Privacy policy
Last updated 21 October 2026.
Who we are
BedsReady is run by Andreas Riha, a sole trader trading as BedsReady (“we”, “us”). This policy covers this website and the BedsReady apps (the hotel app and the short-let app). Questions about it, or about your data: andreas@bedsready.com.
Two different roles
- Website visitors and people who contact us or sign up: we decide what is collected and why, so we are the controller.
- Data inside a customer’s account (their staff, guests, landlords, properties, cleans, photos, notes, hours, invoices): the customer (the hotel, agency or cleaning company) is the controller, and we are their processor. We process it only to run the service for them and on their instructions. If you are a guest, cleaner or landlord with a question about that data, the business that uses BedsReady is the right first contact; we will help them answer you.
What we collect on the website
- Forms (“Get access”, contact, sign-up): your name, email, business name, what you run, its size, the tools you use and what you tell us. Used to reply, set up your account and follow up. Kept while we are in touch and for up to 24 months after, then deleted.
- Page counter: which page was viewed, the referring site, campaign tags, screen width, language and a random session id. No cookies, no IP address, no third party. Opt out with
?noanalytics=1. - Google Analytics: only if you accept in the cookie banner. It sets cookies and Google receives usage data. You can refuse, and change your mind any time by clearing site data.
What the apps store
Sign-in details (name, email, phone if given, and a scrambled PIN; we never see PINs), what each person does in the app (cleans started and finished, photos, notes, problem reports, hours, linen, check results), bookings imported by the customer (guest names, dates, room or property), invoices and payments. The customer decides what goes in and how long it stays; when they close their account we delete their data within 90 days unless the law requires us to keep invoices longer.
The AI assistant
Premium accounts include an AI assistant: questions about the day, a weekly summary, and staff notes and problem reports translated and sorted. It uses Claude, a model by Anthropic, through Anthropic’s commercial API.
- What is sent: only what a request needs from that one account, for example today’s rooms or cleans, staff names and times, guest names on bookings, notes, problems, ratings and unpaid invoices for a question; the note itself for sorting; the week’s figures for a summary. Never PINs, payment card details, photos or other customers’ data.
- Not used for training: under Anthropic’s commercial terms, data sent through the API is not used to train their models. Anthropic keeps it for a limited period, as its terms allow, for example to detect misuse, then deletes it.
- Logged: each AI request is logged (who, when, how much text) so use and cost can be checked; answers and summaries are kept in the account like its other records.
- Can be switched off: an account admin or manager can turn the assistant off at any time (Setup in the short-let app, Ask in the hotel app).
- Can be wrong: AI answers come from the account’s records, but they can be mistaken. Check anything important before acting on it.
Who else handles data (sub-processors)
- Supabase: database, files and server functions, hosted in London (UK).
- Vercel: hosts the hotel app.
- Hostinger: hosts this website.
- Resend and Google Workspace: send the app’s emails.
- Anthropic: the AI assistant (Premium), as above.
- Stripe: card payments, where a customer connects it for their invoices.
- Google: website analytics, only with your consent.
- Optional integrations a customer switches on, such as their booking calendar or KeyCafe key boxes.
Some of these are based in the United States; where data leaves the UK or EU it is covered by the standard safeguards those providers offer (such as the UK/EU standard contractual clauses or data-privacy frameworks).
Lawful basis
For website enquiries and sign-ups: taking steps you asked for and our legitimate interest in replying and following up. For analytics cookies: your consent. For data in customer accounts: our contract with the customer, who is responsible for having their own lawful basis.
Your rights
You can ask for a copy of your data, to correct or delete it, to restrict or object to its use, or to move it, and you can withdraw consent at any time. Email andreas@bedsready.com; we reply within a month. You can also complain to your data protection authority: the ICO in the UK (ico.org.uk) or the Data Protection Commission in Ireland (dataprotection.ie).
Security
Data is encrypted in transit, PINs are stored only as one-way hashes, sign-in is rate-limited, and each account’s data is kept separate in the database. No system is perfectly secure; if something goes wrong that affects your data we will tell the affected customer promptly.
Changes
We will update this page when anything changes and change the date at the top. Material changes for customers are also emailed to account admins.