Smart Hotel WiFi
EN
Get your price

Privacy

Last updated: 4 November 2026

This notice covers the website hotelwifi.ch, its forms and bookings made through hotelwifi.ch, including payment through Stripe. It does not cover services we provide to business customers under separate agreements. It applies to people in the European Union and the European Economic Area under the General Data Protection Regulation (GDPR) and to people in Switzerland under the Swiss Federal Act on Data Protection (FADP). For people in Switzerland, the corresponding FADP terms apply.

1. Controller

Airfy Inc.
201 W. 5th Street, 16th Floor
Austin, TX 78701
United States
Email: sales@airfy.com

2. Visiting the website

When you open a page, our web server processes your IP address, date and time, the requested address, the status code, the amount of data transferred, the page you came from (referrer), your browser identifier (user agent) and the X-Forwarded-For header if your browser or a proxy sends it. It stores these data in log files. Error logs also contain your IP address.

Purpose: delivering the pages, secure operation, error analysis and defense against attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

Retention: section 6.

The website sets no cookies. We use no analytics or advertising services. The pages load all content from our own web server. The exceptions are Cloudflare Turnstile in the forms and when you book (section 3) and the Stripe payment page when you book (section 5a).

3. Spam protection with Cloudflare Turnstile

The forms and the booking use Cloudflare Turnstile from Cloudflare, Inc. (USA). Turnstile tells requests from people apart from requests by programs. The Cloudflare script loads only when you use a form: when you click or tap into it, type in it, move into it with the Tab key, or submit it. It does not load when you open or scroll the page. Only once it loads does Cloudflare receive your IP address and technical details about your browser and connection. Turnstile stores one entry for challenges.cloudflare.com in your browser's storage (cf.turnstile.u). It sets no cookies. When you submit a form, our form service checks the result with Cloudflare. When you start a booking, our checkout service checks the result with Cloudflare, sends your IP address to Cloudflare again and logs the result.

Purpose: protecting the forms and the booking against spam and abuse.

Legal bases: For storing and reading information in your browser, Art. 5(3) of Directive 2002/58/EC as implemented in national law (in Germany, Section 25(2) no. 2 TDDDG). This is strictly necessary for sending a form or a booking as you request. For all further processing, Art. 6(1)(f) GDPR. Our legitimate interest is keeping out automated requests.

Cloudflare processes these data on our behalf. Cloudflare also uses them as an independent controller to improve its bot detection. Cloudflare's notice applies to that: https://www.cloudflare.com/turnstile-privacy-policy/

You can prevent this by blocking scripts from challenges.cloudflare.com. You then cannot submit the forms. Our checkout service then accepts a booking without this check. You can still email us at sales@airfy.com.

4. Forms

When you submit an offer form (AI Hotel WiFi, AI WiFi Concierge), we process your name, your email address, your hotel or group if you provide it, the number of your hotels and rooms, for the AI WiFi Concierge the level you choose, a message created from your selection with quantities and prices, the subject and the website the request comes from, your IP address and the time of submission. For the spam check, the form service also evaluates technical values, such as the time between opening and submitting the form. It does not store them.

Our form service runs on a server in Germany. It forwards your request as an email to sales@airfy.com via the delivery service SendGrid of Twilio Ireland Limited. The mailbox is processed in Google Workspace, see section 5. The form service also stores your request, without your IP address, in a queue. From there we transfer it to our CRM system to handle it. Our CRM system runs on servers in Germany.

To prevent overload, the form service counts requests in memory only: per hour by a shortened hash of your IP address, and per day by website. Its own logs contain this hash, not your IP address. The web server in front of the form service logs each request with your IP address as described in section 2, but not the content of your request.

Messages that look like spam are discarded without an error message. If you do not hear from us, please email sales@airfy.com.

If the form does not go through, the page lets you email us instead. Section 5 then applies.

Purposes and legal bases:

  • Answering your request: Art. 6(1)(b) GDPR if you are seeking a contract with us yourself. Otherwise, for example for requests on behalf of a company, Art. 6(1)(f) GDPR. Our legitimate interest is answering business inquiries.
  • Your IP address in the request: investigating spam and abuse, Art. 6(1)(f) GDPR.

Providing your details is voluntary. Without your name, email address and the number of hotels and rooms we cannot answer your request.

Reminder before your contract ends: If you enter your email address, the year and, if you wish, the month in which your current contract ends, the website sends these details to our form service like a request. They then go to our mailbox, into the queue and into our CRM system as described above. Before that date we remind you by email of the end of your contract and send you suitable offers from Airfy Inc. for hotel WiFi until then. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by submitting. You can withdraw it at any time with effect for the future, for example by email to sales@airfy.com. Without your email address and the year we cannot remind you.

Retention: section 6.

5. Emailing us

If you email us, the purpose and legal basis for answering your request in section 4 apply. We process emails to addresses at airfy.com in mailboxes at Google Workspace of Google LLC (USA). We process emails to addresses at airzen.io on our mail server and in our ticket system on servers in Germany.

5a. Booking and payment through Stripe

In the price calculator you choose the number of hotels and rooms and the level. When you start the booking, the website transmits this selection and the language of the page to https://forms.airfy.ai/api/checkout. This checkout service runs on our server at Hetzner Online GmbH in Germany. It passes the details on to Stripe and returns the address of the payment page. The checkout service itself does not store your selection. To prevent overload, it counts requests by your IP address in memory only, for ten minutes at most. The web server in front of the checkout service logs each request with your IP address as described in section 2.

