Security

How we handle your data

Fondas reads the bookings in your PMS and the mail in your hotel's inbox. This page says exactly what we read, what we store, where it is hosted and what happens the day you leave. Written to be read without a lawyer; the full privacy policy is linked at the end.

Updated 2 October 2026

What we read

Only what it takes to write your morning brief, your drafts and the answers about your hotel.

From your PMS: bookings, arrivals and departures, occupancy, rates and the guest profiles attached to them. Through the official MEWS and Apaleo APIs, read-only.
From your inbox: the messages in the mailbox you connect, contents included, so we can sort them and draft the reply.
From your account: your name, your work email and the hotel's settings — rooms, timezone, language and the hour you want the brief.

What we store

We store it, and we say so plainly because it is the part some people skip. The seven o'clock brief and the drafts do not come out of thin air: they are written from bookings and emails held in our database. Without storing them there is no brief.

The bookings and guest profiles we sync from your PMS.
The guest emails we read and the drafts we write, until you send or discard them.
Your connection credentials, encrypted.
Guest profiles — what we've worked out about a returning guest, and any note your team has written. Kept for 24 months after their last stay, then deleted.
Chat transcripts, with guest surnames shortened to an initial before they're stored. The answer on your screen shows the full name; the stored copy doesn't.

Each hotel lives in its own space, isolated in the database by row-level security: one property cannot see another's data, not even by accident.

How Fondas uses AI

Under the EU AI Act, Fondas is the provider of a limited-risk AI system, and each hotel that uses it is a deployer.

The Act's high-risk rules don't apply to anything Fondas does. What does apply — marking what the AI writes, and saying when you are dealing with it — is set out for every feature below.

Reply drafts

Claude Sonnet 4.6, by Anthropic claude-sonnet-4-6

Reads: The guest's email and its thread, the booking it matches and the guest's profile, and the house details and tone you set in Settings.
Writes: A reply in the guest's language, waiting in Communications. Complaints are not drafted: they wait for a person.
Who sees it: Your team, in Communications. A guest only ever sees what your team sends.
Before anything leaves: A person on your team. Nothing is sent until someone presses Send, or confirms a bulk send of drafts they have reviewed.
Where it can be wrong: A date, a price or a policy it wasn't given. Check the facts before you send.
Kept: With the email, while your hotel uses Fondas.
Under the AI Act: Art. 50(2): every reply sent from a draft carries a machine-readable AI mark in its headers. Your team sees on every draft that Fondas AI wrote it.

Arrival-time requests

Claude Sonnet 4.6, by Anthropic claude-sonnet-4-6

Reads: Confirmed bookings arriving in the next seven days without an arrival time: the guest's first name, email and language.
Writes: A short email asking the guest when they expect to arrive.
Who sees it: Your team, under Arrivals & departures.
Before anything leaves: A person on your team sends it. Nothing goes out on its own.
Where it can be wrong: It knows only the booking — not that the guest already told you on the phone.
Kept: While your hotel uses Fondas.
Under the AI Act: Art. 50(2): marked like a reply when it is sent, and labelled as drafted by Fondas AI for your team.

Morning Brief

Claude Opus 4.8, by Anthropic claude-opus-4-8

Reads: Today's arrivals and departures with guest surnames cut to an initial, VIPs and requests, the sender and subject of overnight guest email, occupancy and rates for the next 14 nights, and your house settings.
Writes: The day's brief, emailed to the people you choose at the hour you set, and kept on the Morning Brief page.
Who sees it: You and the recipients you add. No guest ever receives it.
Before anything leaves: It goes only to your team. Read it as a summary, not as the record: your PMS is the record.
Where it can be wrong: It is as fresh as the last sync with your PMS, and it can misread a note or a request.
Kept: While your hotel uses Fondas.
Under the AI Act: Art. 50(2): the email carries a machine-readable AI mark, and the page says Fondas AI wrote it.

