Privacy notice

Infinit PMS is run by Global Tech Develop Ltd (company number 16250551), registered office 124 City Road, London, EC1V 2NX. We are registered with the Information Commissioner's Office (number ZB912706).

There are two roles, and they change what you should read:

• For the people who sign in to Infinit PMS (account owners, managers and their team) and for visitors to this website, we are the controller. This notice is our explanation to you.
• For the guests, property owners and other people a company puts into Infinit PMS, the company that uses it (the "host company") is the controller. It decides why and how their details are used. We are its processor: we store and handle that data for the company, on its instructions, to provide the service. The terms for that are in the data processing section of our terms.

If you are a guest and want to know what a host company holds about you, or want it corrected or removed, ask that company first: it is the one that can decide. If you cannot reach it, write to us and we will pass your request on.

When you sign up, are invited by your company, or use the service, we hold:

• Your account: your name, work email address, and your password (kept only in a scrambled form that cannot be turned back into the password). If you switch on two-step sign in, we also keep its secret (sealed) and recovery codes.
• Your company and role: the company you belong to, your role, and which homes you may see.
• Sign-in and security: when you last signed in, whether your email address is confirmed, the links we email you (confirm email, invitation, password reset), and the date from which older sessions stop working after a password reset.
• An activity log: a record in each company of who did what (for example a stay being changed or a guest's details being removed), shown to people the company allows.
• Company details you add: business name, registered address, company and VAT numbers, and the settings you choose.

We use this to run your account and the service (needed to perform our contract with you), to keep the service secure and working (our legitimate interest), and to keep records the law requires, such as accounting records of anything you pay us.

The host company decides what goes in. Infinit PMS is built to hold the following, and the company chooses which features to use. We do not use this data for our own purposes.

• Guest details: first and last name, email address, phone number, country, notes and labels written by the company's team, and, if the guest agreed, that they want to hear about offers.
• Stays: dates, home, number of guests, where the booking came from, prices, charges, payments, receipts, and what the guest asked for (such as extras).
• Messages: emails, text messages and booking-site messages between the company and the guest, and messages from Airbnb or Booking.com that arrive through Channex when that connection is on.
• Photo ID checks (only if the company switches them on): a photo of a passport, driving licence or ID card and a selfie, kept in a private area and shown only to people the company allows. The company sets how many days the photos are kept after the stay (the default is 7 days), after which they are deleted.
• Card payments and deposit holds: taken through the company's own Stripe account. Card numbers go to Stripe and never reach Infinit PMS. We keep the amounts, the status and Stripe's references.
• Property owners and landlords whose homes the company manages: name, contact details and statements.
• Team members (cleaners, maintenance, accountants) and what they were asked to do.
• Guest stay pages: each booking has a private link. Anyone who has the link can see that stay, so the company should only send it to the guest.

Infinit PMS has tools for the company to answer data protection requests: a download of everything held about a guest, and removal of a guest's personal details. Money records are kept after removal, without saying who the guest was, because the law asks companies to keep them.

Browsing this website or a company's booking site needs no account. Our servers handle your IP address and browser details to deliver the page and protect the service. We do not run analytics or advertising tools on Infinit PMS (see Cookies below).

When you book through a company's booking page, the details you type in (name, email, phone, dates) go to that company, which is the controller of them, and we handle them for it. The page may show a Google map; see "Who we share data with" for what that means.

We do not sell personal data. We use these providers to run Infinit PMS. Some are optional and are used only when a company or we switch them on.

