Privacy Policy (GDPR / RGPD)
This policy explains what personal data we process when you visit our website, request a demo or use the During Stay platform, for what purpose, for how long and which rights you can exercise.
Last updated: November 2026
Data controller
InRoom Hospitality SL · VAT B27610112
Calle Muntaner 322, Piso 3 Puerta 2 · 08006 Barcelona · Spain
inroom@inroom.io · DPO: rai@inroom.io · +34 603 35 72 75
1. Data controller
The controller of the data collected through this website is InRoom Hospitality SL, VAT number B27610112, with registered office at Calle Muntaner 322, Piso 3 Puerta 2, 08006 Barcelona (Spain).
You can contact us at inroom@inroom.io or reach our data protection officer at rai@inroom.io for any question related to this policy.
2. What data we process
The scope depends on how you interact with us. We never ask for data that is not needed for the specific purpose of each form.
- Professional contact data: name, work email, hotel or group, role, country and room count.
- Request data: the message you write, the solution of interest and acceptance of this policy.
- Technical browsing data: IP address, device type and pages visited, for security and aggregated statistics.
- Cookie preference, stored in your browser.
3. Purposes and legal bases
We process your data on the basis of the consent you give when submitting a form (Art. 6.1.a GDPR) and InRoom's legitimate interest in handling commercial requests and keeping the site secure (Art. 6.1.f GDPR). Where a contractual relationship exists, the basis is performance of the contract (Art. 6.1.b GDPR).
- Respond to your demo or information request.
- Coordinate the product session and the commercial follow-up.
- Manage the contractual relationship if you subscribe to During Stay.
- Prevent abuse, fraud and attacks against the website.
4. Guest data processed on behalf of the hotel
When a property uses During Stay, the hotel is the controller of its guests' data and InRoom acts as processor. The hotel decides what information is loaded, how long it is kept and who it is shared with.
In that context we only process what is needed to handle the conversation: WhatsApp identifier, exchanged messages, stay data and the operational tag that helps the human team. We do not use that data for our own purposes or for advertising.
5. Recipients and sub-processors
We do not sell personal data. To deliver the service we rely on technology providers acting as sub-processors under contract with equivalent data protection obligations:
- Meta Platforms · WhatsApp Business Cloud API, for sending and receiving messages.
- OpenAI · voice-note transcription and automatic translation.
- Cloud infrastructure provider with data centres in the European Union.
- Professional email provider for handling requests.
6. International transfers
Our core infrastructure is in the European Union. If any provider involved were to transfer data outside the European Economic Area, it would rely on a European Commission adequacy decision or on the standard contractual clauses approved by the Commission.
7. Retention periods
We keep data for as long as the purpose requires and, afterwards, for the legally mandated periods.
- Demo requests with no follow-up: 24 months.
- Client data: for the duration of the contract and 6 years afterwards for commercial and tax obligations.
- Guest conversations: the period configured by the hotel, 24 months by default.
- Technical security data: maximum 12 months.
8. Your rights
You can exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to inroom@inroom.io or rai@inroom.io, stating the right you are exercising and attaching a document proving your identity.
We will reply within one month. If you are not satisfied with the response, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Information security
We apply technical and organisational measures proportionate to the risk: encryption in transit and at rest, role-based access control, audit logging of administrative actions, regular backups and dependency reviews.
No system is infallible. If a breach with risk to people's rights occurred, we would notify the supervisory authority and affected individuals within the deadlines set by the GDPR.
10. Changes to this policy
We may update this policy to reflect regulatory or product changes. The version in force is always the one published on this page, with the update date shown at the top.