Privacy Policy

Wado is operated by TODOOR CONTRACTING, LLC and Alanitech, LLC ("we", "us"). Together we decide why and how the personal data described here is used. [TODO: confirm roles with the agreement between the two companies, and add a postal address.]

This policy covers the Wado website, the hotel dashboard, the Wado support dashboard (used by our team) and the guest pages opened from room and amenity links, QR codes and NFC tags. A hotel that uses Wado decides what to do with its own guests' requests; this policy describes what the service itself collects and does.

Contact: privacy@heywado.com.

Information a hotel or our team provides

• Hotel details: name, address, city, country, contact email and phone, an optional image, the front-desk phone and Wi-Fi network name shown to guests, and, if the hotel requires guests to be on site to send requests, the hotel's latitude, longitude and allowed radius.
• Account holder and administrator details: name, email address, phone number and account status. Passwords are held by our authentication provider, not in our own tables.
• Staff details: name, employee ID, phone number, notification preference, department and amenity links, and shifts. Staff members are listed for assignment and do not sign in to the dashboard. If the hotel or our team gives a staff member a login for the staff app, we also keep a sign-in account under a placeholder address (not an email), the PIN as a one-way hash that nobody can read back, the time of the last sign-in and the count of recent wrong PINs (an account is locked for a while after repeated mistakes). The staff app shows a staff member only the requests assigned to them, and records when they accepted, declined or finished one.
• Alerts on a device: a hotel administrator, department user or staff member who turns on alerts in their browser or installed app has that device's push address and keys stored, with the language, until they turn alerts off or the device stops accepting them. The alerts are delivered through the push service of the browser or phone maker (for example Google, Apple or Mozilla).
• Wado team accounts: name, email and status.
• Billing: the hotel's trial end date, subscription status and billing period, the identifiers Stripe gives our records (customer and subscription), a log of trial changes made by our team (who, when, old and new date, reason) and which trial notice emails we sent. The administrator's email and the hotel name are sent to Stripe to create the customer. Card details are entered on Stripe's pages and never reach our servers.
• Messages with our support team: the text (up to 2,000 characters) and the sender's name and email.
• Website contact form: the name, hotel name, work email, optional number of rooms and optional message you type. They are sent to our server, which posts them to our team's Slack channel so we can reply. We do not save them in our database; they remain in Slack. If the form cannot send, it opens your own email app instead and nothing reaches us until you press send there.

Information from guests

Guests do not create an account and are not asked for their name. When a guest sends a request we store the room or amenity name, the department and service, an optional free-text note (up to 500 characters; please do not include sensitive details), the urgency, the status, the times, and who it was assigned to. A hotel administrator can also create a request on a guest's behalf.

A guest can also start a live chat with the hotel from the room page. The page warns that the chat is temporary. Its messages (up to 500 characters each) are held only in our server's memory, never written to the database or logs, and are erased when either side ends the chat or after 10 minutes without messages.

If a hotel requires guests to be on site to send requests, the guest's browser asks permission to share the device's location when the guest presses send. The position is compared with the hotel's position and then discarded: we do not store or log it. If the guest declines, the request is not sent.

Collected automatically

• When a hotel administrator accepts the Terms, we store the version, the time, the IP address and the browser's user agent text.
• Our server uses IP addresses to limit how often a sign-in, a guest request or a similar action can be repeated. These counters are kept in memory and are not written to the database. [TODO: confirm what the hosting provider's own access logs record.]
• Our server writes operational logs. [TODO: confirm log contents, location and retention.]
• Guest room links are random tokens; they identify a room, not a person.

From third parties

We do not buy personal data. Our authentication and storage provider sends us account identifiers for users it signs in.

• Provide the service (to perform our contract with the hotel): show requests, assign staff, show history and analytics, send account invitations and password emails, show guest pages.
• Keep the service secure (legitimate interest): sign-in checks, rate limits, link expiry, abuse prevention.
• Support (contract and legitimate interest): answer chat messages and help hotels.
• Record acceptance of the Terms (legitimate interest and legal obligation): the version, time, IP and user agent are kept as proof.
• Contact messages (contract, or consent where required): invitation and notification texts, when the hotel enables them; and answering the inquiries sent through the website contact form (steps you take before a contract, legitimate interest).
• Legal compliance: when the law requires it.

We do not use personal data for advertising or marketing profiles, and we do not make decisions about people by automated means. When a request arrives and the hotel has turned on automatic assignment, the service can assign it to an available staff member of the right department who is on shift, and text that staff member if they chose text messages; this only routes work inside the hotel.

The service does not send personal data to any AI or large-language-model provider.

The website and the guest pages set no cookies and have no analytics or advertising scripts.

