Privacy notice

1. Personal data we collect

Only what you give us when you ask for information or write in the chat:

• Identification and contact: your name and the email address, WhatsApp or phone number you choose for our reply.
• Your stay: arrival and departure dates, number of people, the apartment you are interested in and the message you write.
• Chat conversations: the text of the messages you exchange with the virtual assistant and with reception, and any name, phone or email you give there.
• Technical data: a random session identifier; where your visit came from (campaign parameters such as utm_source or gclid, the site that sent you and the first page you saw); the page you sent your request from; and a salted hash of your IP address, used to limit abuse of the forms and the chat. We never store your IP, only that hash.

We do not collect sensitive personal data or financial or payment data. Please do not write sensitive data (health, card numbers, passwords) in the chat or the forms.

The booking buttons take you to external platforms (Booking.com and, once available, Airbnb): bookings you make there, and the data and payments you give them, are governed by each platform’s own privacy notice, not by this one. This site takes no payments.

2. What we use your data for

Necessary purposes (we cannot help you without them):

• Answering your request, message or chat conversation.
• Quoting your stay and confirming availability.
• Managing your reservation if you decide to book with us.
• Following up on your request through the contact you gave us.
• Protecting the site from abuse and automated messages (limits based on the hashed IP).

Secondary purposes (voluntary; not needed to help you): measuring which channels and campaigns bring requests, using where your visit came from, to improve the hotel’s promotion. We do not use it to profile you or to send you advertising. You can refuse by writing to reservaciones@hotelvalle.com.mx, and your request is not affected.

We do not send advertising, newsletters or surveys. If we ever do, we will ask for your consent first.

3. Service providers and transfers

To run the site we use service providers (processors, encargados) that handle your data only to provide that service and on our instructions:

• Avanzia: builds and runs this site, the chat and the admin panel on behalf of Hotel Valle.
• Supabase: database and server functions where requests and conversations are stored.
• Netlify: website hosting.
• Anthropic: language model that drafts the virtual assistant’s replies; it receives the conversation text in order to answer.
• Brevo: sends the internal email notice to our team when a request arrives or someone asks to talk to reception; it receives the request data and the conversation transcript included in that email.

Some of these providers store data outside Mexico. We do not sell your data or transfer it to third parties for their own purposes, so we make no transfers that require your consent.

4. Consent

By sending a form with the acceptance box ticked, or by writing to us in the chat, you consent to the processing of your data for the purposes in this notice. If we wanted to use it for a different purpose, we would ask for your consent again.

5. Your ARCO rights

You can Access your data, Rectify it, Cancel it or Object to its processing, and you can revoke your consent or limit its use. Write to reservaciones@hotelvalle.com.mx with your name, a way to reply to you, the data concerned and the right you want to exercise.

We will answer within 20 business days and, if it applies, carry it out within the following 15 business days. If you believe your request was not handled properly, you can go to Mexico’s Secretaría Anticorrupción y Buen Gobierno.

6. How long we keep your data

Only as long as needed to handle your request or reservation and to meet any legal obligation that applies. The exact retention period is pending the legal review of this draft.

7. Cookies and browser storage

• A first-party cookie (hv_attr) and your browser’s local storage keep where your visit came from for up to 90 days, so it can be attached to your request if you write to us.
• Session storage keeps the identifier of your chat conversation; it is cleared when you close the tab.
• We use no third-party advertising or analytics cookies. The contact page shows a Google Maps map, which may set its own cookies under Google’s policy.

You can delete or block cookies in your browser settings; the forms and the chat keep working.

8. Security measures

We apply administrative, technical and physical measures to protect your data: encrypted connections (HTTPS), access to requests and conversations only for authorised staff with a username and password, and database access rules that block reading them from the public site.

9. Changes to this notice

We will publish any change on this page, with its update date.