Who we are and whose data it is
GroupSalesKit runs the service. For your account, our website and our own sales outreach, we decide how information is used.
For what a hotel puts into GroupSalesKit or collects through it (its kit, its buyer links and booking pages, and what buyers send through them), the hotel decides how it is used and we process it on the hotel’s behalf. If you are a buyer, the hotel you are working with is your first contact for that information; we will help the hotel answer your request.
What we collect
Account information: name, work email, role, hotel or company, phone number, sign-in details and settings. Billing is handled by Stripe; we see the plan and payment status, never card numbers.
Hotel content: files, photos, menus, floor plans, website text, facts, kit copy, contact cards, email signatures, links and QR codes that a hotel adds or approves.
Buyer and booking information: when a hotel shares a buyer link or booking page, what the buyer and the hotel add to it, such as the buyer’s name and email, colleagues either side adds, messages, deadlines, files (for example rooming lists, tax-exempt certificates and signed agreements), questions asked on a kit, and replies sent by email to a booking’s own address. Card details for a deposit are entered on the hotel’s own payment page; GroupSalesKit never receives them.
Visits and use: pages viewed, clicks and buttons used, time on page, browser and device type, the page you came from, campaign tags in the link, a random visitor ID kept in your browser, a keyed one-way hash of your IP address (we don’t store the address itself), and errors.
Session recordings: a recording of how pages are used (described under Cookies, analytics and your consent).
Our sales outreach: business contact details of hotel sales and management professionals we contact or who contact us (name, work email, company, role) and our correspondence with them.
The phone app: a notification token for your device, so we can send the alerts you turn on.
Messages you send us: forms, support requests, feedback and setup notes.
How we use it
To run the service: build and publish kits, power buyer links, booking pages, cards, signatures and QR codes, send the emails and alerts you ask for, and show hotels activity on their own links.
To draft from what you give us: uploaded files and public website pages are processed to suggest facts and copy. Nothing publishes until someone at the hotel approves it.
To keep it working and safe: fix errors, prevent abuse and fraud, and enforce our terms.
To improve the product, using usage information and session recordings.
To talk with you about your account, billing, security and changes to the service, and, for hotel professionals, about GroupSalesKit itself. You can ask us to stop at any time.
To meet legal obligations.
Activity on a link shows what happened on that link. It does not prove who opened it: links can be forwarded.
We do not sell personal information, share it for cross-site advertising, or use customer content to train AI models.
AI processing
Drafting from files and websites uses OpenAI’s API. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models.
Drafts can be wrong or out of date. The hotel reviews and approves facts before anything is published.
Cookies, analytics and your consent
Your browser keeps a few things for us in local storage: whether you’re signed in, your settings, and a random visitor ID that lets us count repeat visits.
If you are in the European Economic Area, the United Kingdom or Switzerland, we ask first. Until you choose Allow, we don’t record sessions, don’t load our Google Ads tag, and keep nothing on your device: the visitor ID lasts only while the page is open. You can change your answer any time from “Cookie settings” at the bottom of our pages and of buyer kits.
Browsers that send Global Privacy Control or Do Not Track are never recorded and never measured for ads.
Session recordings use PostHog (United States). They show pages, clicks, scrolling and errors. Anything typed into a form is hidden, passwords are never recorded, and the contents of booking pages and of the reply composer are blocked out. We use recordings to find what’s confusing or broken, never to identify buyers or for advertising.
Our own marketing pages use Google Ads measurement with advertising storage, ad personalization and ad user data denied by default. It never runs on hotel kits, booking pages or account pages, and form contents are never sent to Google.
Blocking local storage in your browser can stop sign-in and some features from working.
Google account and Gmail add-on data
When you use the Gmail add-on, Google provides your verified account identity and authorization information so we can confirm access to your GroupSalesKit hotel workspace.
The add-on can insert the content you select into your current email draft. It does not request permission to read your inbox, email bodies, attachments, contacts, or existing draft content, and it does not send email. You review and send your reply in Gmail.
Hotel answers, buyer names, proposal links, offer details, and search text that you enter or select in the add-on are processed to prepare your chosen content. Creating a buyer link stores its details in your hotel workspace and makes them accessible to people who receive that link.
Google account data is used to provide and secure the requested integration. We do not sell it, use it for advertising, or use it to train generalized AI models. GroupSalesKit use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove the add-on and revoke its access through your Google account. Removing it stops future access but does not delete buyer links or content already saved in GroupSalesKit. To request deletion of saved information, contact info@groupsaleskit.com.
Service providers (subprocessors)
These companies process information for us, only to provide their service. Each is in the United States unless noted.
Vercel: hosting the website and app.
Supabase: database, sign-in and file storage (US East).
Stripe: subscription billing and payment details.
Resend: sending email, and receiving replies to booking addresses.
OpenAI: drafting facts and copy from files and websites.
PostHog: product analytics and session recordings.
Google: maps and travel times on buyer kits, ad measurement on our marketing pages, the Gmail add-on, and our own email.
ScraperAPI: fetching public hotel web pages when a hotel imports its website.
OpenStreetMap (Nominatim and Overpass): looking up addresses and nearby places.
Apple, and browser push services such as Google and Mozilla: delivering notifications you turn on; Apple also for Wallet passes.
We also share information with people a hotel chooses to share a kit, link or booking page with; when the law requires it; to protect people, rights or the service; and with a buyer of or investor in our business, under the same protections.
Legal bases (EEA, UK and Switzerland)
We process account and hotel information to provide the service you signed up for (contract); analytics, recordings and ad measurement with your consent where the law requires it; security, fraud prevention, product improvement and business-to-business outreach on our legitimate interests; and billing records to meet legal obligations.
Information is processed in the United States. We work with providers that offer Standard Contractual Clauses or Data Privacy Framework certification for these transfers. A data processing agreement for hotels is available on request.
How long we keep it
Account, hotel and booking information: while the account is open. When an account is deleted, we delete its workspaces, kits, booking pages and their files, visit records, email copies and the sign-ins of members who belong to no other account within 30 days of the request. Billing records that the law requires stay with Stripe, and backups expire on their own rolling schedule.
Visit records and session recordings: visit records are deleted with the account they belong to, or on request; recordings are deleted on PostHog’s standard schedule.
Our sales outreach: until you ask us to stop or to delete it.
Your choices and rights
You can ask to see, correct, export or delete your information, object to how we use it, or withdraw consent. Email info@groupsaleskit.com. We answer within 30 days and may need to confirm who you are first.
If you are a buyer, ask the hotel first; we will help it answer. If you are in the EEA, the UK or Switzerland, you can also complain to your data protection authority.
You can stop non-essential emails from us at any time. Account, billing, security and booking emails still go out while you use the service.
Security, children and changes
How we protect information is on our Security page. No service can promise perfect security.
GroupSalesKit is for businesses and is not meant for anyone under 16.
When we change this policy we post the new version with a new date. For a significant change, we email account owners at least 30 days before it takes effect.
Contact us
Privacy questions and requests: info@groupsaleskit.com.
Mailing address: GroupSalesKit, 406 Dennywood Drive, Nashville, TN 37214.
GroupSalesKit