Privacy Policy

1Who we are

Book2dream ("Book2dream", "we", "us") provides an AI-powered direct booking engine for hotels, lodges and boutique properties. This Privacy Policy explains how we handle personal data across our website at book2dream.com, the booking engines we operate for our customers, and the administrative tools we provide to them.

It applies to three groups of people: visitors to our website, staff at hotels that use Book2dream ("Hotel Customers"), and guests who make or manage a booking through a booking engine we run on a Hotel Customer's behalf.

2Our role: your hotel owns its data

For guest and booking data flowing through the booking engine, the hotel is the data controller and Book2dream is the data processor. The hotel decides what is collected and why. We act only on the hotel's documented instructions.

Put plainly: that data belongs to the hotel, not to us. We do not sell it, we do not rent it, we do not disclose it to other hotels, and we do not use one hotel's guest data to build features that serve anybody else.

For our own website, marketing and account administration, Book2dream is the controller, and this policy describes our own practices directly.

3Information we collect

What we collect depends on how you interact with us.

• Hotel account data — names, work email addresses, phone numbers and roles of the people at a Hotel Customer who administer the booking engine, plus billing and contract details.
• Guest and booking data, processed on behalf of a Hotel Customer — guest name and contact details, stay dates, room and rate selection, number of guests, special requests, language and currency preferences, and booking status.
• Payment data — handled by PCI-DSS compliant payment providers. Book2dream does not store full card numbers or security codes on its own systems.
• Messaging data, processed on behalf of a Hotel Customer — mobile numbers, the content and delivery status of text and WhatsApp messages and, where available, calls, and records of when and how a guest agreed to receive messages or stopped them.
• Enquiry data — what you send through our demo request form: your name, work email, hotel name, property type, room count and any message you write.
• Technical and usage data — IP address, browser and device type, pages viewed, referring page, and approximate location derived from IP. On booking engines this includes the signals our pricing and personalisation features rely on.

4How we use personal data

• To operate, maintain and secure the booking engine, and to take bookings on a hotel's behalf.
• To personalise availability, pricing and content for a guest, on the hotel's instructions and within the rules the hotel configures.
• To send the email, text and WhatsApp messages a hotel chooses to send its guests, such as booking confirmations, changes, cancellations and payment reminders.
• To provide support, respond to demo requests, and manage contracts and billing with Hotel Customers.
• To detect and prevent fraud, abuse and security incidents.
• To produce aggregated, de-identified statistics about how the product performs. These never identify a guest or expose one hotel's commercial data to another.

5Text messages and mobile numbers

Hotels can use Book2dream to send guests text messages and WhatsApp messages, as described in our Messaging Terms at book2dream.com/messaging-terms. A hotel messages a guest only with the guest's consent, and the guest can stop at any time by replying STOP, or get help by replying HELP. Message frequency varies, and message and data rates may apply.

We do not sell, rent or share mobile numbers or other mobile information with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are never shared with any third party. All the other sharing described in this policy excludes this data: mobile numbers go only to the providers that deliver messages, such as Twilio, and only to deliver them.

6Legal bases

Where data protection law requires a legal basis, we rely on: performance of a contract, to run the service and take bookings; legitimate interests, to secure our systems, improve the product and market to hotels; consent, for analytics and marketing cookies and for marketing email where consent is required; and legal obligation, for tax, accounting and lawful requests.

We handle personal data in line with Chilean Law No. 19.628 on the Protection of Private Life, as amended by Law No. 21.719, and — where a hotel or its guests fall within its scope — the EU General Data Protection Regulation.

7Data ownership and portability

All guest, booking, rate and content data a hotel puts into Book2dream, or that is generated by guests booking through it, remains the hotel's property. Our rights to it extend no further than what we need in order to run the service for that hotel.

A Hotel Customer can export its data at any time in a structured, machine-readable format, and can ask us to delete it. On termination we return or delete it as described in the Terms of Service.