• Amazon Web Services (AWS): hosts Infinit PMS on a server in London (eu-west-2), sends our emails through Amazon SES (sign-up confirmations, invitations, password links, security notices and messages to guests), and, when switched on, keeps copies of our backups in a private Amazon S3 bucket in London.
• Stripe (each company's own account): card payments and deposit holds. The company holds the relationship with Stripe; guests pay on Stripe's page.
• Twilio (each company's own account, when the company adds it): text messages to guests.
• Channex (when a company connects it): the channel manager that links Infinit PMS to Airbnb, Booking.com, Expedia and Vrbo. Prices, open nights, bookings and guest messages pass between us and Channex.
• Bookalizer and Guestalizer (our sister products, when a company connects them): Bookalizer receives open nights and prices and sends bookings back; Guestalizer carries a stay's guest checks, agreements and deposits.
• Anthropic (Claude), when switched on: drafts suggested replies in the inbox. To draft one, the stay details, guidebook text and the conversation are sent to Anthropic. A person at the company reads and edits every draft before it is sent; nothing is sent by the model.
• Google Maps, when switched on: shows maps on booking pages, guest stay pages and the home editor. The map loads in your browser directly from Google, so Google receives your IP address and browser details, under Google's own privacy policy.
• postcodes.io: turns a home's UK postcode into a position on the map. Only the postcode is sent.
• Xero: we make import files that a company can download and load into Xero. Nothing is sent to Xero by us.
• Expo, Apple and Google: deliver notifications to the phone app (see Phone app below).
• The InfinitWizard admin dashboard (our own), when switched on: we send it each company's account owner email and how many homes, rooms and bookings it keeps, once an hour, so we can see how the service is used.

A host company can also ask Infinit PMS to send data to its own systems through the API and webhooks. That is the company's choice, and the company is responsible for what it sends.

We may share data when the law requires it, or to protect our rights, for example to prevent fraud. Our servers are in the UK. Some of the providers above (for example Stripe, Twilio, Anthropic, Google and Expo) may handle data outside the UK; where they do, we rely on the safeguards UK law requires, such as adequacy regulations or the UK International Data Transfer Agreement.

Host companies decide how long they keep their guests' data and can remove it. Photo ID pictures are deleted after the number of days the company sets (default 7). Our nightly backups are kept for 14 days before they are replaced.

We keep account data while the account is open. If you ask us to close an account and delete its data, we will, except anything the law requires us to keep.

Under UK data protection law you can ask for:

• a copy of your personal data;
• correction of data that is wrong;
• deletion of your data, or a limit on how it is used;
• your data in a common format to take elsewhere;
• an end to use that rests on our legitimate interests;
• withdrawal of consent, where you gave it (for example to hear about offers).

For your own account, email legal@globaltechdevelop.com. For data a host company holds about you as a guest, ask that company; we will help it answer you. If you prefer to write to us by post, our registered office is 124 City Road, London, EC1V 2NX.

You can also complain to the Information Commissioner's Office at ico.org.uk, though we would like the chance to help first.

Infinit PMS uses only the cookies it needs to work, so they do not need consent. It has no analytics, no advertising and no tracking cookies.

• pms_session: keeps you signed in. It can only be read by the server, lasts up to 7 days, and ends when you sign out.
• pms_dashboard_design: remembers which dashboard layout you chose. It lasts a year and is set only if you choose one.

If Google Maps is switched on, Google may set its own cookies or storage when a map loads, under Google's policy.

The iPhone and Android app is for a company's team. It is another way into the same account, so everything in this notice applies to it too. It adds the following:

• Staying signed in: the app keeps a sign-in token in the phone's secure storage. Signing out ends it. The website lists the phones signed in, using the device name and whether it is an iPhone or an Android phone.
• Notifications: if you allow them, the app gives us a push token (a code Expo gives your phone). Notification text (for example a guest's name, the home, dates, the start of a message or a task title) passes through Expo's push service and Apple or Google, who deliver it. The token is removed when you sign out or switch notifications off.
• No tracking: the app has no adverts, no analytics, no crash reporting, and does not use your camera, microphone, photos, contacts, location or advertising identifier.

The guest data the app shows belongs to the company, which is the controller; the app only displays what your role allows.

Every connection to Infinit PMS is encrypted (https). Passwords are stored only in scrambled form. Each company's data is kept apart from every other company's, and people see only what their role allows. A company's Stripe and Twilio keys are stored encrypted. Photo ID pictures sit in a private area that checks who is asking. Two-step sign in is available to everyone, and a company can require it.

Infinit PMS is a business service for adults. Our account holders must be 18 or over.

If we change how we use personal data, we will update this page and its date, and tell account holders about important changes by email or in the app. Our terms of service explain the rest of how Infinit PMS works.