Privacy notice

Zikora is provided by Evogue Consulting ("we", "us"). We run the software that hotels use. We run the software. Each hotel is responsible for the guest information it records.

• Hotel staff who sign in to Zikora.
• Hotel guests whose details a hotel records.
• Visitors to this website.

• Staff accounts: name, email address and sign-in details.
• Hotel records: bookings, rooms, bills, payments and invoices.
• Guest details the hotel records: for example name, phone, email, nationality and address. If the hotel enters them, ID document details. If the hotel allows it, a photo or scan of the ID document (see section 4). Only staff whose role allows it can see ID document details.
• A record of changes: who changed what and when. For guests it records which details changed, not the details themselves.

• A hotel can choose to keep a photo or scan of a guest's ID, front and back. This is off unless the hotel switches it on.
• Why the hotel keeps it: to keep the guest register the law requires and to confirm who is staying (draft wording).
• Who can see it: only hotel staff whose role allows it, such as managers and front desk. Reservation staff and accountants cannot.
• How it is protected: stored privately, never at a public web address. A photo opens only through a link that works for 60 seconds. Every upload, view and deletion is recorded with who did it and when.
• Before upload, the photo is made smaller on the hotel's device. This also removes hidden details, such as where it was taken.
• How long it is kept: deleted automatically 12 months after the guest's last check-out, unless the guest has a stay that is not over. The hotel can ask for it to be deleted earlier (draft wording).
• It is deleted straight away when the guest's personal details are removed, or when a hotel manager deletes it.
• Where it is stored: in the European Union (Ireland), like the rest of the database. The files are private, encrypted in storage, and only people with permission at the hotel can open them (draft wording).

• The database is run by Supabase on servers in the European Union (Ireland).
• The website is served by Vercel.
• Sign-in and password emails are sent by Supabase. We plan to send these, and booking confirmations, through our email provider Resend.

We use no advertising, no analytics and no tracking cookies. Your browser keeps your sign-in so you stay signed in. Our fonts are served from our own website, not from another company.

Each hotel's information is kept separate from every other hotel's. Inside a hotel, each person sees only what their role allows. We do not sell information.

• Bills, payments, invoices and the record of changes cannot be deleted, because they are financial records. Mistakes are corrected with a new entry that stays on record.
• A guest's personal details can be removed (anonymised) once the guest has no current or upcoming stay. Past stays and bills are kept without the personal details.
• After a hotel's account closes, we keep its information for 90 days, then delete it (draft wording).

You can ask what information we hold about you, ask us to correct it, or ask us to remove it. Write to our privacy contact at hello@zikorahq.com. If you are a hotel guest, you can also ask the hotel directly.

We will update this page when we change how we handle information, and we will change the date at the top. See also the security page and the terms of use.