RatePulse Privacy Policy

Status: Draft pending legal review. Last updated 2026-09-26 · v0.7.

1. Who we are

The RatePulse platform is operated by RATEPULSE LTD (company number 17408208), a company registered in England and Wales (“RatePulse”, “we”, “us”).

Contact for privacy matters: privacy@ratepulse.io Postal address: 176 Mytchett Road, Mytchett, Camberley, England GU16 6AE

2. Controller or processor — an important distinction

RatePulse processes personal data in two different roles:

As controller — for the data of the people who use or contact RatePulse: your account details, your team members, your settings, your conversations with the AI assistant, contact and support correspondence, and usage and security information. This policy describes that processing.

As processor, on your hotel’s behalf — for personal data about your hotel’s guests and reviewers that reaches RatePulse through systems you connect (your property management system, your Google Business Profile). Your hotel decides why and how that data is used; RatePulse processes it only to provide the service, on your instructions, under our Terms of Service. Guests should direct privacy enquiries to the hotel they booked with. A data processing agreement covering this processing is available on request at privacy@ratepulse.io.

3. What we collect

Account data — email address, name, hashed password, the hotel(s) you are associated with, and your role within each hotel’s team.

Hotel data — hotel name, address, location coordinates, room types, room count, rate plans, settings, and custom events you create. This is business data about your property.

Guest reservation data (processed as processor) — when you connect a property management system, we regularly sync reservation records, which include guest names, stay dates, room assignments, and reservation status. This is the highest-sensitivity category we handle; see Sections 6 and 8.

Review data (processed as processor) — when you connect your Google Business Profile, we sync your public reviews, which include reviewer names and review content as published on Google.

Google account data you connect (Gmail, Google Drive) — a manager may connect the property’s Gmail and Google Drive to the AI assistant, each separately and at a level they choose. With Gmail “send only”, RatePulse sends only the emails you approve, from your address. With Gmail “read & send”, the assistant can also search and read messages and attachments in that inbox when you ask it to. With Drive “files I pick”, it sees only the files you choose and the reports it saves; with “whole Drive”, it can search and read your Drive when you ask. RatePulse’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice: what the assistant reads from your Gmail or Drive is used only to answer the request in front of it, is not stored beyond that conversation, is never used to train AI models, is never sold or used for advertising, and is not read by our staff except with your explicit permission for support or as required by law. One exception, which you choose each time: a Drive file you attach to the chat with the paperclip is copied and kept for 7 days exactly like a file uploaded from your computer, so the assistant can re-read it in that conversation. A file the assistant reads on its own, from the Drive list or by name, is not copied. The AI providers that answer (listed under sub-processors) receive the text needed for that answer under terms that forbid training on it. The access tokens are encrypted at rest and deleted the moment you disconnect the service, which you can do at any time in Settings → Integrations or from your Google Account’s security settings.

Market data — rates and availability observed on publicly accessible travel platforms. This contains no personal data and is therefore outside the scope of this policy; it is described here only for completeness.

AI conversation data — your chat history with the AI Revenue Assistant, the memory facts derived from those conversations, and the suggestions surfaced to you.

Contact and support correspondence — when you use our contact or support forms or email us, we collect the name, email address, hotel name, subject, message and any attachments you choose to provide. The public contact form also records your IP address so we can limit automated or abusive submissions.

Usage analytics — feature-engagement events, sign-in times, and error reports used to operate and improve the service. No third-party advertising or tracking pixels.

4. Why we process it, and the lawful bases

Under UK GDPR Article 6, we rely on:

• Performance of a contract or steps at your request before entering one — account, hotel, AI conversation and service or sales correspondence necessary to set up, provide and support the service.
• Legitimate interests — responding to other enquiries, maintaining an appropriate record of correspondence, service improvement, usage analytics, and protecting the service and public forms from spam, abuse and security threats, balanced against your rights and expectations.
• Consent — for any non-essential cookies (Section 9), which you may withdraw at any time.

Guest reservation and review data is processed on your hotel’s instructions as described in Section 2; the lawful basis for that data is your hotel’s responsibility as controller, supported by our processing terms.

We do not make solely automated decisions about you that produce legal or similarly significant effects. Rate recommendations are advisory; a human — you — decides what to publish.

