MAYA Privacy Policy

1. Our Role

We are the controller of the information we collect about Customers and their authorized users, such as account, billing and usage information.

For data we receive from a Customer's PMS or other connected systems (“Property Operational Data”), we act as an independent controller. This reflects the terms of the PMS platforms we integrate with; for example, the Cloudbeds API terms make us the controller of personal data made available to us through that API. We process Property Operational Data only for the purposes described in this Policy and our Terms of Service. Each Customer is separately responsible, as a controller, for the data in its own systems, including any notice it owes its guests and having a lawful basis to connect its systems to MAYA.

We do not hold guest names or contact details (see Section 2.c), so we usually cannot identify a guest from our records. Hotel guests seeking to exercise privacy rights should contact the hotel where they stayed first. If a guest contacts us, we will respond as applicable law requires and may ask the hotel to help us locate any related records.

Customers with questions about data protection terms can contact us at info@modern-hospitality-solutions.com.

2. Information We Collect

a. Customer Account Information. When a Customer registers for the Service, we collect business contact information such as name, business email address, hotel/property name, role, and billing information. Payment card details are processed by our third-party payment processor and are not stored on our systems. When someone accepts our Terms of Service and acknowledges this Policy, we record which versions they accepted or acknowledged, when, where in the Service (for example at signup or when accepting an invitation), the property where known, and the IP address and browser user agent where available.

b. Property Operational Data (via PMS Integration). With the authorization given when a property connects MAYA to its PMS, we access data from that PMS through its authorized API, limited to what is needed to provide revenue management functionality. This includes reservations (for example dates, room type, channel or source, rate, booking status, guest counts, and reservation and channel confirmation numbers), room types and inventory configuration, rate plans and rates, availability and occupancy, property details, taxes and fees, and historical performance data. We may begin importing this data once someone at the property has created or signed in to a MAYA account and claimed or connected the property, which may be before any payment is taken and, for someone who has not yet accepted an updated version of our Terms of Service, before they do.

c. Guest Personal Information and Data Minimization. The Service does not need guest names, email addresses, phone numbers, postal addresses, or payment details to function, and we do not keep them. PMS responses can contain them, so before reservation data is stored we remove every field that is not on a strict allowlist; anything removed is processed only transiently and is never stored, displayed, or used. What we keep is booking-level information of the kind listed in Section 2.b. It does not identify a guest to us, but a hotel could link it to a guest using its own records, so we treat it as personal data where the law does.

d. Usage and Technical Data. We collect standard technical information when anyone uses the Service or visits our website, such as log data, IP address, browser type, device information, and usage analytics, collected via cookies or similar technologies.

e. Website and Waitlist Information. If you join the MAYA waitlist or enter an early access code on our website, we collect your email address, the code you entered and when you submitted it, and keep them with our service providers so we can contact you about MAYA. Our website uses tag management and analytics tools that may collect device, browser and usage information and may set cookies. If you visit from the EEA or the UK, we ask first and only load those tools and set those cookies if you accept. You can change your choice at any time with “Cookie settings” in the website footer. Elsewhere, the website loads these tools without asking. We also use cookieless website analytics for all visitors.

3. How We Use Information

We use the information described above to:

• Provide, operate, maintain, and support the Service, including calculating rates from the Customer's own rules and settings and sending them to the Customer's PMS when the Customer has turned that on;
• Set up and evaluate the Service for a property before it pays, which can include importing its booking history, identifying room types and closures, preparing suggested rules, and showing what the Service would do;
• Communicate with Customers about their account, the Service, and support requests;
• Respond to people who join our waitlist or ask about MAYA;
• Process billing and payments, including measuring the room count that billing is based on;
• Monitor, secure, and improve the performance and reliability of the Service;
• Create aggregated and de-identified data as described in Section 4;
• Keep records of acceptance of our Terms of Service and acknowledgement of this Policy, comply with legal obligations, and enforce our agreements.

We do not use Property Operational Data to market to hotel guests, we do not use personal data received through PMS integrations to send unsolicited communications, and we do not sell personal information of any kind. Where a connected PMS platform notifies us of a data subject's opt-out or deletion instruction, we comply as required under our agreements with that platform and applicable law.

4. Aggregated and De-Identified Data

We may create aggregated, anonymized, or de-identified data derived from use of the Service (for example, market-level pricing trends that cannot reasonably be linked to any individual property or person). We may use such data for lawful business purposes, including operating, securing and improving the Service, as permitted by the terms of the PMS platforms we integrate with, provided it does not identify any Customer, property, or individual. We do not use one property's non-public data to calculate or recommend another property's prices. De-identified data will not be re-identified.

5. How We Share Information

We do not sell or rent personal information. We share information only with:

• Service providers / subprocessors that support our infrastructure (e.g., cloud hosting, analytics, payment processing, email delivery, error monitoring), bound by confidentiality and data protection obligations, and only as necessary to provide the Service;
• Connected PMS and integration partners, as directed by the Customer through their authorized integration (e.g., pushing rate updates to the Customer's PMS);
• Legal and safety recipients, where required by law, legal process, or to protect the rights, safety, or property of MAYA, our Customers, or others;
• Business transfer recipients, in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy's protections.

