Modern Hotel Booking — Privacy Policy

Privacy First — Always

Modern Hotel Booking was built on one principle: your guest data belongs to you, not us. Every booking record, every guest detail, every pricing configuration stays inside your own WordPress database. We never see it.

Last updated: July 2026 — covers both the free and Pro versions of Modern Hotel Booking

1. Data Storage & Ownership

Unlike SaaS reservation platforms that store your guest information in third-party cloud datacentres, Modern Hotel Booking operates entirely within your own WordPress installation. All booking records, room configurations, pricing rules, guest contact details, and reservation histories are saved exclusively to your own WordPress database on your own hosting server.

We — the developer of Modern Hotel Booking — never receive, access, store, or process your guest data. There are no telemetry calls, no usage reporting, and no analytics data sent back to our servers. All third-party JavaScript libraries used by the plugin are bundled locally and served from your own server. Nothing is loaded from external CDNs. The one exception is the Pro version licence checker — this periodically contacts our servers to verify your licence status and check for available plugin updates. This check contains only your licence key and your site URL. It contains no guest data, no booking records, and no personal information of any kind.

You own your data completely. If you uninstall the plugin, your booking data remains in your WordPress database under your control. We have no copy of it and no ability to access it.

2. What Data the Plugin Collects

The plugin collects only what is necessary to process a booking. All data is stored locally in your WordPress database. Nothing is transmitted to the plugin developer.

3. AI Concierge Data Handling

The AI Concierge is an optional feature. It is disabled by default. If you choose to enable it, guest chat messages and the property context you configured (amenities, rules, pricing information) are transmitted to your chosen AI API provider — either Google Gemini or OpenAI — to generate a response. This data is sent directly from your server to the AI provider’s API. It does not pass through our servers at any point.

To minimise data exposure, conversation histories are cached locally as WordPress Transients with a maximum lifespan of 2 hours. After that they are automatically deleted by WordPress. No personally identifiable information is permanently stored by the AI Concierge feature. Guests are not asked to log in or identify themselves to use the chat.

If you enable the AI Concierge on a site serving EU residents, you should inform guests via your privacy notice that chat messages may be processed by a third-party AI provider. The relevant privacy policies for those providers are:

• OpenAI Privacy Policy ↗
• Google Privacy Policy (Gemini) ↗

4. Rate Limiting & Spam Prevention

To protect your booking endpoints from spam submissions and automated abuse, the plugin stores anonymised per-IP request counts as WordPress Transients. These have a Time-To-Live of 2 minutes and are deleted automatically by WordPress. No IP addresses are stored permanently in any database table or log file by the plugin. No IP data is ever sent to our servers.

5. Third-Party Services

The free version of Modern Hotel Booking works entirely offline within your WordPress installation and makes no external API calls. The Pro version supports optional connections to the following external services. Each is only activated if you choose to configure it. None are enabled by default.

Service	Purpose	Data Sent	Privacy Policy
Pro Licence Server (modernhotelwp.com / startmysuccess.com)	Licence verification & update checks (Pro only)	Licence key and site URL only — no guest data, no booking records, no personal information	This privacy policy
Stripe	Card payment processing (Pro)	Payment amount, card details (handled by Stripe directly)	stripe.com/privacy ↗
PayPal	PayPal checkout (Pro)	Booking amount, redirect to PayPal	paypal.com/privacy ↗
Revolut	Payment link / QR display (Free & Pro)	Your RevTag or payment link is displayed — guest initiates payment through Revolut independently	revolut.com/legal/privacy ↗
OpenAI	AI Concierge responses (optional)	Guest chat messages + your property context	openai.com/privacy ↗
Google Gemini	AI Concierge responses (optional)	Guest chat messages + your property context	policies.google.com ↗
iCal Feeds (Airbnb, Booking.com, VRBO, Google Calendar)	Availability sync (Pro)	Date blocks and availability status only — no guest PII is included in iCal feeds	Governed by respective platform policies

6. “Powered By” Link

The plugin includes an optional “Powered by Modern Hotel Booking” link that can be displayed on your booking forms. This is disabled by default. If you choose to enable it, a visible link to modernhotelwp.com appears on your frontend booking form. No tracking data, cookies, or analytics information is sent when this link is displayed or clicked. Enabling or disabling it has no effect on plugin functionality.

7. GDPR — Your Obligations as a Hotel Owner

If your property serves guests from the European Union or European Economic Area, GDPR applies to how you collect and handle their personal data. As the operator of your WordPress site, you are the data controller. Modern Hotel Booking is a tool that helps you collect bookings — it does not make you compliant by itself. Compliance is your responsibility as the property owner.

