Privacy policy

The Hapi Partner Onboarding Portal is a testing environment where software companies verify their integrations against simulated hotel operations before connecting to Hapi. During its development phase the service is operated by Glhip on behalf of the Hapi sandbox programme. Questions about this policy can be sent to info@glhip.com.

• Account information. When you sign in with Google, Microsoft or an email link we receive your email address, your name and a provider identifier. We do not receive your password, and we request only the openid, profile and email scopes.
• Company workspace details. Company name, workspace address, optional website domain, team membership and roles, and the integrations and use cases you register.
• Integration testing data. API requests your software sends to the sandbox, webhook deliveries we send to your endpoints, command results, test outcomes and the evidence collected for readiness review. Credentials in this data are redacted before storage.
• Sandbox connection settings. Webhook destination URLs and the credentials you supply for them, which are encrypted at rest.
• Billing information. When annual access is purchased, payment is handled by Stripe. We store the subscription state and invoice references, never card numbers.
• Technical logs. Request metadata such as timestamps, IP address, status codes and correlation identifiers, used for security, rate limiting and troubleshooting.

All hotel, guest, reservation and financial records in the sandbox are fictional and generated by us. They do not describe real hotels or real people. Any data your software sends into the sandbox is treated as test data and is isolated to your company workspace.

• To create and secure your account and company workspace.
• To provide the sandbox, run tests, diagnose failures and record evidence for readiness review.
• To send transactional messages: invitations, provisioning notices, review outcomes, billing and annual validation reminders.
• To operate, monitor and protect the service, including abuse prevention and rate limiting.
• To meet legal and accounting obligations.

We do not sell personal data and we do not use it for advertising.

We rely on the following processors, each bound by their own data processing terms:

• Supabase for authentication and the database, hosted in the United States (us-east-1).
• Vercel for hosting and delivery of the portal.
• Google and Microsoft as sign-in providers, when you choose them.
• Stripe for payments, when annual access is purchased.
• Resend for transactional email.

Account and workspace data is kept for as long as the workspace exists. Sandbox test data follows the retention you choose in the workspace and can be reset at any time. Evidence submitted for readiness review is retained according to the review policy shown at submission. Technical logs are kept for a limited period for security and troubleshooting. Deleting a workspace removes its data except records we must keep for legal or accounting reasons.

You can access and correct your account information from the workspace. You can request a copy or deletion of your personal data, or object to a use described here, by contacting info@glhip.com. Depending on where you live you may also have the right to lodge a complaint with a supervisory authority.

Access to workspace data is restricted to members of that company and to authorised Hapi staff. Secrets are encrypted at rest, connections use TLS, and every access is scoped to the company that owns the data.

We will update this page when the service or our processors change, and we will show the new date at the top. Material changes will be announced in the portal.