Privacy Policy

Hotflow helps hotels, restaurants, bars, and related businesses manage operations such as front office, POS, housekeeping, room service, finance, and reporting. Processing personal data is necessary to provide authentication, multi-user workspaces, guest and staff records you choose to enter, and optional integrations.

For account registration, billing contact details, and platform administration, Hotflow (as identified in the legal entity line above) acts as a data controller or equivalent role under applicable law.

For guest profiles, employee records, bookings, payments, and other operational content you upload or create in your workspace, you typically act as the controller (or primary decision-maker) for that data, and Hotflow processes it on your instructions to deliver the Service. You are responsible for providing notices to guests and staff and for having a lawful basis to collect and use their information.

Account and identity data: name, email address, password (stored in hashed form), business name, selected plan, sector modules, role assignments, and business identifiers generated for your workspace.

Usage and technical data: sign-in timestamps, IP address and device/browser characteristics received in server logs, actions needed for security and audit trails within the product, and error diagnostics where enabled.

Communications: messages you send via our contact or demo request forms, support correspondence, and subscription or billing communications.

Marketing site: our public pages do not require an account. We do not use third-party advertising cookies on the marketing site based on our current implementation; see the Cookie Policy for browser storage details.

Depending on modules you enable, your workspace may include, among other things:

• Guest and visitor names, contact details, identification references, and stay history;
• Reservations, check-in/check-out records, folios, invoices, and payment records;
• Restaurant, bar, and room-service orders, tables, menus, and staff assignments;
• Housekeeping tasks, maintenance notes, and room status;
• Inventory, suppliers, expenses, revenue categories, tax settings, and financial reports;
• Staff user accounts, roles, permissions, and optional profile or notification preferences.

You control what is entered and how long it is kept in the product subject to your subscription and retention settings.

We process information to:

• Provide, secure, and maintain the Service (contract performance and legitimate interests in operating a SaaS platform);
• Authenticate users, enforce roles, and protect against abuse (legitimate interests and legal obligations);
• Manage trials, subscriptions, and billing communications (contract and legal obligations);
• Respond to support requests and improve reliability (legitimate interests);
• Comply with law, respond to lawful requests, and establish or defend legal claims (legal obligations and legitimate interests).

Where consent is required for a specific processing activity (for example, optional marketing emails if we offer them separately), we will request it clearly and allow withdrawal.

Optional integrations: if you connect services such as QuickBooks (where available on your plan), selected financial or account-mapping data is exchanged with that provider according to your configuration and their policies. Push notifications for certain guest-facing features may use web push endpoints you opt into on supported devices.

We do not sell personal information. We may disclose data if required by law, to protect rights and safety, or in connection with a merger or acquisition subject to appropriate safeguards.

We apply access controls, role-based permissions within workspaces, and industry-standard practices such as encrypted transport (HTTPS) for data in transit. No method of storage or transmission is completely secure; we cannot guarantee absolute security.

You should use strong passwords, limit admin roles, and sign out on shared devices. Session lock and related features in the product use browser storage as described in our Cookie Policy.

We retain account and workspace data for as long as your subscription or trial is active and for a reasonable period afterward to allow export, resolve disputes, and meet legal obligations. Specific retention periods may vary by data type and regulatory requirements.

You may request closure of a workspace or deletion of personal data by contacting us. Some information may be retained in backups or logs for a limited time or where the law requires retention (for example, billing records).

Your data may be processed in Tanzania and in other countries where our hosting or subprocessors operate. Where transfers occur across borders, we aim to use appropriate safeguards consistent with applicable law. Details of hosting locations depend on your production deployment configuration.

Depending on applicable law (including Tanzania's personal data protection regime where it applies to you), you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability where technically feasible.

Workspace owners should handle guest and employee requests for data held in their business records. For platform-level requests (account email, billing contact, or questions about Hotflow's processing), contact support@gethotflow.com with sufficient detail to verify your identity. We will respond within a reasonable timeframe.

Privacy inquiries: support@gethotflow.com. General contact: hello@hotflow.co.tz or contact form.

We may update this Privacy Policy by posting a new version on this page with an updated date.