Privacy Policy

Privacy Policy

Last updated: 15 October 2026

Zaplar, Inc. ("Zaplar", "we", "us", or "our") provides software that helps hotels manage their operations and guest experiences. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you visit our website, communicate with us, or use our services. It also explains the choices and rights you may have.

1. Who is responsible for your personal data?

Zaplar, Inc. is located at 1209 Orange Street, Wilmington, Delaware 19801, United States. You can contact us about privacy at founders@zaplar.com.

We act as a data controller when we decide why and how personal data is used for our own business activities, including managing our website, responding to enquiries, and maintaining relationships with customers, suppliers, and business partners.

When a hotel or other business customer uses Zaplar to process information about its guests, staff, customers, or suppliers ("Customer Data"), that customer generally acts as the data controller and Zaplar acts as its processor. The customer's privacy notice explains its purposes and legal grounds for processing. Our handling of Customer Data is governed by the customer agreement, documented instructions, and our Data Processing Agreement.

If your request concerns a hotel reservation, stay, payment, guest profile, or message handled through Zaplar, please contact the hotel first. We assist our customers with privacy requests in accordance with our obligations. This policy does not replace a hotel's privacy notice or expand our rights to use Customer Data.

2. Personal data we collect

The information we process depends on your relationship with us and the features you use. It may include:

• Contact and business information: your name, email address, telephone number, company, job title, and business address.

• Account and relationship information: account identifiers, roles, permissions, subscription details, billing contacts, invoices, and records of our business relationship.

• Communications: enquiries, demo requests, support correspondence, feedback, and information or attachments you choose to send us.

• Technical and usage information: IP address, browser and device information, pages or features used, access times, diagnostic information, security events, and cookie or similar identifiers.

• Preferences: communication preferences, consent choices, and settings you select.

For Customer Data, the categories depend on what the customer submits and the services it enables. These can include guest contact details, reservation and stay information, preferences and requests, purchases, payment and transaction records, messages, event arrangements, and staff account or task information. Customer-provided requests or documents may also contain sensitive information, such as health or accessibility needs. Customers are responsible for establishing the required legal grounds and safeguards for that information.

We receive information directly from you, automatically through your interactions with our website and services, and from your organisation or people acting on its behalf. Customer Data may also come from connected booking channels, payment services, communication platforms, and other integrations authorised by the customer. For business relationships, we may receive professional contact information through referrals or publicly available business sources.

Please provide only information relevant to your request. If information is required to arrange a demo, administer a relationship, or provide a feature, we may be unable to do so without it. Optional information is voluntary.

3. How we use personal data and our legal grounds

For activities where Zaplar acts as a controller, we use personal data for the following purposes. Where the General Data Protection Regulation or similar laws require a legal ground, we rely on the grounds described below.

Enquiries, demos, and business relationships. We use contact details and correspondence to respond to requests, arrange meetings, and manage customer and supplier relationships. Our legal ground is our legitimate interest in communicating with people interested in our services and administering those relationships. Where you personally enter into a contract with us, we may instead rely on taking steps at your request or performing that contract.

Administration, billing, and support. We use relevant account, contact, transaction, and communication information to administer subscriptions, issue invoices, and provide assistance. We rely on our legitimate interest in operating our business, performance of a contract with you where applicable, and legal obligations for required financial records. Customer Data accessed during support remains subject to the customer agreement and DPA.

Website operation, security, and troubleshooting. We use technical information to deliver our website, detect misuse, investigate faults, and protect our systems. We rely on our legitimate interest in maintaining reliable and secure services. Where a law requires particular processing, we rely on that legal obligation.

Understanding and improving our website and services. We use feedback and permitted usage information to understand what works and improve functionality. We rely on consent for optional cookies and similar technologies where required, and on legitimate interests for other processing where legally permitted. Use of Customer Data and service logs remains limited by the customer agreement; this purpose does not authorise independent reuse of identifiable guest records.

Marketing. We use business contact details and preferences to send relevant information about Zaplar. We rely on consent where required and otherwise on our legitimate interest in promoting our services where the law permits. You can unsubscribe using the link in a marketing email or contact us. Opting out of marketing does not stop necessary billing, security, or service communications.

Legal compliance and claims. We use information needed to meet applicable legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims. We rely on legal obligations or our legitimate interest in protecting our rights, as appropriate.

Where we rely on legitimate interests, we consider the impact on your rights and interests. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

For Customer Data processed on a customer's behalf, the customer determines the applicable purposes and legal grounds. We process that information to carry out its instructions and provide the agreed services.

4. AI features and automated processing

Zaplar includes AI features that can assist with guest communications, bookings, recommendations, and operational tasks. These features process relevant inputs and context to generate responses, suggestions, or actions. Inputs and outputs may contain personal data. We use AI service providers to support these features.

Customers configure the features and degree of automation available to their teams, including approval requirements for designated actions. Customers are responsible for supervising the use of AI in their operations and explaining relevant processing to affected individuals. AI output can be inaccurate.

We do not use Customer Data to train general-purpose AI models or permit our AI providers to use it for that purpose.

For our own activities as a controller, we do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. A hotel's use of automation, including personalisation or profiling, is covered by its own privacy notice. Contact the hotel about how its use affects you.

5. Cookies, analytics, and similar technologies

Our website and services use cookies and similar technologies to support essential functions, remember settings, and, where enabled, understand usage. Some technologies are necessary to provide a feature you request; others are optional.

Where enabled, product analytics and session replay tools can capture interactions such as page navigation, clicks, and on-screen activity to help diagnose problems and assess usability. Their use is subject to applicable consent requirements and, for Customer Data, the customer agreement.