The lawful basis for processing guest booking data under GDPR Article 6 is contractual necessity (Article 6(1)(b)) — you need a guest’s name, email, and dates to fulfil their reservation. You do not need separate consent to collect this information, but you do need to inform guests about it clearly at the point of booking.

Steps you should take as a hotel owner operating under GDPR:

• Link to your privacy policy from your booking form so guests can read it before completing a reservation
• Only collect the guest fields you genuinely need to process a booking — don’t add unnecessary custom fields
• If you plan to send guests marketing emails after their stay, obtain explicit consent at booking — this is separate from the contractual necessity basis
• Have a documented process for handling data deletion requests from guests
• If you use the AI Concierge, disclose in your privacy notice that chat messages may be processed by a third-party AI provider
• Consider using an EU-based hosting provider if the majority of your guests are EU residents

The Pro version of Modern Hotel Booking includes a built-in GDPR toolkit: mandatory privacy consent checkboxes on the booking form, and automated data erasure tools that allow you to delete or anonymise guest records from your database upon a guest’s formal request.

8. Guest Rights Under GDPR

Guests who make a booking through your Modern Hotel Booking-powered site have the following rights under GDPR. These rights are exercised against you as the data controller — not against the plugin developer, who holds no copy of their data.

• Right of Access — a guest can request a copy of all personal data you hold about them
• Right to Rectification — a guest can ask you to correct inaccurate data
• Right to Erasure — a guest can request deletion of their booking records (the Pro version includes automated tools for this)
• Right to Data Portability — a guest can ask for their data in a portable format
• Right to Restrict Processing — a guest can ask you to limit how their data is used
• Right to Object — a guest can object to processing based on legitimate interests

To handle a guest’s rights request, you can access and manage all booking records directly from the WordPress admin dashboard. The Pro version includes automated erasure tools. All guest data lives in your database — you have full control over it at all times.

9. Data Retention

Modern Hotel Booking does not enforce automatic data retention periods — that is your decision as the data controller, based on your own legal obligations. As a guide, most hospitality businesses in the EU retain booking records for the duration required by local tax and accounting regulations (typically 5–7 years), then delete or anonymise them. GDPR’s storage limitation principle requires you not to keep data longer than necessary for the purpose it was collected.

• AI Concierge conversations — auto-deleted after 2 hours (WordPress Transients)
• Rate limiting data — auto-deleted after 2 minutes (WordPress Transients)
• Booking records — retained until you manually delete them or use the Pro erasure tools
• Payment credentials — stored in your WordPress options table until you remove them from settings

10. CCPA & US State Privacy Laws

If your property accepts bookings from residents of California, Virginia, Colorado, Texas, or other US states with active privacy legislation, additional obligations may apply to you as the property operator. Modern Hotel Booking does not sell, share, or disclose guest personal data to any third parties for advertising or marketing purposes. The plugin developer does not receive any guest data, so there is no data sale or sharing on our end.

If you use the AI Concierge and serve US residents, note that chat messages are transmitted to your chosen AI provider (OpenAI or Google) and their data handling is governed by their own privacy policies and terms. California residents making a booking through your site have the right to know what personal information is collected about them and to request deletion — both of which you can facilitate directly from your WordPress admin as the data controller.

11. Security

Modern Hotel Booking follows WordPress security best practices throughout its codebase. Booking form inputs are sanitised and validated before being written to the database. All database queries use prepared statements to prevent SQL injection. Payment gateway credentials you configure are stored in the WordPress options table and are never exposed in frontend output.

The security of your WordPress installation itself — hosting configuration, SSL certificate, WordPress core and plugin updates, admin password strength — is your responsibility as the site operator. We recommend using a reputable hosting provider, keeping WordPress and all plugins updated, and running your site over HTTPS at all times.

Security issues with the plugin can be reported directly to [email protected]. We follow responsible disclosure practices and aim to respond to security reports within 48 hours.

12. Contact for Privacy Requests

This privacy policy covers how the Modern Hotel Booking plugin handles data. If you are a guest who made a booking through a site powered by Modern Hotel Booking and you want to access, correct, or delete your booking data — you need to contact the property owner directly, as they are the data controller and hold your data on their own server. We do not hold any guest booking records.

If you are a property owner or developer with questions about this privacy policy, the plugin’s data handling, or to report a privacy or security concern: