Privacy policy

Marhala AI Ltd is the data controller for personal data collected via our websites, products and direct communications. The company is registered in England & Wales with company number 17161138 and is registered with the UK Information Commissioner's Office under reference ZC148626.

Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom. For routine commercial enquiries please email [email protected]; for privacy, data protection or subject access matters addressed to the Data Protection Officer (DPO) or data controller, contact [email protected].

Under UK GDPR and the Data Protection Act 2018 we process personal information on one or more of the following lawful bases: contractual necessity where we are preparing or delivering an agreement with you; legitimate interests pursued by Marhala AI or a trusted third party where those interests are not overridden by your rights; compliance with a legal or regulatory obligation; and, in limited circumstances, explicit consent that you can withdraw at any time.

Where we rely on legitimate interests we conduct an internal balancing assessment and keep a record of the processing purpose, the interest relied upon and the safeguards applied. A summary of our legitimate interest assessments is available on written request.

Marhala AI processes a variety of data depending on whether you are a website visitor, a prospective customer, a contracted customer, a staff user of our tenant platform, or an end consumer interacting with a hotel or travel agent site operated on our platform.

• Identity and contact details: name, email address, phone number, postal address, company name, job title and role.
• Website and device data: approximate geolocation, IP address (stored in hashed or truncated form where possible), user-agent string, pages visited, referrer URL, language preference and cookie/device identifiers.
• Enquiry and CRM data: subject lines, message content, lead source (for example WEBSITE_INQUIRY or MANUAL_LEAD), enquiry type, detected lead category such as Wedding enquiry, Private event, Corporate event, Reservations, Room booking or General enquiry, assigned staff member, resolution notes and audit history.
• Product usage and configuration: tenant branding and customization, staff user roles (Superuser, Admin, DPO, Events Manager, Weddings Manager, Sales Director, General Manager, Reception Manager, Reservations Manager, Revenue Analytics, Marketing Manager and Staff), permission grants, login sessions, screen routes, audit logs, API tokens and feature entitlements.
• AI service data: customer chatbot conversations, visitor inquiries routed to LLM providers, WhatsApp Business conversations, automatic transcription, intent detection, confidence score, emotion score, AI-generated summaries and analysis saved into CRM or contacts.
• Payments and billing: billing contact, company details, purchase order references, payment receipts and invoicing information. Financial card data is processed exclusively by our payment processor (Stripe) and never stored directly on Marhala AI systems.
• Documents and marketing assets: uploaded files, document metadata, scheduled social media posts, campaign templates, review responses and uploaded photographs.

We use personal data to respond to enquiries, arrange product demonstrations, prepare proposals, deliver contracted services including CRM, website hosting, lead processing, AI messaging and reporting, send operational notifications, invoice for services, ensure security of tenant accounts, detect fraud or misuse, maintain audit and compliance records, and improve product performance and reliability.

Where we provide a hosted tenant platform, personal data belonging to end consumers of our hotel and travel-agent customers (for example guests submitting contact forms) is processed strictly in accordance with the agreed customer instructions and under the direction of the customer tenant controller, not as an independent controller. Our customer contracts set out those processing responsibilities, sub-processor lists, retention periods and technical/organisational security measures.

If you are located in the United Kingdom or your data is processed as part of a UK-based service, you have specific rights under UK GDPR including the rights of access, rectification, erasure (the "right to be forgotten"), data portability, restriction of processing, objection to processing and, where processing is based on consent, the right to withdraw that consent without affecting the lawfulness of processing before withdrawal.

Within the Marhala AI tenant platform these rights are supported through built-in data subject request (DSR) tooling: customer staff with the DPO role or appropriate permissions can search customers across CRM, guests, contacts and bookings, generate a structured personal data export for the customer, perform a documented erasure that preserves audit logs in line with UK law, and review an immutable GDPR audit log of every search, export and erasure performed.

To exercise any of these rights directly with Marhala AI as controller, email [email protected] with enough detail to identify your data. We will respond without undue delay and, in any event, within one month of receipt, extendable by a further two months for complex or voluminous requests. We may ask for proof of identity before disclosing any personal information.

If you remain dissatisfied with our handling you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom.

When an end visitor submits an enquiry form — whether on a Marhala AI-powered hotel/travel-agent website, via the AI customer chatbot, or through a WhatsApp Business conversation initiated by the concierge — the submission is automatically logged into the tenant CRM, assigned a lead identifier, categorised using keyword and context heuristics (for example Wedding enquiry, Rooms, Events, General enquiry) and assigned to the relevant staff team based on configured routing rules.

Website enquiries are also deduplicated by matching email plus subject/recency windows, in order to prevent duplicate records and route follow-up consistently. A duplicate record may refresh the existing lead while preserving the earlier audit history.

If a tenant has enabled AI lead analysis, the submitted enquiry is sent to a language model provider for automatic summarisation, sentiment detection, next-step recommendation and priority ranking. Enquiry content is processed under the controller's instructions and the relevant sub-processor terms.

Sites that subscribe to the AI customer chatbot embed a floating launcher widget that connects the visiting web browser to our chatbot APIs. In that setting we process the visitor message, their approximate page context, their conversation identifier and, if provided, their name, email address or telephone number they leave when requesting a call back or follow-up reply.

Conversations that are escalated or detected as high priority (bookings, weddings, private events, complaint handling, etc.) may be saved directly into the tenant CRM alongside staff notes and any AI-generated summary. Chat history and metadata are retained as described in the Retention section below.

Tenants using the WhatsApp Business integration process their customer phone numbers and message content through our platform. The originating WhatsApp number, reply threads, media attachments, auto-reply results, intent detection and escalation events are all captured in the tenant conversation log and linked, where appropriate, to the matching CRM or contact record.

Marhala AI is a UK-based company and we design our services to store primary customer and tenant data inside European Economic Area or United Kingdom infrastructure. Where international data transfers are required to deliver contracted services (for example inference hosted by an LLM provider based outside the EEA/UK, backup storage or CDN endpoints for media assets) we rely on appropriate transfer mechanisms recognised under UK GDPR including UK adequacy decisions, UK International Data Transfer Agreements, Binding Corporate Rules where applicable, and supplementary technical and contractual safeguards.

We maintain an up-to-date sub-processor inventory covering AI inference, cloud hosting, database services, email delivery, payment processing, observability, fraud detection and content delivery networks. A copy is available on written request to the DPO.

When Marhala AI products or customer tenant workspaces integrate with Google services or process Google user data, we only share, transfer or disclose Google user data with the following strictly limited categories of recipient, strictly for the purposes described and in accordance with applicable Google policies and UK GDPR.

• Google LLC and Google Ireland Limited — Google OAuth consent flows, Google Analytics GA4 Data API v1beta reporting for tenant dashboards, Google Business Profile / Business Profile management (posting, review responses, location data), Google Workspace Gmail send/modify/thread operations, token refresh at oauth2.googleapis.com, and Google account profile (openid, email, profile) scopes used during Google Connect linking. Google user data processed includes OAuth refresh and access tokens (never stored in plaintext), the linked Google account display name and email address, Google Analytics 4 property metrics (session count, channel grouping, page path, geo-region, device category, landing page, bounce and exit metrics), Google Business Profile location identifier, review and post metadata, and Gmail message-id, thread-id, sender/recipient addresses and subject lines for tenant-branded emails routed through the linked Gmail mailbox.
• Meta Platforms Ireland Ltd / Meta Platforms Inc — only if a tenant workspace links Facebook Pages, Instagram Business Accounts or the WhatsApp Business Platform for social media scheduling, review replies, conversation inboxes or WhatsApp concierge auto-replies. Shared data includes Meta User Access Tokens, Page Access Tokens, WhatsApp Business System User Access Tokens, phone-number identifiers, Instagram account identifiers and conversation message metadata. No Google user data is ever forwarded to Meta systems.
• Stripe Payments Europe Ltd — only for subscription billing, invoices and payment receipts. We share billing contact (name, company, email), Stripe Customer ID, subscription status, paid invoices and payment receipt metadata. Stripe exclusively processes payment card details on its own PCI-DSS certified infrastructure; Marhala AI never receives, stores or transmits card PAN, CVV or magnetic-stripe data. No Google user data (including any Google profile, Gmail or Analytics data) is ever disclosed to Stripe.
• Amazon Web Services EMEA SARL and AWS, Inc — cloud infrastructure services (Amazon Relational Database Service for per-tenant MySQL databases, Amazon Elastic Compute Cloud for API and worker microservices, Amazon Simple Storage Service and object storage for uploaded assets, Amazon CloudFront CDN for public gallery media, Amazon Route 53 for DNS, AWS Bedrock runtime for LLM inference using Google Gemma and similar foundation models). Stored Google user data on AWS infrastructure is always encrypted at rest (AES-256-GCM) and in transit (TLS 1.2+).
• Marhala AI Ltd internal sub-processors — Marhala AI engineering and customer-success staff, acting strictly under controller or processor instruction and bound by signed confidentiality agreements, may access tenant-scoped support data only when required to deliver contracted services, resolve a support ticket, investigate a security incident or perform a lawful data-subject request. Access is role-gated, least-privilege, audited and recorded in immutable GDPR DSR audit logs.
• Legal, regulatory and law-enforcement disclosures — we may disclose personal data, including limited categories of Google user data when strictly required by a binding UK court order, statute, regulation or mandatory governmental request. Where reasonably practical and legally permitted we will (i) notify the affected Google user or tenant customer in advance of disclosure, (ii) challenge over-broad or unlawful requests and (iii) redirect the requesting authority to our registered office or DPO correspondence channels. We do not voluntarily sell Google user data, share it for ad targeting, or license it to third-party data brokers.
• Onward transfers and mergers — if Marhala AI enters into a merger, acquisition, corporate reorganisation or sale of all or substantially all of its assets, Google user data may be part of the transferred assets. Any such transfer will be subject to binding written assurances that the receiving party will continue to protect Google user data with at least equivalent technical and organisational safeguards, and affected users or customer tenants will be notified by email or prominent in-product notice where practicable before the transfer takes effect.

Marhala AI applies a layered approach to technical and organisational security including encrypted transport (HTTPS/TLS 1.2+ with modern cipher suites and TLS 1.3 preferment) across all services, authenticated API access with short-lived signed bearer tokens, role-based access control on staff user accounts, mandatory strong password policies (Argon2id-equivalent adaptive hashing or scrypt/BCrypt class hardened per-password salted hashes with minimum 12-character complexity), optional second-factor time-based one-time password (TOTP) authentication at staff login, server-side CSRF tokens on all state-changing form submissions, HTTP security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and automated malware scanning on every uploaded file before it is accepted into persistent storage.

Customer databases are separated per workspace tenant (tenant isolation) so that one customer's staff, documents, CRM records and lead enquiries cannot be accessed by another customer workspace. Every SELECT, INSERT, UPDATE and DELETE statement at the ORM, service and route layer is explicitly scoped to the authenticated tenant id, and cross-tenant leakage is prevented at every layer through middleware tenant-bind assertions, permission checks and immutable audit logging of every record access.

For sensitive personal fields and secret credential data we apply the following specific data-protection mechanisms, consistent with UK GDPR Article 32 requirements and the principle of data minimisation.

• Column-level and envelope AES-256-GCM authenticated encryption for all stored OAuth credentials: Google refresh tokens (linked Gmail mailbox, Google Analytics GA4, Google Business Profile), Microsoft Outlook 365 refresh tokens, Meta Graph user and page access tokens, WhatsApp Business System User access tokens, Stripe restricted API keys, SendGrid/SMTP password strings, AWS access key pairs and OpenAI/Anthropic/Bedrock LLM provider API keys. Each secret is encrypted with a per-purpose tenant-scoped HMAC-SHA256 derived key (scope = "<purpose>::<tenantId>::<tenantSlug>") using the SECURE_RECORDS_ENCRYPTION_KEY or JWT_SECRET master, producing an IV.ciphertext.auth-tag triplet; the plaintext is never written to SQL logs, slow-query logs, exception stack traces, PM2 stdout/stderr or observability payloads. Decryption happens only inside the request scope of the owning tenant at the precise moment the credential is consumed by an outbound provider call.
• CRM and contacts sensitive PII fields: passport and travel-document numbers, UK and international car-registration identifiers, postal-address components (street address, postcode, geographic latitude/longitude, Google Maps Place ID), national insurance, date of birth where entered, and free-text passport/driving-licence document scans are each wrapped by the protected-record encryption service before being written to per-tenant MySQL rows. Access to decrypted values inside the tenant CMS UI is restricted to users holding Superuser, DPO, General Manager or Reception Manager roles through the SecureFieldsCard and PassportFieldCard UI components. Unauthorised role attempts to read or write secure fields are denied at the route authorisation layer and recorded in the GDPR audit log.
• Uploaded passport, driving licence and identity-document files (PDF, JPG, PNG, HEIC) are stored in a private_uploads directory tree that is NEVER exposed by the public webserver. Before being written to disk, every byte stream is encrypted at the file level with AES-256-GCM using a tenant-scoped PASSPORT_FILES_ENCRYPTION_KEY-derived secret, the resulting .mhl ciphertext blob is keyed under tenants/<slug>/passports/<entity>/<id>/<uuid>.mhl with path-traversal stripping enforced both on write and on read-back, and the original filename is sanitised to an alphanumeric/hyphen slug so that directory enumeration or metadata leakage is not possible.
• Password reset tokens, email-verification tokens and email-change tokens are never stored in plaintext: a single-use random 256-bit token is sent to the user, while only a SHA-256 hash of the token is persisted to the password_reset_requests, email_change_requests and users verification-token columns. Token-hash rows are consumed on single use and automatically expire after 60 minutes; brute-force enumeration is infeasible against the SHA-256 column.
• AI chatbot and outbound marketing signature tokens: track/open, track/click and unsubscribe recipient hashes are produced with HMAC-SHA-256 timing-safe-equal signature verification using a dedicated per-installation MARKETING_LINK_SECRET, with a layered 9-candidate fallback list to accommodate key rotation. Unsigned safe-decode fallback on open/click/unsubscribe URLs only reads the base64url payload body for redirect routing, never returns raw secrets and never exposes decrypted tenant fields to unauthenticated web visitors.
• In-process and PM2 microservice hardening: high-risk AI newsletter dispatching runs inside an isolated marhala-ai-newsletter-worker PM2 microservice (DISABLE_IN_PROCESS_MARKETING_WORKER flag) with its own lower-connection-cap MySQL tenant pool so that a runaway campaign cannot starve the public API or chatbot paths of database connections. Every Node.js entry point registers structured unhandledRejection and uncaughtException handlers that emit JSON severity tagged logs (pid, memory RSS, heap, uptime, stack) to stderr and stdout before a graceful 250ms unref exit, ensuring that transient unhandled promise rejections from Google or Meta upstream API transient errors cannot silently kill the process without forensic evidence.
• Row-level contention and database deadlock safeguards: all recipient UPDATEs for track/open, track/click, bounce webhooks, GDPR erasure, campaign heartbeat leases and campaign progress flushes are wrapped in retryWithTxGuard with 3 jittered retries (40–260 ms back-off) on ER_LOCK_WAIT_TIMEOUT (1205) and InnoDB deadlock (1213), each labelled with a descriptive txLabel so contention hotspots can be identified from the PM2 log stream without exposing row data. Marketing-campaign progress is persisted as a 250-recipient batch-delta flush against a KMC 5-minute LRU cache for known columns so that per-recipient UPDATE pressure is reduced from ~220k row locks to ~220 batch UPDATEs on a 55,000-recipient audience, dramatically reducing lock-wait exposure and potential data-access race conditions.
• Data-subject request handling and immutable audit trail: the tenant GDPR workspace provides DPO-role search, structured JSON personal-data export, documented erasure that preserves legal retention fields, and an append-only GDPR audit log capturing every DSR action (search, export, erasure, staff actor id, timestamp, record count affected) which is retained for 6 years independently of customer erasure requests to satisfy UK GDPR accountability obligations.
• Google-specific Google user data deletion on unlink or revocation: whenever a tenant customer revokes Google Connect OAuth consent, unlinks a Gmail mailbox, disconnects a GA4 property or disconnects a Google Business Profile, Marhala AI immediately deletes the tenant-scoped stored AES-256-GCM encrypted Google refresh token blobs, linked account display name, cached property metadata, cached Business Profile location/insights/review summaries and any short-lived access tokens from memory; deletion is confirmed by SQL DELETE against tenants.google_refresh_token and/or tenant customization.google_refresh_token_enc/iv/tag columns and recorded in the GDPR audit log. Further use of the affected Google scopes ceases immediately and subsequent API attempts surface an explicit reconnection prompt rather than retrying against a revoked token.

The public Marhala AI website uses Google Analytics to help measure website traffic, understand page usage and improve the site experience. Google Analytics may collect information such as page views, approximate location, device or browser details and interaction data through a Google tag integration on the website. The current Google Analytics measurement ID used on the site is G-7QFC0EYHL8.

Where the Marhala AI tenant platform integrates with Google Analytics on behalf of a subscribed tenant customer, GA4 runReport calls are made from the Marhala AI backend to analyticsdata.googleapis.com/v1beta using the tenant-scoped encrypted Google refresh token. Google user data flowing through this path is strictly limited to GA4 dimensional and metric output for the property identifiers configured by the tenant; Marhala AI does not request or ingest Google Analytics raw user-level event data, client_id, user_id, session_id or advertising identifiers unless a tenant expressly configures a raw export with their own property.

We also use first-party cookies and similar storage technologies for essential functionality including session state, CSRF tokens, temporary feature flags and user interface preferences. Non-essential cookies (analytics or advertising cookies) are only set where the site presents a consent banner and the user has given their consent. You can disable cookies at any time through your browser settings.

We send transactional and operational email messages using the configured tenant branding, including logo, primary colour and tenant display name, so that emails from our platform appear consistent with the hotel's or travel agent's own stationery. Example transactional messages include new-lead notifications to staff, thank-you confirmation emails to the guest who submitted an enquiry, booking confirmations and automated replies triggered by an out-of-hours schedule.

For any direct commercial marketing from Marhala AI (including newsletters, product updates, event invitations or partner promotions) we will only send marketing communications on an opt-in basis or where we have a legitimate business interest after a genuine commercial discussion, and every marketing email includes an easy one-click unsubscribe or opt-out mechanism.

Marhala AI does not keep personal data for longer than is necessary for the purpose for which it was collected, or for any longer required by law or regulation. The following indicative retention schedule applies unless a longer period is required or authorised by a signed customer agreement or specific law.

• Website enquiries and lead records: retained for a minimum of the active commercial relationship plus six years after the last meaningful contact in order to satisfy commercial, tax and evidentiary retention requirements, or shorter if requested through a valid erasure request.
• Staff user accounts, login sessions and permission audit logs: retained for the duration of the staff member's access plus 12 months after account deactivation, after which non-legal fields are minimised or deleted.
• Customer chatbot and WhatsApp Business conversation history: retained in line with the tenant workspace retention policy, defaulting to 36 months for active customer workspace records and longer only for audit/compliance purposes.
• GDPR audit logs and immutable access records: retained for a minimum of six years as evidence of compliance, regardless of customer erasure requests, as required under UK GDPR accountability obligations.
• Transactional finance, billing and tax records: retained for at least six years from the end of the relevant UK accounting period.

Marhala AI products and websites are not directed at children under the age of 13 and we do not knowingly collect, process or store personal information about individuals under 13 without verifiable parental consent. If you become aware that a child under 13 has submitted personal data to us, please contact [email protected] and we will take prompt steps to delete that information.

Special category personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying a natural person, health data, or data concerning sex life or sexual orientation) and criminal offence, conviction or misconduct data are only processed where necessary for the performance of our obligations under employment, social security or social protection law, or under another UK GDPR condition with appropriate safeguards recorded. Wherever possible we design our products so that customers do not pass such data into general CRM fields or general enquiry message boxes without a documented lawful condition.

Most of our processing is not automated in a way that produces legal or similarly significant effects on a data subject. However, we do make limited use of automated scoring for the narrow purposes of lead categorisation (e.g. assigning Wedding enquiry vs Room booking), spam or fraud detection on incoming web forms, AI-powered suggested next-steps for staff members and priority ranking for the front-desk staff inbox.

These automated steps are either a necessary part of entering into or performing a contract with the customer, or are carried out with explicit consent, and are never the sole basis of a decision that would produce legal or similarly significant effects on an individual. Staff users always have the ability to override an AI category assignment, edit a detected lead priority, dismiss an AI-suggested next-step or reassign an automated routing decision through the CRM user interface. Where we use automated detection on incoming messages we also keep a record of the manual staff override where it occurs.

We review and update this privacy policy from time to time to reflect changes in our processing activities, new product features, legal or regulatory requirements, or decisions affecting our sub-processor arrangements. Material changes will be posted on this page with an updated effective date and, where appropriate, we may notify customers or website visitors through an in-product notice or by email.

If you have a privacy concern, complaint or query, or wish to escalate a matter to the Data Protection Officer, please write to [email protected] or to Marhala AI Ltd, Data Protection Officer, 128 City Road, London, EC1V 2NX, United Kingdom. We will acknowledge receipt without undue delay and investigate in accordance with our internal DSR and complaint handling procedures.