Privacy, security and your data

This page answers the questions an owner, a general manager or an IT reviewer asks before connecting. The legal wording lives in the Privacy Policy and the Terms of Service. Where this page and those documents differ, the documents win. Section numbers below point into them.

What MAYA keeps

From your property system. Your bookings: the nights, the room type, the nightly rate and the status. Also the date each booking was made, how many adults and children, and the channel it came through. And its number in your system, but never the booking channel's own confirmation number. Also your room types and how many rooms each has, your own rates, and your property's name, time zone and currency. What MAYA reads and writes has the full list, system by system.

From you. Your rules, floors and ceilings, the prices you type, your answers about room types, rooms out of service, dates you set aside, your setup answers, and your team with their roles.

Screenshots you import from PIE. Never kept. Import from PIE reads a screenshot in your own browser, and it is never uploaded or sent anywhere. Only the rules and limits you then choose to add reach MAYA, like any you add yourself. Read Import your rules from PIE.

About you and your team. Your business email address and role. When you tick the Terms box: who ticked it, when, where in the app, the version, your browser, and in most cases your IP address (The Terms checkbox has the detail). When you go live: who clicked, the Terms version shown, your IP address and your browser (Going live). Billing details, while the card itself stays with Stripe. And a record of how MAYA was used, such as when a property connected, subscribed or cancelled and which screens were opened. None of it holds guest information.

Guest data: never kept

Your property system's answers can carry guest names, contact details and payment details. MAYA keeps only the fields on a short fixed list and drops everything else before anything is stored. A dropped field is never stored, shown or used. A new field your system adds later is dropped by default.

A Cloudbeds allotment block or group code can name a guest too, like "SMITH-WEDDING", and so can a ThinkReservations group's id. MAYA never keeps them, and never reads a ThinkReservations group's name. It turns the code into a scrambled key, with a secret of your property's own that only MAYA's servers can read, and keeps only the key, which says which bookings belong together and nothing else. MAYA also keeps the time each booking was made, to the minute, so separate bookings made together can count as one for booking speed. Their key is worked out from the dates, the room type and those times, never from anything about the guest.

What is left does not identify a guest to us. You could link a booking number to a guest using your own records, though, so the Privacy Policy treats booking records as personal data wherever the law does.

If a guest asks about their data, they should contact your property first, since we hold no names or contact details and usually cannot tell who a booking belongs to. If a guest contacts us, we answer as the law requires and may ask you to help find the records (Privacy Policy section 1).

Where your data is hosted

Modern Hospitality Solutions is based in the United States, and your data is processed on servers in the United States (Privacy Policy section 9). The database and its backups are on Amazon Web Services servers in Ohio (Privacy Policy section 8). There is no option to keep it in another country or region.

Using MAYA from Europe, the UK or Switzerland

MAYA takes customers worldwide, including in the European Economic Area, the UK and Switzerland.

Transfers to the United States. When personal data protected by the GDPR, the UK GDPR or Swiss law comes to us, it is covered by the European Commission's Standard Contractual Clauses: the ready-made contract terms Europe provides for sending personal data abroad. MAYA uses Module One (for one controller passing data to another), with the UK Addendum and the Swiss amendments. They are built into the Terms (section 8.9), so you agree to them when you agree to the Terms. Nothing extra needs signing. You are the data exporter and we are the data importer. The Clauses are governed by Irish law.

A data processing agreement. A data processing agreement is the contract a customer signs with a supplier that handles data only on the customer's instructions (a "processor"). We are not your processor. We handle booking data as an independent controller, as the next section explains, so the Terms do not include one. Unless we both sign a separate agreement that says otherwise, we are neither your processor nor a joint controller with you (Terms 8.5).

Why we hold the data. Account and billing information, to run our contract with you and meet tax rules. Booking data from your system, including before you pay, for your and our legitimate interest in setting up and running your pricing. Usage information, for our legitimate interest in running and improving MAYA. Cookies that measure visits to get-maya.com from the EEA and UK, on your consent (Privacy Policy section 9A). Where we rely on legitimate interests, you may object.

Your rights. You and your team can ask to see, correct or delete your account information. Depending on where you are, you may also have rights of access, deletion, correction and portability (a copy you can take elsewhere). We honour verified requests as the law requires (Privacy Policy section 10).

Complaints. Email us about how we handle your data, or to ask for a copy of the Clauses. You can also complain to your local data protection authority (Privacy Policy sections 9 and 9A).

Who is responsible for which data

"Controller" is the legal word for whoever is responsible for a set of personal data and why it is used.

• We are the controller of the information about you and your team: accounts, billing and how MAYA is used.
• We are also an independent controller of the booking data MAYA reads from your property system. This follows the terms of the property systems we connect to (Cloudbeds' own API terms say so for data that comes through them). We use that data only for the purposes in the Privacy Policy and the Terms.
• You stay responsible for the data in your own systems and for anything you must tell your guests. You also need a lawful basis to connect your system to MAYA (Privacy Policy section 1, Terms 8.4 and 8.5).

