1. Who we are
RoomListo is a maintenance planning service for hotels. It is operated by Golden Signature LLC, [Jeremy: state of organization] limited liability company, [Jeremy: mailing address] (“Golden Signature,” “we,” “us”).
This policy covers this website (roomlisto.com), the RoomListo web app, the RoomListo phone app and the housekeeping QR pages (together, the “Service”).
2. Our role and your hotel’s role
RoomListo is a business product. Our customers are hotels, hotel ownership groups and management companies (each a “Customer”). A Customer creates the accounts for its own staff, decides who can see what, and controls the information its people put into RoomListo.
- Information in a Customer’s account (staff accounts, work orders, photos, notes and the rest of Section 3): we handle it on the Customer’s behalf and under our agreement with the Customer. If you use RoomListo through your job, your employer’s own policies also apply, and questions about your information are best sent to them first.
- Information about visitors to this website and people who contact us: we decide how it is used, as described here.
[Lawyer: confirm the controller/processor (or “service provider”) framing and whether to offer a data processing addendum to Customers.]
3. What we collect
Staff accounts
Hotels create their staff’s accounts; nobody can sign up for RoomListo on their own. For each person we keep their name, a username, an email address if the hotel adds one (many technicians don’t have one), their preferred language, their role (such as front desk, technician, manager or owner), the hotels they work at and their work schedule.
Sign-in is handled by Amazon Cognito, part of Amazon Web Services (AWS). Passwords are stored by Cognito in a form we cannot read. Owners and managers also set up an authenticator app for a second sign-in step.
Work information
As people use RoomListo to run maintenance, we store what they enter, including:
- issues and work orders, out-of-order rooms, and the notes written on them;
- photos taken for a job, a checklist or an equipment label (such as a model and serial number plate);
- checklist answers and readings, such as pool and spa readings;
- end-of-day reports and the reasons work wasn’t finished;
- voice-log text: when a technician taps Talk and speaks, the phone or browser turns the speech into text and RoomListo saves the text with the time. We don’t receive or keep audio recordings;
- a history of who did what and when (for example, who logged an issue and who marked it done), which makes up each room’s and each piece of equipment’s history.
Hotel information
Rooms and areas, equipment details, schedules for preventive maintenance, compliance records and documents, and the average daily rate and occupancy figures a Customer enters so RoomListo can estimate revenue lost to out-of-order rooms.
Housekeeping QR reports
Housekeepers can report a problem by scanning a QR code posted by the hotel, without an account. We keep the report, any photo added to it and, if the housekeeper chooses to give it, their first name. The browser remembers that name on that device so it doesn’t have to be typed again.
Technical information
When anyone uses the Service, our systems record standard technical details: IP address, browser or device type, the pages or features requested, and the time. We use these records to keep the Service secure (for example, to limit repeated requests) and to fix problems.
This website and our email
This website does not use analytics, advertising or tracking tools, and its fonts and images are served from our own site. Our website host, Cloudflare, receives the standard technical details above to deliver the pages. If you email us, we receive your address and your message, which we keep to reply and follow up. Our email runs on Google Workspace.
4. PMS reports and guest information
RoomListo doesn’t need information about hotel guests, and we work to keep it out. A hotel can upload, paste or email in an out-of-order report from its property management system (PMS) so RoomListo can list the rooms that are out of order.
- Uploaded reports are read and then deleted right away. As a backstop, our storage automatically deletes any report file left behind, normally within two days.
- Emailed reports are read and the whole email is deleted as soon as it has been read. We keep only a short record of each email (when it arrived, the sender’s address, what happened to it, and each attachment’s name and size) for 30 days. We never store the subject, the body or the attachments.
- What we keep from a report is the room, the date it went out of order, the reason and a cleaned-up note. Before anything is saved, staff names and initials, guest names, phone numbers and reservation numbers are removed from the notes.
- Guest names are never stored.
Customers should not type guest names or other guest details into notes. The front desk can mark that a room has a guest in it or an arrival coming, without saying who.
5. Optional AI features
Some features use artificial intelligence (AI) to save typing: turning a desk note into work orders, matching a technician’s end-of-day notes to their tasks, translating notes between English and Spanish, reading equipment labels from a photo, and reading PMS reports that are scanned or in a layout RoomListo doesn’t know. These features are off unless they are turned on for the Customer’s account. [Jeremy: today AI is switched on for a whole deployment, not per hotel; make it a per-Customer setting before launch, or change this sentence.]