Where required by law, we obtain consent before using non-essential cookies or similar technologies. You can change or withdraw that consent through the cookie controls on the relevant website or service. You can also manage cookies through your browser, although blocking necessary cookies may prevent some features from working. Information about the technologies in use, their providers, purposes, and duration is provided with the relevant cookie disclosures.

6. When we disclose personal data

We disclose personal data where necessary for the purposes described in this policy, including to:

• Service providers supporting hosting, communications, scheduling, customer support, payments, AI functionality, analytics, monitoring, and document signing. Providers processing data on our behalf are subject to contractual requirements concerning its use and protection.

• Your organisation and its authorised users, where needed to administer its relationship with Zaplar or provide the services it requests.

• Customer-authorised integrations, where a customer enables a connection or directs us to transmit information to another service.

• Professional advisers, including lawyers, accountants, auditors, and insurers, where needed for their work and subject to appropriate confidentiality obligations.

• Authorities or other parties, where disclosure is legally required or necessary and lawful to protect rights, address fraud or security incidents, or establish, exercise, or defend legal claims.

• Parties involved in a business transaction, such as a merger, financing, restructuring, or acquisition, subject to appropriate safeguards and applicable contractual restrictions.

Information about subprocessors supporting the hotel platform is available in our Data Processing Agreement. This list is separate from the providers used for our own website and business administration.

Payment processors and other integrated providers may act as independent controllers for some activities, such as their own compliance obligations. Their privacy notices apply to that processing.

We do not sell personal data or share it for cross-context behavioural advertising.

7. International processing and transfers

Zaplar is a US company and works with providers in the European Economic Area, the United States, and other locations where our business and service providers operate. Personal data may be processed in a country other than the one where you live.

Our DPA describes the locations used by platform subprocessors. Hosting data in Europe does not mean that every related processing activity takes place there; some service providers, including AI providers, process information in the United States.

Where a transfer is subject to European data protection requirements, we rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where necessary. For other regulated transfers, we use the safeguards required by applicable law. You can contact us for information about the safeguards relevant to your data and, where applicable, a copy of them, subject to necessary redactions.

8. How long we keep personal data

We retain personal data only for as long as needed for the purposes for which it was collected, taking account of legal requirements, the nature of the information, and relevant operational needs.

• Enquiries and demo requests: for the time needed to respond and complete reasonably related follow-up.

• Customer and supplier relationship records: while the relationship continues and afterwards to the extent needed for outstanding obligations, applicable recordkeeping requirements, or legal claims.

• Billing and accounting records: for the period required by applicable accounting and tax laws.

• Support and technical records: for the period needed to resolve the issue, maintain security, and investigate relevant faults or incidents, subject to contractual limits.

• Marketing information: while we have a valid basis to contact you. We may retain a limited record of an opt-out to respect your choice.

Customer Data is retained, returned, or deleted in accordance with the customer's instructions, the customer agreement, and applicable law. Backup copies are subject to the applicable backup retention and deletion processes. A legal preservation obligation may require particular records to be retained longer.

When personal data is no longer needed, we delete it or make it anonymous so that individuals can no longer be identified.

9. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, and loss. These include access controls, confidentiality obligations, and measures appropriate to the risks of the processing. Additional commitments for Customer Data are set out in our DPA. No method of storage or transmission can be guaranteed to be completely secure.

10. Your privacy rights

Depending on your location and the law that applies, you may have the right to access your personal data, correct inaccuracies, request deletion, restrict certain processing, and receive a portable copy of information. You may also withdraw consent or object to processing based on legitimate interests. You can object to direct marketing at any time.

Some US privacy laws also provide rights to opt out of sale, targeted advertising, or certain profiling, and to limit particular uses of sensitive information. We do not sell personal data or share it for cross-context behavioural advertising, as stated above. We will not unlawfully discriminate against you for exercising your rights.

To make a request, email founders@zaplar.com or write to the address below. We may need information proportionate to verifying your identity and locating the relevant records. Where permitted by law, an authorised agent may act for you, subject to verification of their authority. Rights are subject to applicable conditions and exceptions.

We respond within the time required by applicable law. For requests under the GDPR, this is normally within one month; if an extension is permitted and needed, we will explain the reason within that month. Where applicable law provides a right to appeal a refused request, reply to our response asking for an appeal.

You may complain to the relevant data protection authority. In the EEA, this may be the authority where you live, work, or believe an infringement occurred. In Sweden, you can contact the Swedish Authority for Privacy Protection (IMY). You do not need to contact us before making a complaint.

For requests concerning Customer Data that we process for a hotel or another customer, please contact that organisation. If you contact us, we will help direct your request and assist the customer as required.

11. Children

Our business website and services for hotel operators are not directed at children. Hotels may provide information about children travelling with their guests; we process that information on the hotel's behalf under the applicable agreement. If you believe a child has provided personal data directly to Zaplar inappropriately, please contact us so we can investigate and take appropriate action.

12. Other websites and services

Our website and services may link to or integrate with third-party services. Their privacy notices explain how they process information for their own purposes. A hotel's use of Zaplar does not make this policy the privacy notice for that hotel's operations.

13. Changes to this policy

We may update this policy to reflect changes in our practices, services, or legal requirements. We will publish the updated version with a revised date and provide additional notice or obtain consent where required. Any new purpose for processing personal data will be addressed in accordance with applicable law.

14. Contact us

For questions about this policy or requests concerning your personal data, contact:

Zaplar, Inc.
1209 Orange Street
Wilmington, Delaware 19801
United States

Email: founders@zaplar.com