6. PMS Integration Terms

Our access to data through any PMS API is governed by the authorization given when the property connected, our Terms of Service, and the applicable PMS platform's API terms. We use PMS data only for the purposes described in this Policy. If a property disconnects the integration, we stop syncing data from that PMS and stop sending rates to it. Disconnecting does not delete data already imported; it is kept as described in Section 7 so the property can reconnect without being set up again.

7. Data Retention and Deletion

We retain Property Operational Data for as long as needed to provide the Service, including historical data used for forecasting and rate calculations. Disconnecting a PMS or cancelling a subscription does not delete it: except as described below for properties that never pay, we keep it so a property that returns does not have to be set up again.

Properties that never pay. If no subscription fee has ever been paid for a Connected Property (a trial that ends without payment counts as never paid), we may delete the data imported from its PMS, the data derived from it, and its PMS connection and stored credentials once 180 days have passed without anyone using the Service for it. We may keep the property's account record, settings, and pricing rules so it does not have to be set up again. If nobody claims a new connection by creating or signing in to a MAYA account before its connection link expires, we may remove that connection, its stored PMS credentials, and the property record, usually within a few days.

Deletion on request. The Service does not provide a way for Customers to delete a property or the data imported from its PMS. A Customer may ask us to delete its data by writing to info@modern-hospitality-solutions.com from the email address of a Hotel Admin or General Manager of the property. After verifying the request, our administrators will delete or de-identify the Customer's Property Operational Data within 90 days of receiving the verified request.

What we keep. Even after deletion we may retain information where retention is required by law, in our database backups until they expire (each is kept for 7 days, as Section 8 explains), for legitimate business records (e.g., billing history, records of acceptance of our Terms of Service and acknowledgement of this Policy, and records of how the Service was used, such as when a property connected, subscribed or cancelled and which screens were viewed, which identify the property and user account but contain no guest information), or to establish, exercise, or defend legal claims. Data that has been de-identified or aggregated pursuant to Section 4 may be retained and used indefinitely.

8. Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, misuse, or alteration, including encryption in transit, access controls, and credential management for API tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Customers are responsible for maintaining the confidentiality and security of their own account credentials, API tokens, and PMS accounts, and for all activity occurring under their credentials.

Backups. We back up our database once a day and keep each backup for 7 days, after which it is deleted. The database and its backups are hosted in the United States, on Amazon Web Services servers in Ohio. We do not have point-in-time recovery: we can restore the database only to the moment one of those daily backups was taken, so information added or changed after the most recent backup could be lost.

9. International Data Transfers

We are based in, and process data on servers in, the United States. When personal data protected by the GDPR, UK GDPR or Swiss law is transferred to us, we rely on the European Commission's Standard Contractual Clauses (Module One), with the UK Addendum and Swiss amendments, which are incorporated into our Terms of Service (Section 8.9). Complaints about our handling of that data, and requests for a copy of those clauses, can be sent to info@modern-hospitality-solutions.com.

9A. Legal Bases and Complaints (EEA, UK and Switzerland)

We process account and billing information to perform our contract with the Customer and to meet tax and accounting obligations. We process Property Operational Data, including before a subscription, on the basis of our and the property's legitimate interests in setting up, operating, securing and improving revenue management for that property. We process usage and technical information from the Service, cookieless website analytics, and waitlist information, on the basis of our legitimate interests in running, securing and improving the Service and in responding to people interested in MAYA. We keep account information for the life of the account and billing records for as long as tax law requires. Where we rely on legitimate interests, you may object to that processing. Website analytics cookies for visitors in the EEA and UK rely on your consent, which you can withdraw at any time with “Cookie settings” in the website footer. You may also lodge a complaint with your local data protection supervisory authority.

10. Your Rights

Customers and their authorized users may ask to access, correct, or delete their account information by contacting us at info@modern-hospitality-solutions.com. Depending on your jurisdiction, you may have additional rights under applicable privacy laws (such as the GDPR or U.S. state privacy laws), including rights of access, deletion, correction, and portability. We will honor verified requests as required by law. Hotel guests should see Section 1.

11. Children's Privacy

The Service is intended for business use by adults. We do not knowingly collect personal information from anyone under 18.

12. Third-Party Links and Services

The Service may link to or interoperate with third-party services (including PMS platforms). Their privacy practices are governed by their own policies, and we are not responsible for them.

13. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a revised “Last Updated” date, and where changes are material, we will use reasonable efforts to notify Customers, which may include asking them to acknowledge the updated Policy.

This Policy describes our practices; it is not a contract and does not create rights enforceable by hotel guests or any other third parties. This does not limit any rights data subjects have under the Standard Contractual Clauses incorporated by Section 8.9 of our Terms of Service. Our agreement with Customers is our Terms of Service, which uses this Policy only to complete the annexes to the transfer clauses in its Section 8.9.

14. Contact Us

Modern Hospitality Solutions LLC
1515 E Cesar Chavez St. Suite 100
Austin, TX 78702
info@modern-hospitality-solutions.com