Privacy policy

Data controller

The controller for the personal data of service users is:

• Company name: Encinacorba Sales Consulting Co., Ltd.
• Registration number: 0845567007267
• Registered address: 53/530 Pruksa 20 Village, Moo 2, Khu Khot Sub-district, Lam Luk Ka District, Pathum Thani 12130, Thailand
• Representative: Adrian Gasca Sancho (Director)
• Email for privacy matters and exercising rights: soporte@meo67.com

For guest data that the customer enters or receives from sales channels, the customer is the controller and meo67 acts as the processor (see section 3).

Data we process

Depending on how you use the service, we process the following categories of data:

• Account and contact: name, email address, phone number, password (encrypted, never in plain text), language, business type and application preferences; details of team members you invite.
• Properties: name, address, features, photos, rates, restrictions, licences and other information about the units you list, together with the identifiers linking them to each sales channel.
• Bookings and guests: data you enter or sales channels send us with each booking: guest name, email, phone number, stay dates, number of people, amounts, booking status and, if you upload it, data required for guest registration.
• Messages: guest conversations that channels make available to you and, if you activate messaging, messages exchanged through that medium, with their attachments.
• Billing: tax details, subscribed plan, payment history and payment provider identifiers. Payments are processed through Stripe: your card details are not stored in our systems.
• Usage and technical data: IP address, browser and device, pages visited, activity logs and error logs necessary to operate and protect the service.

We do not process special categories of data (health, ideology, etc.) or ask you to enter them. If a guest communicates such data in a message, it remains your responsibility as the data controller.

Guest data: who is responsible

We process guest data and data about other people that you enter into the service or receive through sales channels on your behalf and following your instructions. You are the controller of that processing (you decide what the data is used for and must inform guests), and meo67 is your processor.

Our obligations as processor (confidentiality, security, subprocessors, assistance and return or deletion at the end of the relationship) are set out in the “Data protection” section of the terms and conditions. If a guest contacts us directly with a request about their data, we will pass it to the relevant customer.

Purposes and legal bases

We process your data for the following purposes and on the legal bases indicated:

• Providing the service (creating and maintaining your account, syncing availability, rates and bookings with sales channels, displaying the calendar and messages, providing support): performance of the contract you accept when signing up.
• Billing and collecting payment for the subscribed plan, issuing invoices and handling unpaid amounts: performance of the contract and legal obligation (tax and accounting legislation).
• Service communications (syncing alerts, end of trial, changes to terms, security incidents): performance of the contract and legitimate interest in keeping you informed about matters affecting your account.
• Security, fraud and abuse prevention(access logs, anti-bot verification at login and signup, blocking compromised accounts): legitimate interest in protecting the service, customers and their guests.
• Service improvement and support (aggregated usage analysis, error diagnosis): legitimate interest in maintaining and improving the platform, with data minimised wherever possible.
• Compliance with legal obligations and responding to requests from authorities: legal obligation.

We do not send third-party marketing communications or make automated decisions with legal effects on you. If we wish to send you our own marketing information in the future, we will ask for your consent, which you may withdraw at any time.

Recipients and data processors

We do not sell your data. We share it only with the providers we need to deliver the service, who act as processors under contract, and with those to whom we are legally required to disclose it:

• Hosting and infrastructure: OpenAI (Sites) and Cloudflare (publication and delivery of meo67.com and its account pages), Supabase (database, authentication and file storage) and Vercel (management application servers).
• Payments: Stripe processes payments and retains your payment method details; we receive only identifiers and transaction statuses.
• Sales channel connectivity: the connectivity provider through which we sync your properties and, as independent recipients, the sales channels you choose to connect to (each with its own privacy policy).
• Messaging: if you activate WhatsApp messaging, Meta and the technical providers that enable it process phone numbers and message content under their terms.
• Transactional email: the email delivery provider we use for service notifications.
• Security and monitoring: the anti-bot verification provider (Cloudflare Turnstile) at login and signup, and the application's error logging tools.
• Authorities and third parties under a legal obligation:public authorities, judges or law enforcement where there is a valid request.

If we change a provider that processes personal data, we will update this policy and, where guest data is affected, notify customers as set out in the terms.

International transfers

Some of the providers above may process data outside the European Economic Area (for example, in the United States). Where this occurs, the transfer relies on a European Commission adequacy decision (including the EU–US Data Privacy Framework for certified companies) or the standard contractual clauses approved by the Commission, together with any necessary supplementary measures.

The controller may be established outside the European Economic Area (Thailand). In that case, we also apply the safeguards described and the security measures in section 10 to all data relating to users and guests residing in the European Union. You can request further information about these safeguards at soporte@meo67.com.

Data retention

• Account, property, booking and message data: while the account is active. After closure, or after a reasonable period of inactivity following a trial that does not convert, data is deleted or anonymised within a maximum of 90 days, unless there is a legal obligation to retain it or an outstanding claim.
• Billing data: for the periods required by applicable tax and accounting legislation (generally between 4 and 6 years from the last invoice).
• Technical and security logs: for a limited period (generally no more than 12 months), unless needed to investigate an incident.
• Backups: deleted data may remain in encrypted backups for a short additional period until rotation, without being used for any other purpose.

You can request account closure and early deletion through settings or by writing to soporte@meo67.com.

Your rights

You have the right to:

• Access: know what data we process about you and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed.
• Object: object to processing based on legitimate interest.
• Restriction: ask us to restrict processing in the circumstances provided for by law.
• Portability: receive your data in a structured, commonly used format, or have it transmitted to another provider where technically feasible.
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of earlier processing.

To exercise these rights, write to soporte@meo67.com from your account email address or with proof of your identity. We will respond within one month, extendable in complex cases in accordance with the regulations.

If you believe we have not properly addressed your rights, you can lodge a complaint with the competent supervisory authority: in Spain, the Spanish Data Protection Agency (www.aepd.es), or the authority in your country of residence within the European Union.

Cookies

The service uses only technical cookies and similar technologies necessary for the application to work. We do not use advertising cookies or third-party tracking cookies.

• Session and authentication: keep you logged in and protect the account against unauthorised access. They expire when you log out or after a period of inactivity.
• Preferences: remember settings such as the visual theme, language or application mode. They are saved in your browser's local storage.
• Security: anti-bot verification at login and signup may set a technical cookie from the security provider to distinguish people from automated programs.

As they are all necessary for the service to function, they do not require consent. You can delete or block them through your browser settings, although you will then be unable to log in.

Security

We apply technical and organisational measures appropriate to the risk to protect data against unauthorised access, loss or alteration, including:

• encryption of communications (TLS) and data at rest in our providers' infrastructure;
• isolation of each customer's data and access control by account and role;
• passwords stored using secure hashing functions and anti-bot verification at login;
• regular backups and logging of relevant activity;
• staff access limited to what is strictly necessary and subject to confidentiality obligations.

If a security breach affects your data, we will notify the supervisory authority and, where appropriate, the affected individuals within the time limits required by the regulations. You also contribute to security by using a strong, unique password and reviewing your team's access.

Changes to this policy

We may update this policy to reflect changes in the law, providers or the service. Material changes will be communicated by email or through an in-app notice before they take effect. The last updated date appears at the top of this page, and the current version is always available here.

For any questions about this policy, write to soporte@meo67.com.