8How we keep data secure

Storing a hotel's data securely is part of the product, not an add-on. These are the controls we operate:

• Encryption in transit using TLS 1.2 or higher on every connection, and encryption at rest using AES-256 for databases, backups and file storage.
• Least-privilege access: only the Book2dream staff who need production access to run the service have it, each through a named account with mandatory multi-factor authentication.
• Logical separation of every hotel's data, so one Hotel Customer can never reach another's records.
• Continuous logging and monitoring of access to production systems, with alerting on anomalous activity.
• Encrypted backups, tested regularly, with defined recovery point and recovery time objectives.
• Vulnerability scanning, prompt dependency patching and periodic penetration testing.
• Vetted infrastructure providers operating certified data centres.
• A documented incident response plan. If a breach affects a hotel's data, we notify that hotel without undue delay and within 72 hours of becoming aware, with what we know and what we are doing about it.

9Service providers and subprocessors

We keep the vendor list short and work with established providers under written data processing agreements. The full list, with what each provider does and where it operates, is in our Data Processing Terms at book2dream.com/data-processing. In summary:

• Hosting, storage and monitoring — Heroku, Vercel, Amazon Web Services, Datadog and Papertrail.
• Messaging — Amazon SES for email, Twilio for text messages and calls, and Kapso and Meta for WhatsApp.
• AI features — OpenRouter, which routes requests to the language model chosen for each feature.
• Card security and billing — PCI Booking for guest card details, and Paddle, Mercado Pago and Haulmer for our own billing and invoicing.
• Analytics — PostHog for product analytics, and Google Analytics for our marketing website, only with your consent.

10International transfers

Book2dream serves hotels across Latin America and guests from around the world, so personal data may be processed outside the country where it was collected, including in the United States and the European Union where our infrastructure providers operate.

Where we transfer personal data out of a jurisdiction that restricts it, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses, alongside the technical measures described above.

11How long we keep data

• Guest and booking data: for as long as the hotel instructs us to keep it, then deleted or returned according to the hotel's retention settings and our agreement with it.
• Hotel account and billing data: for the life of the contract, plus the period Chilean commercial and tax law requires.
• Demo requests and enquiries: up to 24 months from our last contact, unless you ask us to erase them sooner.
• Server and security logs: normally 12 months.
• Aggregated, de-identified statistics: indefinitely, because they can no longer identify anyone.

12Your rights

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to how we use it, receive a portable copy, and withdraw consent at any time. Exercising these rights is free, and we respond within the period the applicable law sets — 30 days in most cases.

If you are a hotel guest, the hotel that took your booking is the controller of your data, so please contact the hotel first. If you come to us instead, we will pass your request on and help the hotel answer it.

You also have the right to complain to your data protection authority.

13Cookies and similar technologies

Our website sets strictly necessary cookies to remember your language and to record your cookie decision. Before you decide, those are the only cookies present.

Analytics cookies are off until you turn them on. We ask on your first visit, and Google Analytics is loaded only if you accept — if you refuse, no request is made to Google and no analytics cookie is set. Refusing is one click, exactly like accepting.

You can change or withdraw your choice at any time through the Cookie Preferences link in our footer. Withdrawing also deletes the analytics cookies already stored on your device.

Booking engines we run for hotels use session cookies needed to hold a reservation in progress, plus any analytics the hotel chooses to enable under its own privacy policy.

14Children

Book2dream is a business tool, and the booking engines we operate are intended for adults. We do not knowingly collect personal data directly from children, other than details an adult provides as part of a booking, such as the number and ages of children in a party. If you believe a child has given us data directly, write to us and we will delete it.

15Changes to this policy

We update this policy when the product or the law changes. The date at the top always reflects the current version, and we give Hotel Customers reasonable advance notice of material changes affecting how we handle guest data.

16Contact us

Questions, requests or complaints about privacy can be sent to contact@book2dream.com.