Privacy Notice

1. Who we are

FreeGuides is a guest experience platform for hotels and hostels, and the publisher of FreeGuides Tours, a marketplace of self-guided walking tours, and What’s On by FreeGuides, a guide to things to do in each city. In this notice “FreeGuides”, “we” and “us” mean FreeGuides Pty Ltd, a company registered in Australia.

This notice covers our websites (freeguides.com, tours.freeguides.com and explore.freeguides.com), the hotel dashboard (app.freeguides.com), the guest apps hotels give their guests (such as the digital guide, the AI receptionist Eli, guest chat, events, online check-in and self-guided tours), and our business emails.

2. Our two roles: controller and processor

Data protection law treats us differently depending on whose data it is:

• We are the controller (the organisation that decides how and why the data is used) for website visitors, people who send us enquiries or request a quote, hotel staff we contact about our product, people who use the hotel dashboard, billing contacts, and people who buy a tour on FreeGuides Tours.
• We are a processor (a service provider acting on someone else’s instructions) when a hotel or hostel uses FreeGuides to provide services to its guests. The hotel is the controller of its guests’ data, and we process it on the hotel’s behalf under our agreement with them.

3. If you are a hotel guest

Depending on the features your hotel has switched on, guest apps may process:

• Stay services and online check-in: your name, room number, reservation reference and dates, email, phone, estimated arrival time and any requests you type in. We check these against the hotel’s property management system (for example Mews, Cloudbeds or Oracle OPERA). Requests are free text, so please share only what you’re comfortable sharing: if you mention a health condition or dietary need, it reaches the hotel as you wrote it.
• Guest chat: your name, country or city, stay dates, guest type, interests, profile photo, Instagram handle if you add one, a device identifier, a push notification token, and your messages. Other guests in the chat can see your profile and messages.
• The AI receptionist (Eli), support tickets and requests: what you type in the chat, and the name, email and room number you give when you ask staff for help. Tickets and requests are emailed to the hotel and a confirmation is emailed to you.
• Events and RSVPs: your name, email, phone and room number, and payment details for paid events (handled by Stripe; we never see your card number).
• Self-guided tours: your device’s location while you play a tour. It is used on your device to show your position and is not stored by us.
• Usage analytics: with your consent only, a pseudonymous identifier, pages viewed, device and browser type and approximate location, and, for Microsoft Clarity, a recording of how you interact with the page. See our Cookie Notice.

The hotel determines the lawful basis for this processing. Ticking an “I agree” box in a guest app confirms you have seen the terms and this notice; it is not the basis on which your data is processed, and you can still exercise all your rights.

4. What we collect, why, and our lawful basis

This section covers the data we control. The lawful bases below are those in the GDPR and UK GDPR. Under the Australian Privacy Act we collect personal information only where it is reasonably necessary for these functions, and usually directly from you.

We also keep security and audit logs (user ID, email, IP address and the action taken) across our systems, on the basis of our legitimate interest in keeping them secure. We do not sell personal information, and we do not use it for decisions that produce legal or similarly significant effects about you without human involvement.

5. Business prospecting emails

We email hotels and hostels that we think would benefit from FreeGuides. If you received one of these emails:

• Where we got your details: from public business sources, mainly the property’s own website and its public business listings (for example Google Maps). Each email tells you the page where we found your address.
• What we hold: your name, job title, business email and phone, the property you work for, the source page, our emails to you and your replies, and whether our emails were opened or links clicked.
• How we research: we use web search and AI tools (Google Gemini) to summarise public information about the property so our email is relevant.
• Lawful basis: our legitimate interest in offering a relevant service to a business. We send to business addresses only, and only about our product.
• Opting out: every email has a one-click unsubscribe link, or you can simply reply. We will stop immediately and keep only the minimum needed to make sure we never contact you again (your email address on a suppression list).

6. Cookies and analytics

Our sites and apps use a cookie to remember your privacy choice and, only if you agree, analytics and marketing tools: Google Analytics 4 (through Google Tag Manager), Firebase Analytics, Microsoft Clarity, and the Meta Pixel. Until you choose, these are blocked and Google tags run in a cookieless “consent mode”. You can change your choice at any time with the “Cookie settings” link at the bottom of every page. The Cookie Notice lists each cookie and how long it lasts.

7. AI features

Eli, the AI receptionist in guest apps, generates replies with Google Gemini. What you type is sent to Google to produce a reply under our agreement with Google Cloud, and chat sessions are deleted after 30 days. Please don’t share sensitive information such as health details or payment card numbers in the chat. Eli can be wrong; for anything important, ask hotel staff.

On What’s On by FreeGuides, Eli helps you plan a stay. It also uses Google Gemini: what you type and the dates and city you choose are sent to Google to produce a reply.

