Ultra Guest
Data map
Each category of personal data on the platform, its purpose, default retention (tied to the live retention engine), deletion behavior, and whether it may be processed outside the EEA.
| Category | Purpose | Role | Default retention | Deletion / anonymization | Processed outside the EEA? | Implementation reference |
|---|---|---|---|---|---|---|
| Guest & session data | Identify the guest, run the device session, and personalise the stay. | Processor | Anonymized after 1095 days (guest_stay) | Display name anonymized after the retention window; session tokens expire on inactivity; erased on a guest erasure request. | Yes | privacy.py _erase_subject / guest_stay retention_policy |
| Stay data | Match a guest to a reservation and tailor in-stay offers and fulfillment. | Processor | Anonymized after 1095 days (guest_stay) | Anonymized after the retention window; room numbers retained operationally; erased on request. | Yes | privacy.py guest_stay retention_policy |
| Order & cart data | Process bookings and purchases of ancillary offerings and record acceptance. | Processor | Retained for tax and consumer-protection record-keeping (legal obligation). | Contact name/email/notes erased on a guest erasure request; the financial record is retained where law requires. | Yes | privacy.py _erase_subject (orders) |
| Concierge conversation data | Run the AI/staff concierge thread and book from the hotel's live offerings. | Processor | Deleted after 365 days (conversation) | Messages redacted and the thread soft-deleted after the retention window; erased on request. | Yes | privacy.py conversation retention_policy; AI inference via Amazon Bedrock (AWS us-east-1) |
| Consent records | Record per-purpose consent and withdrawal to evidence the lawful basis. | Processor | Append-only ledger retained as evidence of consent for the relationship's duration. | Consent is set to 'withdrawn' on a guest erasure request; the audit event is retained. | Yes | consent_state / consent_event (migration 0026) |
| Data-subject request records | Track access and erasure requests and their outcome. | Processor | Request metadata retained as compliance evidence; never includes the export blob. | Metadata retained to demonstrate the request was handled. | Yes | dsar_request (migration 0026) |
| Ledger & financial records | Maintain the double-entry ledger, commission reconciliation, and payouts. | Controller | Retained under legal-obligation (tax/accounting); NEVER swept by retention. | Soft-deleted/retained on erasure; the financial record itself is preserved as required by law. | Yes | wallet_entry / ledger (retention_sweep excludes financial records) |
| Staff & admin data | Manage hotel staff and platform-admin accounts and access. | Controller | Retained for the duration of the account/relationship (independent-controller activity). | Removed when the account is deprovisioned. | Yes | account / GoTrue identity (self-hosted on AWS) |
| Support, email & audit logs | Deliver email, prevent abuse, and keep security/operational audit logs. | Processor | Deleted after 365 days (email_outbox) | Email send-log deleted, OTPs and abuse logs deleted, analytics anonymized — each past its category TTL. | Yes | privacy.py retention_sweep (email_outbox/email_otp/stay_validation_attempt/analytics_event) |