Security and your data

HoteliaOS works from public reviews. Not from your guest data.

It’s a post-stay feedback tool. We read what guests have already published, help you reply, and show what it says about your hotel. That’s all it needs, so that’s all it has.

What we never touch

Guest records: no names from your booking system, no emails, phone numbers or passport details
Your PMS, channel manager or booking engine: we don’t connect to them
Card or bank details: subscriptions are paid through Stripe, and card numbers never reach our servers
Passwords for Booking.com, Agoda, TripAdvisor or your Google account

What we store

Public reviews
The reviews guests have already posted on Google, Booking.com, Agoda and TripAdvisor, under whatever name each guest chose to use.
Your hotel profile
Name, links to your listings, your description and tone of voice, so drafts sound like you.
Your team
The email addresses of the people you add as staff or as recipients for team briefs.
Replies and notes
Drafts, the replies you approve, and the briefs you send to your team.

How your account is protected

Encrypted in transit and at rest

Every connection uses HTTPS. The database is hosted on Supabase and encrypted at rest.

Each hotel sees only its own data

Database access rules check every request, so one account can never read another hotel’s reviews.

Owners control access

Staff logins can read and reply to reviews, but can’t change settings or billing. Remove a login at any time.

Google access is optional and revocable

If you connect Google to post replies, the access key is stored encrypted and only used to post replies you approve. Disconnect in Settings and it’s revoked at Google.

Nothing posts without you

Every reply is a draft until someone on your team approves it.

Your data, on request

Ask and we’ll export it, or delete your account and its data.

Questions from your IT team or owners? Email hello@hoteliaos.com and we’ll answer them directly. See also our privacy policy.