So, do you need to change the privacy information you give your guests? That is your call as the controller of your own guest data, and we cannot give legal advice (Terms 3.2). The Privacy Policy is public, so you can point to it.

Your system's access, and how to withdraw it

MAYA never sees your password. With Cloudbeds and ThinkReservations you sign in on their own site and approve MAYA there. They then give MAYA an access token: a key that lets it read and write on your behalf, within the permissions you approved. MAYA holds that token, not your password. Changing your password in Cloudbeds or ThinkReservations may still end MAYA's access. If prices stop updating afterwards, a General Manager or Hotel Admin reconnects from the PMS tab. With Mews, you create keys in Mews and give them to us, and we connect the property with you.

How the token is kept. The token or keys are kept encrypted, in a store for secrets that is separate from your booking data. No screen in MAYA shows them.

What the access is used for. Reading your bookings, room types and rates, and, once you go live, writing one nightly price per room type (on ThinkReservations also the same change, on their own rate, to each other standard rate type you tick). MAYA never creates, changes or cancels a booking, and never writes availability or restrictions. What MAYA reads and writes lists every read and write, including the two permissions MAYA asks for and never uses.

Withdrawing it. There is no disconnect button in MAYA. You withdraw access in your property system:

Withdrawing access stops MAYA reading and sending. It deletes nothing and does not cancel your subscription. Reconnecting and disconnecting has the whole path.

Security

The Privacy Policy (section 8) lists the safeguards:

• Encryption in transit. Data travels encrypted between your browser, MAYA and your property system.
• Access controls. Each person has their own login, and their role on each property limits what they can see and change.
• Careful handling of the tokens that connect MAYA to your system.

Is my data encrypted at rest? Your system's token or keys are, as above. For the rest of your data, the Privacy Policy promises encryption in transit and makes no separate promise about storage. Guest names, contact details and card details are never stored at all.

Who can see what. A login opens only the properties that person has been added to. Our staff can open your property to look, and change anything on it only in a time-limited support mode that records every change, as Can our staff see your property? explains. Roles has the table of what each role can do.

Your part. The Terms ask you to keep each login to one person and keep it private. Remove people who should no longer have access, and tell us promptly if you suspect someone has used your account (Terms 3.4).

No system is completely secure, and neither the Terms nor the Privacy Policy guarantees it (Terms 8.7, Privacy Policy section 8).

Do you back up our data, and what if it were lost? Yes. MAYA's database is backed up once a day, and each backup is kept for 7 days and then deleted. The backups are in the United States, in Ohio, like the database (Terms 8.7, Privacy Policy section 8). There is no point-in-time restore: the database can go back only to the moment a daily backup was taken, so anything set in MAYA after the most recent backup could be lost. Two more things help if data were ever lost. Your bookings and rates live in your property system, so MAYA can read them from there again. What lives only in MAYA is what you set there: your rules, floors and ceilings, typed prices, rooms out of service, dates you set aside, room type settings and your team. There is no export button, but you can email us for a copy at any time. MAYA is not a backup of your property system (Terms 8.8).

Certifications and security reviews

MAYA does not claim SOC 2, ISO 27001 or any other security certification, and no audit or test report is published. For a security questionnaire or any other security question, email us.

Fixed IP addresses

MAYA publishes no fixed IP addresses, so there is no list to allowlist in your property system. The connection works through the access you approve, not through an address. Nothing needs installing on a front-desk computer or opening on your network.

Reporting a security problem

If you come across something in MAYA that looks like a security problem (IT teams may call it a vulnerability), please tell us. For example, your property's calendar opening while you are signed out, or someone else's property in your list. Email us with "Security" in the subject line, and include:

1. What you saw, and where: the tab or page, and the exact words of any message.
2. When it happened, as the time your screen showed.
3. How to see it again, click by click, if you can.
4. A screenshot, if you have one.

Leave passwords, keys, card numbers and guest details out, as with every email to us.

We read it and reply by email, the same as any support request. There is no set response time (Terms 3.7), and no reward for reports (sometimes called a bug bounty).

Tell us what you came across in normal use, and please do not go looking for more. The Terms do not allow probing, scanning or testing MAYA's security (Terms 9). For questions about how MAYA is protected, read Certifications and security reviews.

If there is a security incident

When we need to reach you, we write to the email address on your account, or of any Hotel Admin or General Manager of the property, or tell you in the app (Terms 18.2). Neither the Terms nor the Privacy Policy adds a separate promise about security incidents, so those addresses are how we would reach you. Keep them current: a sign-in email cannot be changed in the app yet, so email us when one changes.

If you are worried about your data, or suspect someone has used your account, email us at once (Terms 3.4). A General Manager or Hotel Admin can also click Remove beside anyone on the Team page who should not be there, and their access ends at once.