- AI runs through Amazon Bedrock, a service of AWS, using the Claude model made by Anthropic. We send only what the feature needs, such as the note, the report text or the label photo.
- [Lawyer: confirm against the current terms for Claude in Amazon Bedrock (the endpoint the app uses) before stating:] The content we send is not used to train AI models and is not kept by the AI service after it answers.
- AI results are suggestions. A person reviews, edits or rejects every one before it changes anything, translations are shown next to the original words, and every feature can be done by hand without AI.
6. How we use information
- To provide the Service: building each technician’s daily list, showing the desk and managers what is open, showing owners rooms out of order and estimated lost revenue, and producing reports and exports the Customer asks for.
- To keep the Service and its users safe: sign-in and second-step checks, keeping each hotel’s information separate, limiting abuse and investigating problems.
- To send messages the Service needs, such as a temporary password or a password reset code. The phone app will also send work alerts once push notifications are added (see Section 9).
- To answer questions and give support.
- To improve the Service, using information about how features are used. [Jeremy/Lawyer: decide whether we may use aggregated, de-identified data across Customers (for example, average days out of order) and say so here and in the terms.]
- To meet legal obligations and enforce our agreements.
We don’t use Customer information for advertising.
9. The phone app
- The app keeps your sign-in in your phone’s secure storage.
- It asks to use the camera or photo library only when you choose to add a photo, and uploads only the photos you pick.
- Dictation uses your phone’s own speech recognition (from Apple or Google, under their terms). RoomListo receives only the text.
- The app doesn’t send push notifications yet. When they are added, the app will ask your permission first and store a device token so we can send work alerts, such as an urgent job or “your list is ready.” You can turn them off any time in your phone’s settings. [Jeremy: update this item, and name the push providers, when push ships.]
- The app does not track your location.
10. Where it’s stored and how it’s protected
The Service is hosted on Amazon Web Services in the United States (the us-east-1 region, in Northern Virginia). Information is encrypted in transit and at rest.
Each hotel’s information is kept separate, and a person can see only the hotels they belong to. Owners and managers must use a second sign-in step. Access to the systems that run RoomListo is limited to the people who need it to operate the Service.
No system is perfectly secure. If we learn of a security incident affecting a Customer’s information, we will notify the Customer as described in our agreement and as the law requires.
11. How long we keep it
| Information | How long |
|---|---|
| Customer account information (staff accounts, work, photos, notes, history) | While the Customer’s subscription is active, then deleted within [Jeremy/Lawyer: number of days] after it ends, unless the Customer asks for an export first. |
| Database backups | Up to 30 days, then overwritten. |
| Uploaded PMS reports | Deleted right after reading; any file left behind is deleted automatically, normally within two days. |
| Emailed PMS reports | Deleted right after reading. A short record of each email is kept for 30 days. |
| CSV exports | Deleted after 7 days. |
| Replaced or deleted photos | Earlier versions deleted after 30 days. |
| Security and request logs | Up to 3 months (storage access logs up to 1 year). |
| Emails sent to us | As long as needed to answer and follow up. |
When a hotel deactivates a staff account, that person can no longer sign in. Their name stays on the work history they took part in, which is part of the hotel’s maintenance records.
12. Your choices and rights
If you use RoomListo through your job, ask your employer to see, correct or delete your information; your hotel manages your account and we help Customers answer these requests. You can also contact us directly and we will work with your employer.
Depending on where you live, you may have rights under state privacy laws, such as the right to know, correct or delete personal information. We will not discriminate against anyone for using these rights. [Lawyer: decide which state laws apply (for example, California’s CCPA, which covers employee information), whether Golden Signature acts as a service provider for them, and what to list here.]
13. Children
RoomListo is a workplace tool and is not directed to children. We don’t knowingly collect personal information from children under [Lawyer: 13 or 16].
14. Changes to this policy
We may update this policy as RoomListo changes. We will change the “Last updated” date and, for significant changes, tell Customers ahead of time by email or in the app.
This policy is also available in Spanish. [Lawyer: decide whether the English version controls if the two differ.]
15. Contact us
Golden Signature LLC
[Jeremy: mailing address]
[email protected]
[Jeremy: or a separate [email protected]]