Política de privacidad

Who we are

[Fondas Technologies, S.L.] ("Fondas", "we", "us") provides operations software to hotels. Our registered office is [Street, Postal code, City], Spain ([CIF: B-00000000]).

This policy explains what personal data we process, why, on what legal basis, and the rights you have under the EU General Data Protection Regulation (GDPR) and Spanish data-protection law. For any privacy question or request, contact us at privacy@fondas.app.

Two roles: controller and processor

We handle personal data in two distinct roles, and it matters which applies:

• Controller — for data about our direct customers: the hotel staff who create accounts and use Fondas (name, work email, login credentials, settings, and usage/diagnostic data). We decide how this data is used.
• Processor — for the hotel operational data we handle on a hotel's behalf: reservations, guest profiles, and mailbox contents pulled from the systems a hotel connects. The hotel is the controller of that data; we only process it to provide the service under the hotel's instructions and our Data Processing Agreement.

Data we process

Depending on your relationship with us, this may include:

• Account data: name, work email address, password (stored hashed by our auth provider), hotel name, room count, timezone, language, and product settings.
• Hotel/PMS data (as processor): reservation records, arrival/departure and occupancy data, and guest profile fields retrieved from the hotel's property management system (MEWS or Apaleo) via official read APIs.
• Mailbox data (as processor): when a hotel connects Gmail, the content and metadata of guest emails needed to classify messages and draft replies.
• Connection credentials: OAuth tokens and API keys for connected PMS and mailbox accounts, encrypted at rest.
• Newsletter data: if you sign up for our product notes, the email address you enter, the language you signed up in, and the date you confirmed.
• Technical data: log, device, and error-diagnostic data used to keep the service secure and reliable.

Newsletter and marketing email

If you enter your address in the newsletter form on our website, we send you a single email asking you to confirm. We add you to the list only if you confirm — until then your address is stored as unconfirmed and receives nothing further. If you never confirm, we do not email you again. The legal basis is your consent, which you can withdraw at any time using the unsubscribe link in any newsletter or by contacting us. We do not sell or share the list, and we do not use it for anything other than these product notes.

How and why we use data (legal bases)

We use account data to provide, secure, and support the service, and to communicate with you about it — on the basis of performance of our contract with you and our legitimate interests in running and improving Fondas. We process hotel and mailbox data solely to deliver the features the hotel has enabled (morning briefings, email drafting, check-in chasing, and answering questions about the hotel's own data), on the documented instructions of the hotel as controller. Where required, we rely on the hotel having obtained any necessary consent from its guests.

AI processing

To generate briefings, classify emails, draft replies, and answer questions, we send the relevant hotel data to our AI sub-processor, Anthropic, via its API. This data is processed to produce output for the hotel and, under Anthropic's commercial API terms, is not used to train its models. We do not sell personal data, and we do not use guest personal data to train any models of our own.

Sub-processors

We rely on the following sub-processors to run Fondas. We maintain contracts with each requiring appropriate data-protection safeguards, and we will keep this list current:

• Supabase — database and authentication (hosting of account and hotel data).
• Vercel — application hosting and delivery.
• Anthropic — AI processing of briefings, email drafts, and queries.
• Google (Gmail API) — where a hotel connects its inbox.
• Resend — outbound email delivery (e.g. briefing emails).
• Sentry — error monitoring (configured not to send guest personal data).
• The hotel's chosen PMS (MEWS or Apaleo) and mailbox provider, which remain independent controllers of the data in their own systems.

International transfers

Some sub-processors are located outside the European Economic Area. Where data is transferred outside the EEA, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses (together with any additional safeguards required) to protect it.

Retention

We keep account data for as long as you have an account and for a reasonable period afterwards to meet legal, accounting, and security obligations. Hotel and mailbox data processed on a hotel's behalf is retained per our Data Processing Agreement and deleted or returned on request or when the hotel closes its account, subject to short-term backups. Connection tokens are deleted when a hotel disconnects an integration.

Security

We apply technical and organisational measures appropriate to the risk, including encryption of connection tokens at rest, strict per-hotel access controls enforced at the database level (row-level security), least-privilege service access, and error monitoring. No system is perfectly secure, but we work to protect your data and to notify affected parties of any breach as required by law.

Your rights

Subject to conditions in the GDPR, you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. To exercise these rights over account data, contact privacy@fondas.app. If you are a hotel guest, please direct requests to the hotel that holds your booking (the controller); we will assist that hotel in responding. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD, www.aepd.es).

Cookies

Fondas uses only the cookies strictly necessary to keep you signed in and to keep the service secure. We do not use advertising cookies. If we add analytics in future, we will update this policy and request consent where required.

Changes to this policy

We may update this policy from time to time. Material changes will be notified through the service or by email. The date below indicates when it was last revised.