5. Who receives personal data

We share personal data only with service providers who process it on our instructions, under contracts meeting UK GDPR requirements:

• Application hosting — Hetzner Online GmbH (Germany), on servers in Helsinki, Finland. Our application servers and background jobs run here.
• Authentication, database, and file storage — Google Cloud (Firebase). Database records are held at rest in Google’s European multi-region (Netherlands and Belgium).
• AI model inference and speech-to-text — third-party providers (US) that process conversation content — including text the assistant reads from a connected Gmail or Drive for the request in front of it — and audio you record, to power the AI assistant. We do not permit them to train models on your data.
• Payment processing — GoCardless (UK), when you have an active subscription. We never store your bank details ourselves.
• Transactional email delivery — an email service provider (EU/US), for invitations, alerts, account messages, contact acknowledgements and support notifications.
• Systems you connect — your property management system provider and Google (Business Profile), which exchange data with RatePulse at your instruction.

We do not sell personal data, and we do not share it with advertisers or data brokers. A current list of sub-processors with their identities is available to customers on request at privacy@ratepulse.io, and we will notify you before adding a sub-processor that materially changes how your data is handled.

6. Retention

When you delete your account, your identity is removed from login systems immediately and your data is deleted or anonymised within the windows above, except where law requires longer retention (e.g. billing records).

7. International transfers

Some providers in Section 5 process data in the United States. Where personal data leaves the UK, we rely on the UK International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum, and we assess each transfer’s safeguards.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data (subject to legal retention requirements).
• Restrict processing in certain circumstances.
• Port your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, where processing is based on consent.
• Complain to the UK Information Commissioner’s Office (ico.org.uk).

To exercise any right, email privacy@ratepulse.io. We respond within one month of a verified request. If your request concerns guest data we process for a hotel, we will refer it to that hotel and assist them in responding.

9. Cookies and similar storage technologies

We use the minimum browser storage necessary to operate the service:

• Authentication — Firebase session state stored in browser storage so you remain signed in. Required.
• Preferences — local storage for interface settings such as theme and layout. Required.
• Short-lived navigation state — session storage used to complete or recover sign-in, onboarding and checkout journeys. Required.
• No third-party advertising or analytics pixels. No Google Analytics, no Facebook Pixel, no ad networks.

You can clear or block browser storage in your browser, but authentication and essential workflow storage are required for the service to function.

10. Security

We protect personal data with industry-standard measures: encryption in transit (HTTPS everywhere) and at rest, encrypted storage of connected system credentials, role-based access controls, and automated safeguards against credential leaks in our development process. No system is perfectly secure; if a breach occurs that risks your rights, we will notify you and the ICO as UK GDPR requires.

11. Children

The service is not directed at anyone under 16. We do not knowingly collect children’s data; if you believe a child has provided data, contact us and we will delete it.

12. Changes to this policy

We may update this policy. Material changes are notified by email and a 30-day banner on the platform. Non-material changes are reflected in the “last updated” line above.

13. Contact

Privacy enquiries: privacy@ratepulse.io Data controller: RATEPULSE LTD (company number 17408208) Postal address: 176 Mytchett Road, Mytchett, Camberley, England GU16 6AE ICO complaint route: ico.org.uk

14. Effective date and version history

Effective from 2026-09-26.

• 2026-09-26 — v0.6. Added the Gmail and Google Drive connections, the levels a manager can choose, and the Google API Services User Data Policy (Limited Use) commitments that govern what the assistant reads.

• 2026-09-26 — v0.7. Said plainly that a Drive file attached with the paperclip is kept 7 days like an upload, and that the AI providers receive Gmail/Drive text for a request under no-training terms.

• 2026-08-25 — v0.5. Named the application-hosting provider and its location separately from the database provider, stated the European region the database is held in, and recorded that speech-to-text is processed by the same class of third-party provider as the AI assistant.

• 2026-08-19 — v0.4. Added contact and support correspondence, the public form’s abuse-prevention IP record, the applicable lawful bases, and purpose-based retention criteria.

• 2026-08-19 — v0.3. Replaced the pre-incorporation controller placeholders with RATEPULSE LTD’s registered name, company number and postal address; aligned the guest-contact retention period with the live three-year scrub; clarified essential cookies and similar browser storage.

• 2026-07-31 — v0.2. Controller/processor roles separated (guest and review data is processed for the hotel, not controlled by RatePulse); recipients stated as categories with named infrastructure and payment providers; added automated-decision, breach-notification, and consent-withdrawal statements; removed operational detail with no bearing on data subjects’ rights.

• 2026-04-26 — v0.1, initial draft (pending legal review).

Draft pending legal review. This document was prepared with care but has not been reviewed by counsel. Before commercial launch it should be reviewed by a UK-qualified data-protection lawyer and the ICO data protection fee paid where required. The draft label flips to “v1.0” on review.