Privacy policy: Hotel & B&B Booking System

Last updated: 2 November 2026

This policy explains what data the Wix app “Hotel & B&B Booking System” (the app), published by Kayabyte, the trading name of Caner Kaya, Stasjonsveien 64, 0771 Oslo, Norway (we, us), processes when it is installed on a Wix site. It adds to the privacy policy for Kayabyte apps for Wix, which also applies.

What the app does

The app lets a site owner take room bookings for a hotel, B&B or guesthouse through a booking widget on their site. Guests choose dates and rooms and pay through the site’s Wix checkout.

Roles

The site owner is the controller for their guests’ data. Kayabyte acts as a processor that handles the data only to run the bookings the site owner offers. Wix.com Ltd. hosts the site, its checkout and its orders. Cloudflare, Inc. hosts the app’s booking service and its database and is a sub-processor.

Data the app stores

• Room types and settings the site owner enters: names, descriptions, photo links, number of rooms, prices, rates, seasons and booking rules.
• Bookings: dates, number of guests, the guest’s name, email address, phone number (optional) and message to the hotel (optional), the price, deposit and balance, the booking status and the Wix order number.
• Calendars: links to the site owner’s other calendars (for example Booking.com, Airbnb, VRBO or Google Calendar) and the dates those calendars block, with the event name they give (such as “Reserved”).
• The site’s name, address, currency and time zone, read from Wix.
• Visitor keys: one-way keyed hashes of the visitor’s network address and of the anonymous visitor ID Wix gives the browser. They are used only to let one visitor hold one unpaid stay at a time and to limit how many bookings one network address can start on a site per hour. They can’t be turned back into the address or ID. A hold’s keys are removed when the hold ends, and the hourly counter is deleted after an hour.

Data the app does not handle

Payments go through the site’s Wix checkout. We never receive card or bank details. The booking widget shows visitors only which nights are free, never who booked.

Logs

The booking service writes technical log lines (the app instance ID, the request path, the outcome and, for errors, a short message). Logs contain no guest names or contact details and are kept by Cloudflare for a short time.

Retention and deletion

• Checkouts that were never paid are deleted 30 days after they lapse.
• Guest names, emails, phone numbers and messages on past stays are erased two years after check-out. The dates and amounts stay, so the site owner keeps a record.
• When the app is removed from a site, the site is disabled right away: its booking widget stops taking bookings and its calendar links are no longer imported. The data is kept for 30 days, so reinstalling the app within that time restores everything, and the calendar export link keeps listing confirmed stays so other booking sites don’t free those nights. After 30 days all of that site’s data (room types, bookings, calendar links and blocked dates) is deleted. Site owners can ask for earlier deletion, or deletion of a single guest’s data, at support@kayabyte.dev.

Cookies, tracking and third parties

The app sets no cookies on the site and uses no analytics, advertising or tracking services. Data is shared only with Wix and Cloudflare, as described above. The app fetches the calendar links the site owner adds, from the services that host them.

Your rights

Guests should contact the site owner about their booking data. For questions about this policy, or to exercise rights under the GDPR, contact support@kayabyte.dev.

Changes

We will update this page if the app’s data handling changes. The date at the top shows the latest version.