Ask

Claude Sonnet 4.6, by Anthropic claude-sonnet-4-6

Reads: Your question as you type it, and a snapshot of the hotel: bookings for the next 14 days with guest surnames cut to an initial, inbox counts, occupancy and rates, and your house settings.
Writes: An answer, and an email draft if you ask for one.
Who sees it: The person who asked. Each person's conversations are their own.
Before anything leaves: Nothing leaves Fondas from Ask. A draft it starts goes to Communications and waits for Send like any other.
Where it can be wrong: It can misread the data or miss what isn't in it. It says when it doesn't know; double-check key figures.
Kept: Your ten most recent conversations, with guest surnames cut to an initial. Older ones are deleted, and you can delete any of them.
Under the AI Act: Art. 50(1): you are told you are talking to an AI, on every answer.

Guest preferences

Claude Haiku 4.5, by Anthropic claude-haiku-4-5-20251001

Reads: A returning guest's emails and bookings with your hotel.
Writes: Trip purpose, occasion and preferences on the guest's record, each marked as inferred.
Who sees it: Your team, on the guest's record.
Before anything leaves: Your team. Anything a person sets wins and is never overwritten, and notes are only ever written by people.
Where it can be wrong: It infers from what the guest wrote, and an inference can be wrong. Correct it and it stays corrected.
Kept: 24 months after the guest's last stay, then deleted.
Under the AI Act: Labelled as inferred by Fondas AI wherever it appears. Never used to score or rank a guest.

Sorting guest email

Claude Haiku 4.5, by Anthropic claude-haiku-4-5-20251001

Reads: Each email that arrives in the mailbox you connected.
Writes: A category, the language and any booking reference it finds, so each message lands in the right place.
Who sees it: Your team, in Communications.
Before anything leaves: It sends nothing. Every message stays in your inbox, whatever it was sorted as.
Where it can be wrong: It can file a message under the wrong category, or miss a booking reference written in an unusual way.
Kept: With the email, while your hotel uses Fondas.
Under the AI Act: No disclosure duty of its own: it sorts mail and writes to no one.

Review summary

Claude Haiku 4.5, by Anthropic claude-haiku-4-5-20251001

Reads: The reviews you paste into Settings › Hotel information.
Writes: Two or three sentences on what guests praise, which drafts and the brief can draw on.
Who sees it: Your team, in Settings.
Before anything leaves: You see it in Settings, and you can replace it.
Where it can be wrong: It knows only the reviews you paste.
Kept: In your hotel's settings, until you replace it.
Under the AI Act: No disclosure duty of its own: it stays inside Fondas. Recorded with the model and version that wrote it.

Where it is hosted

In the European Union. The database holding your bookings, your guests and your emails sits on European servers and is encrypted at rest.

To write the briefs and the drafts we send the data needed to our AI provider, Anthropic, through its commercial API: under those terms it is not used to train its models. That is the only processing that leaves the European Economic Area, and it relies on the European Commission's Standard Contractual Clauses. The full list of providers is in the privacy policy.

What we never do

Write to your PMS. The connection is read-only: Fondas never edits a booking, never changes a rate, never touches a profile.
Send an email without someone on your team pressing the button. The draft waits; you decide whether it goes, and you can rewrite it first.
Train models on your guests' data — not ours, not anyone's.
Sell, rent or share your data with third parties for advertising.
Mix one hotel's data with another's.

Leave, and it is deleted

Cancel and we delete your hotel's data: bookings, guest profiles, emails and drafts. Short-term backups expire on their own. Your account and billing records are kept only for as long as the law requires.

You do not have to cancel to cut us off: disconnect the PMS or the mailbox in settings and the credentials are erased that moment. In the same step you can ask for the bookings and profiles already synced to go too.

Who answers for what

The hotel is the data controller for its guests' data; Fondas is the processor. That is not boilerplate: it means the data is yours, that we process it only to provide the service and on your instructions, and that when a guest exercises their rights, you are the one who answers — with our help.

For your own account data — your name, your work email, your settings — we are the controller.

What we do not have yet

We hold no ISO 27001 and no SOC 2, and we will not imply otherwise. Those certifications come with size, and we are not there. What we can give you today is this page: the exact list of what we read, what we store, where it lives and what we never do. If your process needs more than that, write to us and we will talk.

The full version

The privacy policy sets out the legal bases, the list of providers, international transfers and the rights the GDPR gives you. For any question about data, write to us: privacy@fondas.app

Read the privacy policy →