Ultra Guest
Data map
Each category of personal data on the platform, its purpose, default retention (tied to the live retention engine), deletion behavior, and whether it may be processed outside the EEA.
| Category | Purpose | Role | Default retention | Deletion / anonymization | Processed outside the EEA? | Implementation reference |
|---|---|---|---|---|---|---|
| Guest & session data | Identify the guest, run the device session, and personalise the stay. | Processor | Hidden from the hotel after 1095 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. (guest_stay) | Hidden from the hotel after 1095 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. Session tokens expire on inactivity. | Yes | privacy.py _erase_subject / guest_stay retention_policy |
| Stay data | Match a guest to a reservation and tailor in-stay offers and fulfillment. | Processor | Hidden from the hotel after 1095 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. (guest_stay) | Hidden from the hotel after 1095 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. | Yes | privacy.py guest_stay retention_policy |
| Order & cart data | Process bookings and purchases of ancillary offerings and record acceptance. | Processor | Retained for tax and consumer-protection record-keeping (legal obligation). | Contact name/email/notes erased on a guest erasure request; the financial record is retained where law requires. | Yes | privacy.py _erase_subject (orders) |
| Concierge conversation data | Run the AI/staff concierge thread and book from the hotel's live offerings. | Processor | Hidden from the hotel after 365 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. (conversation) | Hidden from the hotel after 365 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. | Yes | privacy.py conversation retention_policy; AI inference via Amazon Bedrock (AWS us-east-1) |
| Consent records | Record per-purpose consent and withdrawal to evidence the lawful basis. | Processor | Append-only ledger retained as evidence of consent for the relationship's duration. | Consent is set to 'withdrawn' on a guest erasure request; the audit event is retained. | Yes | consent_state / consent_event (migration 0026) |
| Data-subject request records | Track access and erasure requests and their outcome. | Processor | Request metadata retained as compliance evidence; never includes the export blob. | Metadata retained to demonstrate the request was handled. | Yes | dsar_request (migration 0026) |
| Ledger & financial records | Maintain the double-entry ledger, commission reconciliation, and payouts. | Controller | Retained under legal-obligation (tax/accounting); NEVER swept by retention. | Soft-deleted/retained on erasure; the financial record itself is preserved as required by law. | Yes | wallet_entry / ledger (retention_sweep excludes financial records) |
| Staff & admin data | Manage hotel staff and platform-admin accounts and access. | Controller | Retained for the duration of the account/relationship (independent-controller activity). | Removed when the account is deprovisioned. | Yes | account / GoTrue identity (self-hosted on AWS) |
| Support, email & audit logs | Deliver email, prevent abuse, and keep security/operational audit logs. | Processor | Hidden from the hotel after 365 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. (email_outbox) | email_outbox: Hidden from the hotel after 365 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. email_otp: Deleted after 30 days. stay_validation_attempt: Hidden from the hotel after 90 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. analytics_event: Hidden from the hotel after 730 days if the hotel switches this on; Ultra keeps a protected copy. Deleted only when the guest asks. | Yes | privacy.py retention_sweep (email_outbox/email_otp/stay_validation_attempt/analytics_event) |