Skip to main content
Your guests hand a hotel more than a name. A phone number, an e-mail address, where they slept, what they asked for, what they told your AI staff in confidence. Protecting that is not a setting on this platform — it is how the platform is built. This page describes what it does, so that you can read it yourself and hand it to whoever reviews these things for your hotel. Everything below exists today, on the platform your guests already use.

​
Collect little, refuse the rest

What is held: the guest’s name, the phone number or e-mail address they chose to be reached on, the stay (room, dates, party size, preferred language), what they asked for, the preferences they chose to have remembered, their ratings, and the conversation itself. What is refused, by design: Before a guest can see their own record, they prove they hold their own phone.

​
Every hotel is walled off from every other

Your guests’ data is separated from every other hotel’s, and that separation is enforced by the platform, not by people remembering to be careful.

​
Where it lives

The platform’s stores and backups are in the European Union. Data is encrypted in transit and at rest. Traffic to the platform is filtered for attacks.

​
Who can see it — and how every look is recorded

This is the part most systems get wrong, and it is where this platform is most deliberate. Most guest-data incidents in hospitality are not break-ins: they are legitimate accounts reading lists they were allowed to read. So the platform is built on one principle — a list is not a file — and every look at a full contact detail is on record.
Every staff screen shows a guest’s phone number and e-mail address masked — enough to recognise the guest, not enough to copy the number. That applies to every list, every detail panel, every live update pushed to a screen, every log your team can read.
To see a full phone number or e-mail, a team member opens that one guest’s record and selects Show. The platform records who looked, at which guest, at which field, and when. Copy-to-clipboard and click-to-call keep working from the guest’s record.
A team member sees only the areas they were granted, at the level they were granted — view or manage — and settings only if they were given settings. A screen not explicitly opened to them is closed. A manager can grant only what they themselves hold; nobody can hand out more access than they have.
New team members are invited by e-mail and set their own password. A manager does not set or see it. Changing a password, an e-mail address or someone’s access ends that person’s existing sessions at once, everywhere.
Anyone who manages settings, people or data proves a second factor at sign-in — a code on their phone, an authenticator app or a code by e-mail. Hotel Linkage can require it for every member of a hotel’s team.
The e-mails your team receives about a new booking or a request show the guest’s contact details masked; the full value lives on the guest’s record and is reached from there. The platform’s own logs are scrubbed of guest phone numbers, addresses and message text.
When a booking is passed to your channel manager, the guest’s name travels in full and their contact details travel masked, or not at all — your choice, per hotel. The platform’s own record of what was sent never contains the contact details.
Our own staff are not given the download — not the address book, not a consent file, not a guest’s record. The right to download belongs to a named person at your hotel and is granted only by us. Every download then needs a fresh one-time code sent to that person’s phone and is recorded, and a Guest Data Downloaded notice, which cannot be switched off, names who downloaded what. Its recipients are set under How to reach you on Notifications.

​
Your AI staff are built to take instructions from you, not from a document or a guest

Your AI staff are built to treat what a guest types, and what an uploaded document says, as information, not as instructions. They show a guest only the record that guest has proven is their own. A price a guest is quoted comes from your own rate settings.

​
The guest’s rights, built in

Merged duplicates are one person, so a request applies to the whole history. A later edit or merge cannot bring an erased profile back.

​
Nothing is kept for ever

Retention is a mechanism, not a policy document: expired data is removed automatically.

​
Backups

Backups are kept in the European Union, independently of the live system, with a deletion lock. A restore has been rehearsed against a real copy, not assumed.

​
Kept that way

  • Changes that touch security, money, identity or guest data are reviewed before release.
  • The platform went through a security audit programme in 2026 — secrets, the perimeter, the wall between hotels, sign-in and sessions, everything reachable without an account, and guest data itself.
  • The tenant wall, the masking, the reveal record, the download gate and the retention sweep are enforced by the platform, not remembered by people.
We do not publish thresholds, findings or the inner workings of individual controls. Publishing them would help exactly the people they exist to stop.

​
Ask us

support@hotellinkage.com

Tell us your hotel name and what your review is asking. We answer security questionnaires directly.
Do not send a guest’s details to us by e-mail. If a request concerns one guest, act on their profile — the platform records what it did.