The dashboards use your browser's local storage:

• A session entry for the hotel dashboard (heywado.hotel.session) and one for the support dashboard (heywado.support.session) keep you signed in. They hold sign-in tokens until you sign out or they expire. Essential.
• A session entry for the staff app (heywado.staff.session) keeps staff signed in the same way, and the staff app remembers the hotel code typed at sign-in (heywado.staff.hotelCode) so it need not be typed again. Essential.
• Language preference (heywado.hotel.locale, heywado.support.locale, heywado.staff.locale), the sidebar state (heywado.sidebar.collapsed) and, in the hotel and staff apps, whether the alert sound is on (heywado.hotel.chime, heywado.staff.chime). Essential to the interface.

All of these are first-party and essential, so no consent banner is used. The website's contact form uses no cookies or local storage.

Fonts: the dashboards, the staff app and the guest pages load typefaces and icons from Google Fonts, so Google receives the visitor's IP address and browser details when a page loads. The website serves its fonts and icons itself. [TODO: confirm whether to self-host fonts in the apps.]

We do not sell personal data or share it for targeted advertising. We use these providers to run the service:

• Supabase: database, sign-in, file storage for hotel images, and the invitation and password emails. All account, request, chat and acceptance data is stored here. [TODO: confirm hosting region and the sub-processor agreement.]
• Bird: text messages, only when a hotel enables them, and trial notice emails to the hotel's administrator; Bird receives the phone number or email address and the message text.
• Stripe: subscription payments. Stripe receives the hotel name and the administrator's email and collects the card details and billing information directly; our records keep only Stripe's customer and subscription identifiers and the subscription status.
• Slack: our team's workspace. For the website contact form, Slack receives the message that notifies our team, which contains the details you typed.
• Google Fonts: typefaces and icons for the dashboards and guest pages, as described above.
• Hosting provider: [TODO: name the provider that runs the server and the website].

We also share data with the hotel it belongs to, and when the law requires it or to protect our rights, or in a business transfer.

The service does not delete most records automatically. [TODO: set and confirm retention for each category below before publishing.]

• Guest room links expire after a set time from first use and are replaced; the QR code and tag keep working.
• Service requests and history: kept until the hotel's account is removed. [TODO: confirm.]
• Support chat messages: kept until the hotel's account is removed. [TODO: confirm.]
• Guest live chat messages: never stored; erased when the chat ends or after 10 minutes without messages.
• Staff, hotel and account records: kept while the account exists. Deleting a hotel removes its chat; request records keep the names recorded when they were created.
• Terms acceptance records: kept as long as the user's account exists.
• Billing records, the trial change log and the notice log: kept while the hotel's account exists. [TODO: confirm; invoices and payment records are kept by Stripe under its own retention and legal obligations.]
• Website contact inquiries: the Slack message. [TODO: confirm how long the team keeps them and Slack's retention.]
• Rate-limit counters: held in memory only.

Measures in place today:

• Row-level security is on for every database table, with no public access; only our server reads and writes data.
• Sign-in uses email and password through our authentication provider; sign-in, password-reset and guest actions are rate-limited.
• Hotel images are stored in a private bucket and shown through links that expire.
• Guest room links are long random tokens that expire and can be regenerated; NFC tag keys are derived and not stored.
• The server rejects unexpected input and limits which websites may call it.

No system is perfectly secure. Dashboard and staff app sign-in tokens are kept in the browser's local storage, so protect your device and sign out on shared computers. Tell us at privacy@heywado.com if you suspect a problem.

You can ask us to access, correct, delete or export your personal data, to object to or restrict how we use it, or to withdraw consent where we rely on it. Email privacy@heywado.com; we aim to answer within 30 days. [TODO: confirm response time.] We may need to verify who you are first. Where the hotel is responsible for the data, we may direct your request to the hotel.

EEA, UK and similar laws (GDPR / UK GDPR). You have the rights above and may complain to your data protection authority. Our legal bases are described in section 3.

California (CCPA / CPRA). You may ask what personal information we collect, use and disclose, and to correct or delete it, and you will not be treated differently for asking. We do not sell or share personal information for cross-context behavioural advertising.

Other US states. If your state gives you privacy rights, contact us and we will honor them as the law requires.

Staff and guests: if a hotel entered your details, contact the hotel first.

Data is processed by the providers above, which may be outside your country. [TODO: confirm processing locations and transfer safeguards.]

The service is for businesses and is not directed to children. [TODO: confirm the minimum age, for example 13, or 16 where required.] Guests send requests without giving their names; if you believe a child's personal data has reached us, contact us and we will delete it.

Hotels may add links, such as websites or phone numbers, to their service lists. Those sites have their own privacy practices.

When we change this policy, we will update the date above and, for material changes, tell hotel administrators in the dashboard or by email.

Privacy questions and requests: privacy@heywado.com.