You then reach an external Stripe payment page. The Stripe account for these bookings belongs to Airfy Inc. in the USA. When you open it, Stripe receives your IP address and technical details about your browser. Stripe's cookie and privacy notices also apply there.

When you book, Stripe collects the name of your business and the billing address as required fields, as well as your email address, telephone number and payment details, and the VAT identification number if you provide it. If you book signs, Stripe also collects the delivery address. A coupon code can be entered. The booking details processed are your selection, the language and the website.

To perform and invoice the booking, we also process the price, subscription and billing details, payment status and booking or customer identifiers. Stripe processes your payment details and details for payment verification.

Purposes: concluding and performing the contract, delivery where applicable, subscription management, payment processing and invoicing. Legal bases: Art. 6(1)(b) GDPR for contracts with you yourself; for employees and representatives of a company, Art. 6(1)(f) GDPR. Our legitimate interest is performing and invoicing the contract with the company. Where we meet statutory bookkeeping and retention obligations, Art. 6(1)(c) GDPR applies.

Stripe acts partly on our behalf when processing payments. For its own legal obligations and its own fraud prevention, Stripe acts as an independent controller. Information about Stripe and its processing entities: https://stripe.com/privacy and https://stripe.com/privacy-center/legal

You must provide the details required for booking and payment if you wish to conclude the contract. Without them we cannot process the contract.

6. Retention

We delete web server log files automatically after 14 days at most.

We delete the form service's logs after six weeks at most. There is not yet a fixed deletion period for entries in the form service's queue.

We have not set a fixed deletion period for requests and emails to us. They remain stored until we delete them. You may request deletion at any time (sections 10 and 11). Statutory retention duties take precedence.

If our mail server classifies an email to an address at airzen.io as spam, it moves it to a spam folder. Purpose: protection against spam. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is secure email operation. Our ticket system does not fetch this folder. The folder is currently not emptied automatically.

Our mail server logs technical connection and delivery data when emails are received, sent and retrieved: the time, the sender and recipient addresses, the IP addresses and host names of the servers and devices involved, message and queue identifiers, the message size, the delivery status and delay including the receiving server's response, encryption parameters, the results of spam and sender authentication checks and, for mailbox access, the user name, IP address and session counters. It does not log the subject or content of emails. Purpose: delivery, troubleshooting and abuse prevention. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is reliable and secure delivery. We have not set a fixed maximum period for the log files on the mail server. The mail server replaces some of them by number and size of the files, not by their age. The existing log files go back to early 2023. Another copy in the mail server's system journal remains until the server next restarts. We delete the copy in our monitoring system after 30 days. A backup of this copy does not have a deletion period.

We back up the mail server and the ticket system daily. Purpose: recovery after an outage or data loss. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is being able to restore data after an outage. We do not currently delete these backups. Data we delete therefore remains in older backups.

For contract and billing records, retention depends on the term of the contract, statutory bookkeeping and retention obligations and the establishment, exercise or defense of legal claims.

7. Recipients

  • AirZen Networks Lda., Portugal: operation of the web server, the form service, the checkout service, the mail server, the ticket system and the CRM system, on our behalf.
  • Hetzner Online GmbH, Germany: servers and backup storage in data centers in Germany, on behalf of AirZen Networks Lda.
  • Twilio Ireland Limited, Ireland: delivery of form requests (SendGrid), on behalf of AirZen Networks Lda. Twilio Ireland Limited uses Twilio Inc. (USA) for delivery.
  • Cloudflare, Inc., USA: spam protection (Turnstile) on our behalf; as an independent controller for improving its bot detection (section 3).
  • Google LLC, USA: mailboxes for addresses at airfy.com (Google Workspace), on our behalf.
  • Stripe, LLC, USA, and, depending on the processing, Stripe Payments Europe Limited, Ireland: payment processing, subscription management, their own legal obligations and fraud prevention. The roles are described in section 5a.

8. Transfers to the United States

Recipients based in the United States are Cloudflare, Inc., Twilio Inc. and Google LLC. Each of them is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (www.dataprivacyframework.gov). For people in the EU and the EEA, transfers to them rely on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. For people in Switzerland, they rely on Annex 1 of the Swiss Data Protection Ordinance (DPO).

Stripe also processes payment and booking data in the USA, in particular through Stripe, LLC. According to Stripe's privacy notice, Stripe uses the EU-U.S. and Swiss-U.S. Data Privacy Framework and standard contractual clauses for this where required. Information about the responsible Stripe entities, the transfers and copies of the safeguards is available at https://stripe.com/privacy and https://stripe.com/privacy-center/legal

We, Airfy Inc., are based in the United States. From there we access the data that our service providers in the EU process for us. Implementing Decision (EU) 2023/1795 and Annex 1 of the DPO cover certified companies only. Airfy Inc. is not certified.

9. No automated decision-making

We make no automated decisions within the meaning of Art. 22 GDPR. If the spam check fails, you can email us. Stripe's privacy notice applies to Stripe's own checks and decisions (section 5a).

10. Your rights under the GDPR

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18). Where we rely on your consent or on Art. 6(1)(b) GDPR, you also have the right to data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Processing before the withdrawal remains lawful. Please write to sales@airfy.com. You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

11. People in Switzerland

You may request access (Art. 25 FADP). You may request the handover or transfer of the data you gave us where the conditions of Art. 28 FADP are met. You may request the correction of inaccurate data, object to the processing and request erasure (Art. 32 FADP). You may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

12. Changes

We update this notice when our processing changes. The version published here applies.