8. Who we share it with

We share personal information only as needed for the purposes above:

• Service providers (sub-processors) who host and run our platform, such as Google Cloud and Firebase, Vercel, Stripe, Xero, EmailJS and Web3Forms. They may use the data only to provide their service to us. The full list, with what each one receives and where, is on our Sub-processors page.
• Your hotel, if you are a guest: requests, tickets, RSVPs and check-in details go to the hotel, and stay details are checked with the hotel’s property management system.
• Other guests, if you join a guest chat: your chat profile and messages are visible to the other people in it.
• Booking partners, only when you choose to book with them. Our travel sites link to partners such as GuruWalk, Viator and OpenTable for things we don’t sell ourselves. Following one of those links takes you to the partner’s own site, and the link carries our partner reference so the partner can credit us for the referral. The partner takes your booking under its own terms and privacy notice.
• Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality.
• Authorities where the law requires it, or to protect the rights, safety or property of you, us or others.
• A buyer or successor if our business is sold or restructured, in which case this notice will continue to apply to your data.

When a hotel publishes an event to platforms such as Eventbrite or Meetup, only the event itself is shared, never attendee details.

9. International transfers

FreeGuides is based in Australia, and most of our data is hosted in the United States: our database, file storage and cloud functions run on Google Cloud and Firebase, and our websites on Vercel. Some processing takes place in the European Union (for example our AI helper service runs in Google Cloud’s Belgian region, and the Mews property management system is EU-based), and our accounting provider Xero may store data in New Zealand, Australia or the United States.

When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the EU-US Data Privacy Framework (and its UK Extension and Swiss counterpart) where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum for UK data. You can ask us for a copy of the relevant safeguards at privacy@freeguides.com.

For Australian residents: we may disclose personal information to recipients in the United States, the European Union, New Zealand and Switzerland, and we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles.

10. How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, then delete it or irreversibly anonymise it. Backups roll off within 35 days of deletion.

For hotel guest data, the hotel can instruct shorter periods. Our standard periods are:

When a hotel stops using FreeGuides, we delete its guests’ data within 90 days, or return it first if the hotel asks. We keep data longer only where the law requires it.

11. Security

We protect personal information with encryption in transit (TLS 1.2 or higher, and HSTS on our web apps), encryption at rest by our hosting providers with additional application-level encryption for the most sensitive credentials, role-based access, and audit logging of privileged actions. We never handle payment card numbers: Stripe processes them directly.

If a personal data breach occurs we assess it promptly, notify the relevant regulator within the required timeframes (72 hours under the GDPR; as soon as practicable under the Australian Notifiable Data Breaches scheme), and tell affected hotels and people where required. To report a security issue, email security@freeguides.com. More on how we protect data is on our Security page.

12. Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to:

• access the personal information we hold about you and get a copy;
• have inaccurate information corrected;
• have your information erased;
• restrict how we use it;
• receive it in a portable, machine-readable format;
• object to our use of it based on legitimate interests, and to direct marketing at any time (we will always stop marketing to you);
• withdraw consent at any time where we rely on it, for example for cookies;
• not be subject to decisions based solely on automated processing that significantly affect you.

If you are in Australia, you can ask to access and correct the personal information we hold about you under the Australian Privacy Principles (APPs 12 and 13). You can also deal with us anonymously or under a pseudonym where that is practicable, for example when browsing our sites.

To make a request, email privacy@freeguides.com. We may need to confirm your identity, and we will ask only for what we need to do so. We respond within one month (GDPR), which we may extend by two further months for complex requests (we will tell you within the first month), and within 30 days for requests under the Australian Privacy Act. There is normally no charge.

Hotel guests: please direct requests to your hotel, which controls your data. If you write to us, we will forward your request to the hotel and help them respond.

13. Complaints

Please contact us first at privacy@freeguides.com so we can try to put things right. We will respond within 30 days. You can also complain to a regulator:

• EEA: the data protection supervisory authority in the country where you live or work, or where the issue happened (see the list of EU authorities).
• United Kingdom: the Information Commissioner’s Office (ico.org.uk).
• Australia: the Office of the Australian Information Commissioner (oaic.gov.au), if you are not satisfied with our response.

14. EU and UK representatives

Our EU and UK representatives under Article 27 of the GDPR and the UK GDPR will be listed here. Until then, please contact us directly at privacy@freeguides.com. We handle requests from the EEA and the UK in the same way and within the same deadlines as any other request.

15. Children

Our services are not directed at children. Dashboard accounts are for people aged 16 or over, and guest events require the person signing up to confirm they are 18 or over. Tours are bought by an adult and may be enjoyed by the whole family. If you believe a child has given us personal information, contact privacy@freeguides.com and we will delete it.

16. Changes to this notice

We update this notice when our services or the law change. The date at the top shows the latest version. If a change materially affects how we use your information, we will tell hotel customers and dashboard users directly before it takes effect.

17. Contact us

Questions or requests about privacy: privacy@freeguides.com
Post: FreeGuides Pty Ltd, Level 5/24 Campbell St, Haymarket NSW 2000, Australia

See also our Cookie Notice, Sub-processors, Security and Terms of Use.