Who else handles your data

We share data only with (Privacy Policy section 5):

• Service providers that run parts of MAYA for us: cloud hosting, measuring how MAYA and our website are used, payment processing, email delivery and error monitoring. They are bound by confidentiality and data protection terms and get only what they need. Stripe is our payment processor and holds your card (Terms 6.5).
• Your property system, as you direct: sending your prices to it once you go live.
• Anyone the law requires, or where needed to protect people's rights or safety.
• A buyer or investor, if the business is ever sold or merged, still under the Privacy Policy.

The Privacy Policy lists service providers by kind rather than by name.

Selling and sharing: what never happens

• We do not sell or rent personal information of any kind (Privacy Policy sections 3 and 5).
• Your prices come only from your own data. MAYA works out a property's prices from that property's own bookings and your rules. Your non-public data is never used to work out or recommend another property's prices (Terms 3.1 and 8.6, Privacy Policy section 4).
• Nothing goes to your guests. We never use your booking data to market to guests or to contact them (Privacy Policy section 3).

What we may do: combine data into totals that cannot be linked to any property or person, such as market-wide price trends. The Terms let us use those totals to run, secure and improve MAYA and for other lawful purposes the property systems' own terms allow, and they never identify you, your property or anyone else. They are never turned back into identifiable data, and even totals made from your data are never used to work out another property's prices (Privacy Policy section 4, Terms 8.6).

Can our staff see your property?

Yes. Our staff can open your property and look at everything on it, to check a price with you or to see what a rule did. Looking is all a plain staff login can do: your rules, prices, room types, team and settings stay as you left them.

To change anything for you, for example to switch your property back to simulation at your request, a member of staff switches on a support mode that lasts a short, fixed time and asks for a code from an authenticator app each time. Every change made in it is recorded: who, when, which property and what changed. It shows in your change log as "Changed by MAYA support", a price our staff type for you reads "MAYA support set the base rate to $180.00.", and an answer we give to a Rules that keep adjusting banner is headed "MAYA support's answer". Anything we change for you, we change on your instruction (Terms 3.3). Roles covers who else can see your property.

How long things are kept

Nothing is deleted when you cancel or disconnect. MAYA keeps your data so that a property that comes back does not have to be set up again (Terms 8.8, Privacy Policy section 7). It stays until you ask us to delete it, with the exceptions in the table.

Even after deletion we may keep (Terms 8.8, Privacy Policy section 7):

• database backups, until they expire 7 days after each is taken;
• billing, tax and transaction records;
• records of Terms acceptance, audit logs and correspondence;
• records of how MAYA was used, never with guest information;
• anything needed for a legal claim or required by law;
• totals that identify nobody.

Deleting your data

You cannot delete a property or its imported bookings from inside MAYA. A Hotel Admin or General Manager emails us from their own address. Once we have checked the request, we delete or de-identify the property's data within 90 days. Deletion is permanent, ends MAYA for that property without a refund, and a later reconnection starts from scratch. Cancelling, restarting and leaving has the steps.

Getting a copy of your data

There is no export button in MAYA. Your rules, limits and settings are on screen for you to copy down, and your bookings are in your own property system.

You can email us to ask for a copy. The Terms do not oblige us to export or return your data except where the law requires it (Terms 8.8), so a copy is not something we can promise in every case. Where privacy law gives you a right to a copy of personal data, under the GDPR for example, we honour verified requests as that law requires (Privacy Policy section 10). Terms and legal says who owns what.

Cookies

On get-maya.com, visitors from the European Economic Area and the UK (and from the Channel Islands, the Isle of Man and Gibraltar) see a small banner with Decline and Accept. Tools that measure how the site is used load, and set their cookies, only after Accept. A Cookie settings link in the footer lets you change your answer at any time. Visitors from elsewhere see no banner, and those tools load without asking. All visitors are also counted without cookies (Privacy Policy section 2.e).

In the MAYA app there is no cookie banner. The app uses cookies to keep you signed in, to keep which property you last opened, and, when you choose a larger text size in Settings, to open each page at that size.

In these docs, which live in the app at maya-rms.com/docs, nothing is counted and no cookie of their own is set. Your choice of light or dark and of property system tab stays in this browser only. A text size you chose in MAYA's Settings shows here too, from the app's cookie. If you are signed in to MAYA in the same browser, the page notices that sign-in and shows links into MAYA.

The log of MAYA's calls to your system

For Cloudbeds, the PMS tab lists the most recent requests MAYA made: the time, what was asked, whether it worked and how long it took. Requests are kept for 7 days. For ThinkReservations and Mews MAYA keeps no such log, and the list reads "Not tracked for this system". The PMS tab explains each column.

The docs helper

The Ask MAYA docs panel matches your question to these pages inside your browser. Nothing you type is sent anywhere unless the docs cannot answer and you choose to send the question to us. Then it is kept as text only, not tied to you. Each question asked is counted without its words: the kind of reply, the part of the docs, whether you were signed in, and the MAYA screen whose Help opened the docs, if any. Please never type guest names or card numbers into it. About these docs explains how it works.