarding for addresses at hotelhand.ai.
- Google (Gmail, later Google Workspace): the mailbox where we read and answer your emails.
- Stripe: payments, when you buy a service.
- Skool: the Club community platform, if you join the Club.
- AI providers whose models draft texts (OpenAI, Anthropic), under business or API terms that do not use your content for training wherever such terms are available; the data processing agreement lists the exact configuration for your hotel.
Where a provider is outside the EU, transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. We do not sell personal data and we do not share it for advertising.
5. Guest data when we work in your hotel
During Setup and Managed we see guest data only inside your own systems and only as needed to configure and check the drafts. We act as your processor under a written agreement; nothing is copied to our systems except what the agreement allows, and nothing is used to train AI models.
6. Your rights
You can ask for access, correction, deletion, restriction, portability, and object to processing based on legitimate interest, by writing to hello@hotelhand.ai. We answer within one month. You can complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the authority of your country.
7. Changes
We update this notice when our processing changes and show the effective date at the top.