Privacy notice

Who we are

POSALY is an online service that helps hotels work with content creators. Creators apply to hotels, POSALY prepares a scorecard for each application, and the hotel decides.

POSALY is operated by [legal entity name and registered address — to be named]. In this notice, "POSALY", "we" and "us" mean that operator. [to confirm by the owner/DPO]

Who is responsible for your data

Who decides how your data is used depends on why we hold it. [to confirm by the owner/DPO]

• Hotel signup requests, the accounts of people who use POSALY for a hotel or for Mozaik, and this website: POSALY decides why and how this data is used, so POSALY is the controller. [to confirm by the owner/DPO]
• A creator who applies to POSALY directly, through the creator form on this website: POSALY is the controller of that application until it is passed to a hotel. [to confirm by the owner/DPO]
• Creator data handled for a hotel (applications to that hotel, scorecards, agreements, content, pages and messages): the hotel, or Mozaik where Mozaik runs the creator programme for that hotel, is the controller. POSALY processes this data on their behalf and on their instructions, as processor. [to confirm by the owner/DPO]

Where a hotel or Mozaik is the controller, you can also contact them directly. If we receive a request that is theirs to decide, we pass it on to them and tell you that we have. [to confirm by the owner/DPO]

What we collect: hotels asking to join

When someone asks for a POSALY account on our hotel signup form, we collect:

• the hotel's name and, if given, its website;
• the contact person's first and last name, e-mail address and, if given, phone number;
• the message, if one is written, and the language chosen;
• the IP address the request came from, used only to stop abuse of the form;
• our team's decision on the request and, when it is approved, the hotel account it created.

What we collect: people who use a hotel or Mozaik account

For each person with an account, we hold:

• name, e-mail address, role, and the hotel or organisation the account belongs to;
• sign-in data: a password stored only as a one-way hash, sign-in sessions, and one-time sign-in and invitation links;
• a record of the changes made in the dashboard, such as decisions on applications, edits and invitations, kept in an audit log;
• language and notification preferences, and any feedback, problem reports or feature requests sent to us;
• the conversations held with the dashboard's assistant, which are processed by our chat and AI provider.

What we collect: creators

Creators reach POSALY by applying through a hotel's chat assistant, through the form on this website or through a partner, or because a hotel's team adds them as a prospect. Depending on how far a creator goes, we hold:

• Application details: name, e-mail address, phone number if given, social media handles, the hotel and campaign applied to, what the creator wrote, and the chat conversation in which the creator applied.
• Public profile data: follower counts, engagement, audience location and similar figures about the creator's public social media accounts, obtained from data providers such as Influencers Club, and the creator's public profile picture. Sensitive audience details, such as ethnicity, religion or politics, are removed before anything is stored.
• Scorecards: scores and bands calculated from that public data, and the assessments of our reviewers. Scores are calculated automatically, but they decide nothing on their own: a person at the hotel makes every decision. [to confirm by the owner/DPO]
• Creator accounts: verified e-mail addresses, a password stored only as a one-way hash, sign-in sessions (including IP address and browser type), and the language chosen.
• Agreements: the terms a hotel proposed, whether the creator accepted or declined them, and any reason the creator gave.
• Content and pages: links and files the creator submits, publication reports, and the messages the creator and the hotel exchange on the creator's pages.

What we collect: visitors to this website

This website uses no analytics, advertising or tracking. Like any web server, ours records each request (the IP address it came from, the page, the time and the browser type) in server logs, which we use only to keep the service secure and running. [server log retention period — to be named]

Why we use it, and on what legal basis

We use personal data only for the purposes below. Each legal basis is our current position. [to confirm by the owner/DPO]

• To provide the service hotels sign up for (accounts, applications, scorecards, agreements and content): performance of our contract with the hotel or Mozaik. [to confirm by the owner/DPO]
• To consider a hotel's request to join: steps taken at the hotel's request before entering into a contract. [to confirm by the owner/DPO]
• To assess creator applications from public profile data: the legitimate interest of the hotel in working with creators whose audience is real and suitable, balanced against the creator's interests. [to confirm by the owner/DPO]
• To create and run a creator account: the creator's consent, given when they create the account. [to confirm by the owner/DPO]
• To keep the service secure, prevent abuse and keep a record of who changed what: our legitimate interest in a secure and accountable service. [to confirm by the owner/DPO]
• To meet our legal obligations, for example when an authority lawfully asks us for information. [to confirm by the owner/DPO]

Who receives your data

We do not sell personal data. We share it only as follows:

• The hotel a creator applies to sees that creator's application, scorecard, agreement, content and messages. A hotel never sees another hotel's applications.
• Mozaik, which runs creator programmes for hotels on POSALY, sees the applications and creators it handles for those hotels. [to confirm by the owner/DPO]
• Our service providers, who process data only on our instructions: hosting (Hostman, servers in the European Union); our chat and AI provider (TALOS MaiND), which runs the chat in which creators apply and the dashboard's assistant; public profile data providers (Influencers Club); and our e-mail delivery provider [e-mail provider — to be named]. [to confirm by the owner/DPO]
• The signed-in dashboard, including the hotel signup form, loads its typefaces from Google Fonts, so Google receives your device's IP address when you open it. This website and the creator pages serve their own typefaces and send nothing to Google.
• Authorities, when the law requires us to.

Where your data is stored

POSALY's database, files and backups are kept on servers we rent from Hostman in the European Union. [data centre country — to be named]

Some of our providers may process data outside the European Economic Area. Where they do, we rely on safeguards such as the European Commission's standard contractual clauses. [each provider's location and safeguard — to be named] [to confirm by the owner/DPO]

How long we keep it

We keep personal data only as long as we need it. The periods below are applied automatically by the service every night.

• Hotel signup requests: deleted 12 months after they were sent, or 12 months after a refusal. An approved request is kept as the record of how the hotel joined, but the contact's name, e-mail address, phone number and message are removed after 12 months. The IP address is removed after 30 days.
• A creator's expression of interest: names, contact details and the creator's own words are removed 12 months after the last contact, or 3 months after it when the interest was sent to a single hotel. Prospects added by a hotel's team: identifying details and notes are removed after 12 months.
• Public profile data: kept for a set period after it was last fetched or last used, 365 days unless a shorter period is set for its source, and never removed while an application or agreement is in progress. [to confirm by the owner/DPO] [automatic removal is built but not yet switched on]
• The chat conversation and raw data an application arrived with: removed at the latest 90 days after it was received. [to confirm by the owner/DPO]
• E-mail verifications that were never completed: deleted after 30 days.
• Sign-in sessions: deleted 30 days after they end. One-time sign-in links: deleted 7 days after they expire.
• Notes written in feedback on release notes: removed 2 months after they were last edited.
• Accounts, applications, scorecards and agreements: kept while the account or agreement exists, and erased or anonymised when the person asks for erasure. [period after an account or agreement ends — to be decided by the owner/DPO]
• Server logs: [period — to be named].

Your rights, and how to use them

You can ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, and to receive the data you gave us in a portable form. Where we rely on your consent, you can withdraw it at any time; this does not affect what was done before.

To use any of these rights, write to [privacy contact — to be named]. Tell us your name and the e-mail address or social media handle we hold. We check that the request comes from you, for example by replying to that e-mail address or asking for a message from that account, because anyone can name a public handle.

Erasure is carried out in the next nightly run. We keep only a minimal record that the request was carried out, so that the same e-mail address or handle is not added again later. Erasure cannot be undone. Where a hotel or Mozaik is the controller of your data, we act on their instructions and tell them about your request. [to confirm by the owner/DPO]

We answer within one month. If you are not satisfied with our answer, you can complain to the Hellenic Data Protection Authority or to the data protection authority of the country where you live. [to confirm by the owner/DPO]

Scores are calculated automatically from public data, but no decision about a creator is made by a machine alone: a reviewer reads every scorecard and the hotel decides. You can ask for a person to look again at any assessment of you. [to confirm by the owner/DPO]

Cookies and browser storage

This website sets no cookies. It remembers two small choices in your browser's local storage, on your device only: that you dismissed the language suggestion, and that you closed the welcome card. Neither is sent to us.

When you sign in, we set one cookie that keeps you signed in: posaly_rt for hotel and Mozaik accounts, posaly_crt for creator accounts. It lasts up to 7 days, cannot be read by scripts, and is sent only to our sign-in address. The dashboard and the creator pages also keep your language choice, and the dashboard your last chosen hotel and view, in local storage on your device.

Because the sign-in cookie is strictly necessary and the rest stays on your device, we do not ask for cookie consent. [to confirm by the owner/DPO]

Contact

Questions about this notice or about your data: [privacy contact — to be named].

Data protection officer: [name and contact, or a statement that none is appointed — to be named].

Changes to this notice

When we change this notice, we publish the new text on this page with a new version and date. If a change affects how we use data you have already given us, we tell you before it applies.