Privacy Policy
This policy explains which personal data we collect when you visit Bookmatrix.com, try the demo or become a customer, why we use it, how long we keep it and what your rights are.
1. Controller
SDR I.K.E. (Private Company), VAT EL802525705, GEMI 178012948000, Agias Paraskevis 11, Paralia Katerinis, 60150 Pieria, Greece. For any personal data matter: info@bookmatrix.com, +30 2351 151525.
2. Who this covers
- Visitors of bookmatrix.com / bookmatrix.gr.
- People who start the sign-up wizard or the free demo.
- Customers and Users of the platform (account, billing and contact details).
- People who send us their details through an ad form (Meta, Google) or contact us.
We process the data of the guests of hotels that use Bookmatrix.com on behalf of the property, which is the controller. For that data please contact the property; our obligations are described in the Terms of Service, §13.
3. Data we collect
- Sign-up wizard / demo: name, email, phone, business details (VAT number, legal name, tax office, address — looked up automatically at AADE / VIES), property details (rooms, rates, policies), username and password (stored only in hashed form).
- Account and usage: sign-in dates, IP address, device / browser, actions on the platform for security and support.
- Billing: invoicing details and payment history. Card details are processed by the payment providers (Stripe, Viva.com); we never see them.
- Communication: emails, messages and notes from phone calls with our team.
- Ads and traffic: which campaign or page brought you (utm, gclid, fbclid parameters), the landing page and, only with your consent, advertising cookies (see §5–6).
- Ad lead forms: what you fill in on a Meta or Google form (usually name, email, phone, property name).
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating the demo and the account, providing the service, support | Performance of a contract / pre-contractual steps (Art. 6(1)(b)) |
| Invoicing, accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Contacting you during the demo (a call, help and reminder emails), following up after a form or an ad | Legitimate interest in helping you evaluate the service you asked for (Art. 6(1)(f)) — you can object at any time |
| Security, fraud and abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Measuring our campaigns (measurement cookies, internally, aggregated) | Consent (Art. 6(1)(a)) — can be withdrawn at any time |
| Advertising cookies and sending events to Meta / Google | Consent (Art. 6(1)(a)) — can be withdrawn at any time |
5. Advertising and measurement
On your first visit a cookie message offers three equal choices: “Accept all”, “Necessary only” and “Settings”, where you switch the Measurement category (our own cookies remembering which ad, page or email brought you) and the Advertising category on or off separately. Until you choose, no measurement or advertising cookie is stored; we keep the source of your visit only temporarily in your session and delete it if you choose “Necessary only”. If you turn on Advertising, these load:
- Meta Platforms Ireland Ltd — Meta Pixel and Conversions API (ad measurement)
- Google Ireland Ltd — Google Ads tag and conversions (ad measurement)
With your consent, when you start the demo, confirm it or subscribe, we tell Meta and Google directly that the ad worked. We send your email and phone only hashed (SHA-256), together with the ad identifiers (fbc, fbp, gclid), so they can be matched to the campaign. We do not sell data. Without consent no advertising tool loads and nothing is sent. You can change your choice from the “Cookie settings” link at the bottom of every page.
6. Cookies
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
BookMatrixAccount | Necessary | Keeps you signed in, security | 24 hours |
bm_last | Functional | Remembers the last account on the sign-in page | 180 days |
bm_ui / bm_pwa | Functional | App look preference | 1 year |
bm_fiscal_snooze_* | Functional | Hides a notice for a few hours | Until the snooze ends |
bm_ob | Necessary | Resumes the sign-up wizard where you left off | 30 days |
bm_consent | Necessary | Stores your cookie choice | 1 year |
bm_ref | Measurement (with consent) | Which of our emails brought you to the site | 30 days |
bm_attr | Measurement (with consent) | Which campaign / page brought you (utm, gclid, fbclid) | 90 days |
_fbp, _fbc | Advertising (with consent) | Meta ad measurement — only after “Accept” | Up to 90 days (Meta) |
_gcl_*, Google Ads cookies | Advertising (with consent) | Google ad measurement — only after “Accept” | Up to 90 days (Google) |
Necessary and functional cookies (for example the look you picked) do not need consent; measurement and advertising cookies are stored only if you accept them, and are deleted if you withdraw consent. You can also delete cookies from your browser settings.
7. Recipients
We use the providers below, who process data on our behalf under contract:
| Provider | Purpose | Region |
|---|---|---|
| Render Services, Inc. | Application hosting (servers) | USA / EU |
| MongoDB, Inc. (Atlas) | Database | EU / USA |
| Cloudflare, Inc. | CDN, image and file storage, security | Global network |
| Stripe Payments Europe, Ltd. | Subscription billing | EU / USA |
| Viva Payment Services S.A. (Viva.com) | Payments, Viva Fiscal (certified e-invoicing provider) | EU |
| Everypay | Card payments | EU |
| Channex.io | Channel manager (connection to Booking.com, Airbnb, etc.) | EU / UK |
| PCI Booking | Secure card data tokenisation (PCI DSS) | EU |
| Google LLC (Workspace) | Email delivery | EU / USA |
| Papaki Ltd | Email delivery, domains | EU |
| Anthropic PBC | AI features (AI agents, replies) | USA |
| OpenAI, L.L.C. | AI features | USA |
| Meta Platforms Ireland Ltd | Messenger / Instagram / WhatsApp messages (when you connect them) | EU / USA |
| Twilio Inc. | SMS / WhatsApp messages | USA |
| TTLock (Hangzhou Sciener) | Smart locks (when you connect them) | China / Global |
| Google LLC (Maps) | Maps in the booking engine | USA |
Data is also shared with public authorities where the law requires it (for example AADE for our own invoices), with Meta / Google under §5, and with our accountants or legal advisers when necessary.
8. Transfers outside the EU
Some providers are located or process data outside the EEA (mainly the USA). Transfers rely on an adequacy decision (EU-US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses.
9. How long we keep data
| Data | Retention |
|---|---|
| Unfinished sign-up wizard without contact details | 3 days |
| Unfinished sign-up wizard with contact details | 6 months |
| Demo that did not become a subscription | 90 days after the demo ended |
| Prospective customers (contacts, ad forms) | 24 months after the last contact |
| Customer account and data | For the subscription; deleted within 6 months of the end (export available for 30 days) |
| Invoices and accounting records | At least 5 years, as tax law requires |
| Cookie choice and cookies | As in the table in §6 |
10. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (in particular to promotional contact), and you can withdraw consent at any time. Send your request to info@bookmatrix.com; we answer within one month and may ask you to confirm your identity. You can also complain to the Greek Hellenic Data Protection Authority.
11. Security
Communication is encrypted (HTTPS). Passwords are stored only hashed (bcrypt), automatic sign-in links work once and for a limited time, access is role-based with optional two-factor authentication, and sign-in attempts are rate-limited. No method is perfectly secure, but we review our measures regularly.
12. Children
The service is meant for professionals, not for children under 16.
13. Changes
If we change this policy materially, we will show it on this page with a new date and, for customers, send an email.