Privacy notice.
Version 1 · effective 10 November 2026
1. Controller
MARK Inc Ltd, 11 Akad. Zhak Natan Street, 1700 Sofia, Bulgaria, company number 206058140, is the controller for the personal data described in this notice. Contact: [email protected].
2. What we collect and why
| When | Data | Purpose and legal basis | Kept |
|---|---|---|---|
| Free AI Visibility Check | Website or listing address, email, property type, the report we produce | To produce and send the report (performance of a contract, Art. 6(1)(b) GDPR) and to repeat it on request | 90 days after the last report, unless you become a client |
| Buying a service | Name, company, address, VAT number, email, what you bought; payment is handled by Stripe, we do not see card numbers | Contract and invoicing (Art. 6(1)(b)); accounting obligations (Art. 6(1)(c)) | 10 years for accounting records under Bulgarian law |
| Club | Email and name for your invitation; activity on the community platform is governed by Skool’s notice | Contract (Art. 6(1)(b)) | While you are a member, then 12 months |
| Setup and Managed | Your hotel’s data, and guest data inside your accounts | Guest data is processed on your behalf as processor under a data processing agreement; your own data under the contract | As instructed in the agreement; our own records 10 years |
| Email to us | Your address and what you write | To answer (legitimate interest, Art. 6(1)(f)) | 24 months |
| Visiting the site | Aggregated page statistics without cookies (Cloudflare Web Analytics) | To understand which pages are read (legitimate interest) | Aggregated only |
3. Cookies
hotelhand.ai sets no tracking cookies. Our analytics is cookie-free. Embedded forms (Tally) and the checkout (Stripe) are operated by those providers on their own domains and may set cookies required for their function; see their notices. A small setting such as your chosen currency may be stored in your browser’s local storage; it is never sent to us.
4. Who receives data
Service providers who process data for us under contract: Stripe (payments), Tally (forms), Google Workspace (email), Skool (community), Cloudflare (hosting and analytics), and the AI providers whose models draft texts (OpenAI, Anthropic), under business or API terms that do not use your content for training wherever such terms are available; the data processing agreement lists the exact configuration for your hotel. Where a provider is outside the EU, transfers rely on the EU–US Data Privacy Framework or standard contractual clauses. We do not sell personal data.
5. Guest data when we work in your hotel
During Setup and Managed we see guest data only inside your own systems and only as needed to configure and check the drafts. We act as your processor under a written agreement; nothing is copied to our systems except what the agreement allows, and nothing is used to train AI models.
6. Your rights
You can ask for access, correction, deletion, restriction, portability, and object to processing based on legitimate interest, by writing to [email protected]. You can complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or to the authority of your country.
7. Changes
We update this notice when our processing changes and show the effective date at the top.