Privacy policy

For the accounts of hotels that sign up to NightStay and for people who contact us about NightStay, we decide how the data is used (we are the controller).

For the data a hotel keeps in NightStay about its own guests — bookings, guest details, payments, ID documents and the hotel’s WhatsApp and Facebook conversations — the hotel is the controller and we process that data only on its behalf and on its instructions (we are the processor). Guests should contact the hotel first about their data; we will help the hotel answer.

• Account data: name, email address, phone number, password (stored only as a one-way hash), the hotel’s name, address, country, currency and settings, and staff members invited by the hotel.
• Guest data entered by hotels or by guests on a hotel’s booking website: name, phone, email, country, stay dates, number of guests and children’s ages, notes, payments and — when the hotel turns guest registration on — photos of identity documents.
• Messages: WhatsApp and Facebook Messenger conversations between a hotel (or NightStay) and the people who write to it, including attachments and voice notes, received through Meta’s official APIs or a WhatsApp number the hotel links itself.
• Payment data: amounts, status and the gateway’s transaction reference. Card numbers and wallet PINs are entered on the payment provider’s own page — we never see or store them.
• Business contact data: to tell hotels about NightStay, we may use business phone numbers and names that hotels publish themselves (for example on Google Maps listings). Anyone can opt out at any time — see section 6.
• Technical data: IP address, browser type and log entries for security, fraud prevention and fixing errors.

• to provide the service: bookings, availability, invoices, payments, reports, the hotel website and the inbox;
• to run the AI assistant that answers a hotel’s (or NightStay’s) messages with that hotel’s own information, when the hotel switches it on;
• to send service messages: email verification, password resets, booking confirmations and receipts, and subscription invoices;
• to bill subscriptions and prevent fraud and abuse;
• to tell hotels about NightStay by email or WhatsApp — never to guests, and never after someone opts out.

We do not sell personal data. We share it only with service providers that help us run NightStay, and only what each one needs:

• Meta Platforms (WhatsApp Business Platform / Cloud API, Facebook Messenger) — to send and receive messages;
• AI model providers (such as DeepSeek, Google Gemini and OpenAI) — the text of a conversation, and attachments the hotel allows the assistant to read, to write a reply;
• Payment providers chosen by the hotel or used for subscriptions (for example ZiniPay, SSLCommerz, Stripe, PayPal, Pakasir and other local gateways) — to take a payment;
• Our hosting and email providers — the servers that store the data and the service that delivers our emails;
• Authorities, when the law requires it.

Some of these providers are outside your country; we use them only under contracts that require them to protect the data.

Account and booking data are kept while the hotel uses NightStay, and deleted when the hotel asks us to close its account, except what tax or accounting law requires us to keep. Guest identity documents are deleted automatically after the period the hotel sets. Technical logs are kept only as long as needed for security and troubleshooting. A hotel can delete bookings, guests, chats and contacts itself at any time.

You can ask to see, correct, export or delete your personal data, or object to how it is used, by writing to [email protected]. We answer within 30 days. If you are a hotel’s guest, we will pass your request to that hotel, which decides about its guest records.

Stop messages: reply STOP to any WhatsApp message from NightStay and you will not be contacted again; you can also write to [email protected].

To delete the data NightStay holds about you — including data received through Facebook or WhatsApp — email [email protected] from your account’s email address (or send a WhatsApp message from the number you used) with the subject “Delete my data”. We confirm and delete it within 30 days, except what the law requires us to keep. Hotels can also disconnect their Facebook Pages and WhatsApp numbers at any time in AI & Inbox → Devices, which stops all further access.

Data travels over HTTPS; passwords are hashed; access tokens for WhatsApp and Facebook are stored encrypted; every hotel’s data is kept separate; staff only see what their hotel allows; and we take regular backups. No system is perfectly secure — if a breach affects your data, we will tell you and the hotel without undue delay.

We use only the cookies the site needs: a sign-in cookie, and small preferences such as your language and light/dark theme. We do not use advertising or cross-site tracking cookies.

NightStay is a business tool for hotels and is not meant for children. Hotels may record the ages of children travelling with a guest only to price and plan the stay.

If we change this policy we update the date at the top and, for important changes, tell hotels by email. Questions: [email protected] · +8801609661599 · Contact page · Terms of service.