Privacy policy

At Roomflow we handle the data you give us with the same care we ask of the hotels we work with. This page explains what data we collect, why, who we share it with and how you can exercise your rights.

Who is responsible

Roomflow, based in Quesada, San Carlos, Alajuela, Costa Rica. Contact: hola@theroomflow.com.

What data we collect

• Contact form: name, email, company or hotel, website, phone, country, number of rooms, type of enquiry and your message.
• Free assessment: your contact details (name, email and, if you provide it, phone) and your hotel’s details: name, website, country and area, type of property, rooms, occupancy, direct bookings, tools and challenges. In advanced mode, also figures such as revenue, average daily rate, channel split or commissions.
• Where your visit came from: campaign parameters (utm), ad click identifiers (such as gclid or fbclid), measurement cookie identifiers (such as _ga, _fbp or _fbc), landing page and referring page.
• Technical data: IP address, browser and date of submission.

We don’t ask for sensitive data; please don’t include it in free-text fields.

What we use it for

• Answering your enquiry and the commercial follow-up you asked for.
• Producing your assessment and emailing you a copy.
• Knowing which campaigns and channels bring us enquiries, so we can invest better in advertising.
• Protecting the forms against spam and abuse.

We don’t sell your data or use it for other purposes.

Legal basis

We process your data with your consent, which you give by submitting a form, and to handle the relationship you start when you ask us for information or an assessment. You can withdraw your consent at any time by writing to us.

The AI-powered assessment

Your assessment answers are sent to an artificial intelligence model (DeepSeek, through OpenRouter) that writes the report in seconds. We only use providers that, according to their OpenRouter settings, neither store the data nor use it to train models. The report is for guidance only: it makes no automated decisions with legal effects on you, and our team receives a copy to walk you through it.

Who we share it with

With providers that serve us and process the data on our behalf:

• Vercel: website hosting.
• Sanity: storage of content and of form submission copies.
• Resend: email delivery.
• Cloudflare Turnstile: bot protection.
• OpenRouter and the AI model providers it routes to: producing the assessment.
• Google (Tag Manager, Analytics and Ads) and Meta: measuring the website and ads through cookies, explained in the Cookie policy.

We may also disclose it if a competent authority requires it by law.

International transfers

Several of these providers process data outside Costa Rica, mainly in the United States; AI model providers may be located in other countries, including countries in Asia. We choose providers with security and confidentiality commitments.

How long we keep it

For as long as needed to handle your request and the commercial relationship, and no longer than 24 months after our last contact, unless the law requires keeping it longer. After that we delete it.

Your rights

Under Costa Rica’s Law No. 8968 on the Protection of Individuals regarding the Processing of their Personal Data, you can access your data, correct it, ask us to delete it or object to its processing. Write to hola@theroomflow.com saying what you need and we will reply within the legal deadlines. If you are not satisfied, you can contact Costa Rica’s data protection agency (PRODHAB). If you live in another country, you also have the rights its laws grant you.

Security

The website only runs over an encrypted connection (HTTPS), access to submissions is restricted to our team, and the forms are protected against bots.

Minors

Our services are for hospitality businesses. We don’t knowingly collect data from minors.

Changes to this policy

If we change how we handle data, we will update this page and its date.