Privacy Policy

Last updated: 08/11/2026

1. Who we are

StaySync is a management platform for hotels and accommodation (reservations, guest portal, payments, guest messaging, operations). It is provided by:

For the data of a hotel's guests, the hotel is the controller and StaySync acts as its processor, processing the data only on the hotel's instructions. For the data of the hotels' own users (staff accounts) and of visitors to this website, FHOTELS S.A. is the controller.

2. What data we process

• Guest data entered by the hotel or received from its booking channels: name, email, phone, nationality, booking dates and details, room, amounts and payment status, requests and notes, survey answers, check-in documents when the hotel collects them.
• Messages between the hotel and its guests (email and, where the hotel has connected it, WhatsApp — see section 4).
• Hotel user accounts: name, email, role, sign-in records.
• Technical data: IP address, browser, session and language cookies needed for the service to work. We do not use advertising cookies.

Card details are entered directly on the page of the payment provider (Viva Wallet, ePay); StaySync never sees or stores a card number.

3. Why we process it

• To run the services the hotel uses: bookings, confirmations, payment links, guest portal, check-in/check-out, invoicing.
• To send the guest the messages the hotel chooses (booking confirmation, payment request, pre-arrival information, replies to the guest).
• To keep the service secure, to back it up and to comply with legal obligations (e.g. tax documents).

The legal basis is the performance of the booking contract between the guest and the hotel, the hotel's legal obligations, and its legitimate interest in communicating with its guests; for marketing messages, the guest's consent.

4. WhatsApp

A hotel may connect its own WhatsApp Business number to StaySync through the official Meta WhatsApp Business Platform (Cloud API). When it does:

• StaySync sends and receives WhatsApp messages on behalf of that hotel, from the hotel's own number and under its name. Messages are delivered by Meta Platforms, under the WhatsApp Business Policy.
• We store the guest's phone number, the text of the messages, and their delivery status (sent / delivered / read), linked to the guest's booking, so that the hotel's staff can see the conversation.
• The access key that Meta gives for the hotel's number is stored encrypted and is deleted as soon as the hotel disconnects the number.
• We do not use WhatsApp messages for advertising, profiling, or any purpose other than the hotel's communication with its guests, and we do not sell or share them with anyone else.
• A guest can ask the hotel at any time to stop sending WhatsApp messages.
• Retention: WhatsApp messages and their delivery status are deleted automatically 24 months after the guest's departure (a message not linked to a booking: 24 months after it was sent). A guest can ask the hotel to delete them earlier.

5. Who else receives data

We never sell personal data. Data is shared only with the providers needed to run the service:

• Hosting: Hetzner Online GmbH, data centres in Germany (EU). Encrypted backups (AES-256, encryption keys held only by us): Google Drive.
• Messaging: email providers of the hotel, Meta Platforms (WhatsApp).
• Payments: Viva Wallet, ePay.
• Integrations the hotel enables: its property management system (e.g. CloudHotel), its channel manager, its e-invoicing provider (myDATA).
• AI features (drafting replies, translations): OpenAI — only the text needed for that task.

Some of these providers may process data outside the EU; in that case the safeguards required by the GDPR apply (e.g. standard contractual clauses).

6. How long we keep it

For as long as the hotel uses StaySync and its legal obligations require (tax documents are kept for the period set by law). WhatsApp messages: 24 months after the guest's departure (section 4). When a hotel stops using the service, its data is deleted or returned at its request. Backups are kept for a limited period and then deleted.

7. Security

• HTTPS on every connection; access keys and passwords stored encrypted.
• Each hotel's data in its own database; access only for that hotel's users, by role.
• Firewall, intrusion blocking, encrypted off-site backups.

8. Your rights

You have the right of access, rectification, erasure, restriction, objection and portability. Guests should address the hotel they dealt with; we will help it answer. You can also write to us at info@staysyncapp.gr. How to request deletion: Data deletion instructions.

You may lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

9. Changes

We may update this policy; the current version is always on this page with its date.