Privacy policy

How Oetal handles your information.

Information we handle

Oetal stores account contact details, hotel setup, guest reservations, invoices, payments and operational records supplied by hotels and guests. Digital check-in may include ID images, a signature and an optional selfie. Hotels control whether these check-in features are enabled.

Why we use it

We use this information to run hotel operations, provide guest services, authenticate users, prevent misuse and support the service. Hotels are responsible for providing an appropriate notice to their guests and choosing the information they collect.

Connected services

When configured, Oetal sends necessary information to payment, email, WhatsApp, OTA and identity providers to perform the requested service. Payment-card entry is handled by the configured payment provider. Optional AI providers may receive submitted questions and relevant hotel information. Availability depends on the hotel's enabled integrations.

Storage and retention

Account sessions and preferences use browser storage. Closing a tab clears its session token; the server also expires sessions. Private check-in files are access-controlled and removed after the hotel's configured retention period, normally 180 days after the stay ends. Database and file snapshots are retained locally for 14 days. Off-site backup retention depends on the deployment operator. Financial and operational records have separate retention needs.

Access and requests

For access to, correction of or deletion of a guest record, contact the hotel that collected it. For Oetal account or privacy questions, contact hello@oetal.com. Requests affecting financial records or backups may require additional review.

Security and updates

Oetal provides role-based access, tenant separation, password hashing, optional staff MFA and mandatory production administrator MFA. The deployment operator is responsible for secure hosting, encryption, secrets and backup handling. This page may be updated as the service changes.