Effective date: 30 October 2026
Scope and contact
GuestLuma is a software service for accommodation operators, their staff and guests. For privacy enquiries, contact info@guestluma.com. This notice covers the public website, account operations and use of the software.
For account administration and support enquiries, GuestLuma determines the purposes of processing. For guest and staff data entered by a property, the property determines the purposes and GuestLuma processes information to provide the software on its behalf. Guests may contact their property about its own processing, service fulfilment and notices. This notice does not replace the property's responsibilities.
Information and purposes
Account data may include name, email, password hash, role, country, language and property information. We use it to register and manage accounts, authenticate users, restrict access and communicate about the service. Staff records and activity logs support permissions and property operations.
Guest data may include information supplied by the guest or property, stay and room details, language, sessions, requests, messages and order history. It supports guest access, communication and fulfilment by the property. A completed stay ends guest access; it does not automatically delete historical requests or transactions.
Payment records may include amount, currency, period, payment-provider references and status. They support access, accounting and dispute handling. Card details, when a card checkout is available, are entered with the payment provider rather than in a GuestLuma card form. Support enquiries contain the details you send and our response.
Technical information includes necessary cookies, sessions, IP addresses, browser or device information and security/diagnostic logs. Necessary storage supports operation and security. Optional public-site analytics depends on the user's cookie choice. Internal property activity and service analytics may be linked to a property, room, stay or request and are not necessarily anonymous. See Cookie information.
Legal grounds and use of AI
Depending on the purpose and applicable law, processing is based on providing requested services and performing contractual obligations, legal obligations, legitimate interests such as security and fraud prevention, or consent where required. Browsing the site or dismissing a notice is not blanket consent. Properties must have lawful grounds for the information they enter.
Where enabled, prompts, dialogue and relevant property information are sent to configured AI services to produce responses. The code supports DeepSeek and speech transcription through a configured Whisper-compatible endpoint; actual providers depend on configuration. Voice transcription and text processing may involve external providers. Do not enter unnecessary sensitive, identity or payment information into AI conversations. AI responses may be wrong and do not replace staff confirmation.
Recipients, location and transfers
Information is accessible to authorised property staff and service personnel as needed. Hosting, email, AI, browser push, payment and anti-bot providers may process information when the corresponding service is used. For example, configured Cloudflare Turnstile protection may process an IP address and verification token. Not every integration is enabled for every user.
GuestLuma's configured storage-country declaration lists Russia and the Netherlands. External providers may process information in additional countries. The operator's place of work does not establish the location of databases or backups. Contact info@guestluma.com for information about the processing relevant to your account and any applicable transfer arrangements. This notice does not claim that a specific data-localisation or international-transfer requirement has been certified as satisfied.
Retention and deletion
Account data is retained while needed for the account and service. Financial, contractual and consent evidence may need to be retained after closure for applicable legal obligations and disputes. Retention depends on the purpose, the property's instructions where applicable and mandatory law. Historical orders are not erased merely because a catalogue item changes.
GuestLuma's configured retention targets are 12 months for closed enquiries, 90 days for detailed analytics and AI dialogue, 180 days for security logs, five years for contract evidence and a 30-day backup cycle. These are policy targets, not a claim that every dataset is automatically deleted on those dates. Deletion and backup handling require operational review; legal holds and necessary financial records may affect timing. Contact support to request review of information associated with you.
Your requests and safeguards
Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to processing, withdraw consent for processing based on consent, or complain to the competent supervisory authority. Withdrawal does not invalidate earlier lawful processing or end processing based on an independent lawful ground. Send your request to info@guestluma.com. We may need proportionate information to verify your identity, authority or relationship to a property; do not send identity documents unless specifically requested through an appropriate channel.
For property-controlled data, we may refer the request to the property. We respond within applicable legal time limits. Our service target is to acknowledge requests within three business days and review them within ten business days after enough information is available. Access controls, property/stay scoping, password hashing and HTTPS help protect information; absolute security cannot be guaranteed. Updates are published with an effective date, with separate consent where required.