Privacy policy

1. Data controller

The controller of your data is Aira Hotel, located at Gran Colombia 3-40 y Tomás Ordóñez, Cuenca, Ecuador. For any matter related to your personal data you can write to us at [email protected].

2. What data we process

We only ask for what we need to look after you:

• Identification: first and last names, ID card or passport number, and nationality.
• Contact: email and phone number.
• Your stay: dates, number of guests, room, rate, purchases and special requests.
• Payments: amount, date, reference and authorization number. We do not store your card details: they are processed directly by the payment gateway.
• Invoicing: name or company name, identification number (RUC, ID card or passport), email and address for the electronic invoice.
• Technical website data, such as connection information and error reports, for security, abuse prevention and technical diagnosis. We do not add our own analytics or advertising tools; the optional Google map involves separate processing explained in the cookies section.

3. Why we use it and on what basis

We process your data only for these purposes:

• Managing your booking and your stay, charging for services and assisting you before, during and after your visit (performance of the accommodation contract).
• Meeting legal obligations: keeping the guest register required by Ecuador's Tourist Accommodation Regulation and issuing the electronic receipts required by the Internal Revenue Service (SRI).
• Protecting the security of the hotel, its guests and the website, preventing fraud and diagnosing faults to keep the service available (legitimate interest).
• Sending you news and offers from Aira Hotel, only if you agree. You can withdraw your consent at any time.

4. Who we share it with

We do not sell your data. We use technical providers to deliver the service and respond to requests from competent authorities. The optional Google map involves its own processing, described in the cookies section:

• The payment gateway (PlacetoPay), to process online payments.
• The electronic invoicing provider and the SRI, to issue and authorize your receipts.
• Server hosting, storage and email delivery providers.
• The competent authorities, when required by law or ordered by a court.

5. International transfers

Some of these providers may store or process data outside Ecuador. In those cases we require contractual and technical safeguards equivalent to those of Ecuadorian law.

6. How long we keep it

We keep your data for as long as your booking and stay last and, afterwards, only for as long as the law requires: the guest register for the period set by tourism regulations, and receipts and accounting records for the period set by tax regulations. Data for news is kept until you withdraw your consent. Once those periods end, we delete or anonymize it.

7. How we protect it

We encrypt the most sensitive data, such as your document number and phone; access to our system is personal, role-based and protected with two-factor authentication; we log who views and changes information, and we keep encrypted backups.

8. Your rights

As the owner of your data you have the right to access it, rectify and update it, request its deletion, object to its processing, request its portability, request the suspension of its processing, and not be subject to decisions based solely on automated processing.

To exercise them, write to us at [email protected] from the email you booked with or attaching a copy of your ID. We will reply within 15 days at most. If you believe we did not address your request, you may file a complaint with Ecuador's Superintendency of Personal Data Protection.

9. Children and adolescents

We only process the data of minors that the guest register requires, provided by their parents or legal guardians.

10. Changes to this policy

If we change this policy, we will publish the new version on this page with its update date. If you have an active booking, we will let you know about important changes by email.

11. Cookies, storage and website services

You can visit the site without accepting optional features. Preferences and maps stay off until you choose them. Accept all and Necessary only have equal prominence in the notice. You can change or withdraw permission at no cost through Cookie preferences in the footer.

The first-party aira_consentimiento cookie stores the policy version, date and permitted categories for 180 days to respect your choice. It contains no tracking identifier. If it expires, becomes invalid or its version changes, we ask again. It is limited to this host, with Path=/, SameSite=Lax and Secure over HTTPS. If you block it, we cannot save your decision or enable optional features here.

With preferences permission, we save aira-intro-vista in localStorage to remember that you have seen the AIRA welcome screen. It is not a cookie and contains no identification data. It does not expire automatically: we delete this key when you withdraw permission, and you can also remove it in your browser. Without permission we do not save the visit; we only remember it in memory during that page.

The embedded Google Maps map only loads after maps permission, including through Load map. Google receives your IP address and browser information, may use cookies and process data outside Ecuador, under its policy at https://policies.google.com/privacy. Cookie names and lifetimes depend on the provider and browser. Open in Google Maps takes you to an external site without loading the map here. Withdrawing permission removes the iframe; we cannot delete cookies on Google's domain or undo data already transmitted. You can manage them in your browser.

The better-auth.session_token cookie, or __Secure-better-auth.session_token over HTTPS, is necessary to authenticate hotel staff in the panel, not to visit the public website. Sessions last 12 hours and are renewed during use. Two-factor sign-in may also use technical authentication cookies. Accepting preferences or maps does not start a staff session.

If Sentry is configured, the browser may send technical error and diagnostic session reports to that provider. We have not configured session recordings or advertising analytics. The integrations reviewed keep session context and trace links in memory, without cookies or persistent storage. We scrub cookies, credentials and identified personal data from reports, without claiming that all data are anonymous. Sending reports involves a connection to the provider and may involve processing outside Ecuador. This monitoring is independent of maps permission; without a DSN the browser SDK is not downloaded or started. For questions or to exercise rights over data under our control, write to [email protected].