Privacy policy

Hotel accounts. For the accounts of hotel staff and the hotel's own settings, we decide how that information is used, so we are responsible for it.

Guest requests. When a guest sends a request, order or message, we process it on behalf of the hotel. The hotel decides why and how that information is used, and is the first point of contact for guests about it. We only use it to run the service for that hotel.

Hotel team members:

• Name, work email and role, and which departments you belong to.
• Your password — stored only as a one-way hash, never in readable form.
• Sign-in sessions, including the browser's user-agent string, and when you were last active.
• What you do in Cozyva that changes the hotel's setup or a request (for example, completing a request or changing a price), recorded in the hotel's audit log and request timelines.

Guests:

• Guests don't create an account and we don't ask for a name, phone number or email.
• The room or space whose code was scanned, and what the guest sends: requests and their details, dining orders, messages, and feedback.
• A cookie that keeps a guest's requests together during their stay (see Cookies).
• Daily counts of how often codes are scanned and pages viewed, per hotel — not linked to any person.

Website visitors: if you use the contact form, your name, email, hotel (if you give it) and your message.

Hotels: the hotel's name, location, rooms, services, menus, branding, plan and billing history.

• To run the service: show requests to the right department, keep guests updated on their request, and let the hotel reply.
• To send copies of requests to the hotel's WhatsApp numbers, if the hotel is on the Connect plan.
• To send service emails: team invitations, password reset links and account notices.
• To bill hotels for their plan and show their invoices.
• To keep Cozyva secure, investigate problems and provide support the hotel has approved.
• To reply to messages sent through the contact form.

We don't sell personal information, and we don't use guest requests for advertising.

We use a small number of service providers to run Cozyva. They act on our instructions and only receive what they need:

• Hosting and database — the cloud providers that run the application and store its data.
• WhatsApp (Meta's WhatsApp Business platform) — only for hotels on Connect: the text of each request copy and the destination number.
• Email delivery — the recipient's address and the message, for invitations and password resets.
• Payments — when card payments are introduced, the payment provider will receive the billing details needed to take payment. We will update this policy before that happens.

Within a hotel, admins can see everything for their hotel; operational staff only see requests for their departments. Guests only ever see the hotel's name on replies — never a staff member's name or number.

Cozyva staff can see a hotel's setup only when the hotel approves a support request, for a limited time and only the areas the hotel allows. Every access is logged. Guest conversations are never visible to Cozyva support.

We may disclose information if the law requires it, and we will tell the affected hotel where we are allowed to.

Cozyva only uses cookies needed for it to work. We don't use advertising or analytics cookies.

• cz_session — keeps hotel team members and Cozyva staff signed in (up to 30 days).
• cz_hotel — remembers which hotel you're working in if you belong to more than one.
• cz_g_… — on a guest's phone, keeps that guest's requests together for their stay (up to 14 days).

A guest's in-progress dining order is kept in the browser's local storage on their own phone until they send it.

We keep hotel and guest-request information while the hotel's account is open, so the hotel can see its history. When a hotel account is permanently deleted, its rooms, requests, messages, team memberships and settings are deleted with it. Contact-form messages are kept while they are useful for answering you.

Passwords and sign-in links are stored only as hashes. Connections are encrypted. Access inside a hotel is limited by role and department, Cozyva support access needs the hotel's approval and expires, and changes are recorded in audit logs. No system is perfectly secure; if we learn of a breach affecting you, we will tell the affected hotels and, where required, the authorities.

You can ask us for a copy of the personal information we hold about you, to correct it, or to delete it. Hotel team members can change their name and password in Cozyva at any time, and hotel admins can remove team members.

If you were a guest, please contact the hotel first — they control their guest information, and we'll help them respond. You can also reach us through our contact page.

If you're not satisfied with our answer, you can complain to the data protection authority where you live.

Cozyva is a service for hotels. Hotel team accounts are for adults. Guests of any age may send requests from a room; that information is handled for the hotel as described above.

We'll update this page when our practices change and change the date at the top. If a change materially affects how we use information hotels have given us, we'll tell hotel admins before it takes effect.

Questions about privacy, or a request about your data: use our contact page. Choose “Privacy & data” so it reaches the right person.