This policy explains how Mirage Global Technologies LLC (1621 Central Ave #8434, Cheyenne, WY 82001, United States) handles personal data in connection with HubPMS.
Account data (you, the hotelier: name, email, phone, billing identity) — here we are the controller. Legal bases: performance of our contract with you (Art. 6(1)(b)) for providing the service and billing; legal obligation (Art. 6(1)(c)) for tax records; legitimate interest (Art. 6(1)(f)) for service security and essential service messages. Guest data (your guests' names, contact details, stay details, documents you collect) — here your property is the controller and we process it only on your instructions, under the Data Processing Agreement.
Some jurisdictions require properties to record guest identity details. Where you use online check-in, document data is collected on your instructions, stored under the access controls and audit logging described in the DPA, never used for any other purpose, and erased with the guest's profile on erasure requests. Our advice as your processor: record the fields the law requires; avoid storing document images unless your law explicitly demands it.
Card data never touches our servers. Payments are processed by the payment provider (e.g. Stripe); we store only tokens and transaction references.
We use a small set of sub-processors: our cloud infrastructure provider (hosting, United States); Stripe, Inc. (payment processing); Anthropic, PBC (AI text processing, only when AI features are enabled, no training on your data). The current named list is available at any time from [email protected], and DPA customers are notified of changes in advance per the DPA.
Guest marketing data, preferences and communications are erased on request. Billing and accounting records are retained for 7 years where the law requires it (Art. 17(3)(b) GDPR) — erasure requests are honored selectively so that legal retention is never violated. Account data is kept for the life of your account and deleted within 90 days of account closure, except the 7-year billing records.
Production data is hosted on servers in the United States. Transfers of EU/EEA personal data rely on the European Commission's Standard Contractual Clauses (SCCs), incorporated in the DPA, together with supplementary technical measures (encryption in transit, access controls, audit logging).
If a personal data breach affects your data, we notify you without undue delay after becoming aware of it, with the information Art. 33 GDPR requires, so you can meet your own notification duties as controller.
The HubPMS application uses only strictly necessary storage (your login session and interface preferences, kept in your browser). The public site sets no advertising or third-party tracking cookies. If that ever changes, a consent banner will appear before any non-essential cookie is set.
Access, rectification, erasure (with the legal-retention caveat above), portability, restriction and objection. Write to [email protected]. Guests should contact their property first — the property is their data controller; we support the property in fulfilling the request. EU/EEA residents may also lodge a complaint with their local supervisory authority.
Version 1.0 — effective 26 August 2026.