Security and data protection at Sweeply
Sweeply protects hotel data with encryption in transit and at rest, two-factor authentication, role-based access and logged changes, and processes it under a GDPR data processing agreement with every customer.
How does Sweeply protect hotel data?
Hotel data is encrypted in transit and at rest, access is limited by role and protected with two-factor authentication, and every change is logged.
Encryption: TLS for all data in transit, and AES-256 encryption for stored data in Google Cloud.
Access control: two-factor authentication, role-based permissions granted only where needed, and a minimum number of administrators.
Logging: access to data is logged, and every entry, change and deletion is recorded against a named user.
Backups: automated, encrypted backups in Google Cloud, with a documented emergency plan for restoring access.
Separation: production and test systems are kept apart, and each hotelโs data is logically separated from other customersโ data.
People: everyone at Sweeply is bound by confidentiality, and customer data may not be stored on personal devices.
Where is hotel data hosted and processed?
Sweeply ehf. is an Icelandic company, so the GDPR applies to Sweeply directly through the EEA Agreement.
Production runs on Google Cloud in the us-central1 region in Iowa, USA, so hotel data is processed in the USA. These transfers are covered by the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
Physical security of the data centres is managed by Google Cloud. Its certifications are listed on the Google Cloud compliance page.
Is Sweeply GDPR compliant, and can we sign a DPA?
Yes. Sweeply acts as a data processor for your hotel and signs a data processing agreement under Article 28 of the GDPR, governed by Icelandic law.
Breach notification: we notify you without undue delay, where feasible within 48 hours of becoming aware of a breach.
Data subject requests: we help you respond, and can export a personโs data as CSV or JSON.
Subprocessor changes: we give 30 daysโ notice of any new or replaced subprocessor, and you can object.
Which subprocessors does Sweeply use?
Sweeply uses the subprocessors below. Each is bound by a written agreement with data protection obligations at least as strict as our DPA.
Google Cloud
Core application functionality
USA
Twilio
SMS welcome message to a user
USA
Sentry
Troubleshooting
EU hosted
Chargebee
Subscription management and billing
EU
Intercom
In-product customer support, messaging and related communications
USA with DPF
Honeycomb
Troubleshooting
EU hosted
Inngest
Background job processing
USA
OpenAI
AI processing
USA
Google Vertex AI
AI-assisted product features
USA
Transfers to subprocessors in the USA are based on the EU-U.S. Data Privacy Framework where the subprocessor is certified under it, and otherwise on the EU Standard Contractual Clauses.
How does Sweeply use AI providers with hotel data?
Sweeplyโs AI features run on OpenAI and Google Vertex AI, which are subprocessors under the same terms as every other subprocessor.
Sweeply may create anonymised or aggregated data that does not identify your hotel, guests or staff, and use it to operate and improve the service, including AI features. Anonymised data is not personal data.
Customer data is not used to train OpenAIโs or Googleโs AI models.
What data does Sweeply process, and for whom?
Sweeply processes personal data on behalf of your hotel, which remains the data controller. It covers hotel guests, and hotel staff and contractors who use Sweeply.
Names
Contact details, such as phone numbers and email addresses
Usage and log data, such as user IDs, IP addresses, device information and activity logs
Hotel operations data, such as guest names, room numbers, arrival and departure dates, guest requests and task assignments
Planning data, such as shift and task schedules and task status
The data is used to provide Sweeply: hosting, notifications by email, SMS and push, customer support, troubleshooting and AI-assisted features. Special category data, such as health information, is not intended to be processed and should not be entered into Sweeply.
What happens to our data when the contract ends?
Sweeply deletes your data within 30 days after the contract ends, unless the law requires us to keep it.
Before the contract ends, you can export your data at any time in a common format. Copies in backups are removed as the backups rotate, and we confirm the deletion in writing on request.
Who do we contact about security and data protection?
Email legal@getsweeply.com for security and data protection questions, DPA requests and subprocessor information.