Maki Beds — Privacy Policy

Effective: 1 November 2026 for all accounts and visitors.

1. Who we are

Asvara Labs LLC, a Wyoming limited liability company, 1021 E Lincolnway #9580, Cheyenne, WY 82001, United States ("Asvara", "we"), makes Maki Beds, a property management system for lodging businesses. Contact for privacy: [email protected].

2. What this policy covers — and what it doesn't

• Covered (Asvara is the controller):
  • people who create or use a Maki Beds account on behalf of a business (owners, managers, staff);
  • business contacts;
  • visitors to makibeds.com and app.makibeds.com.
• Not covered: guest data. When a lodging business uses Maki Beds to manage its guests (bookings, messages with Karly, payments, and identity documents the business records at check-in), that business is the controller of its guests' data and Asvara processes it on the business's behalf under our Data Processing Addendum. Guests should read the privacy notice of the property they booked with. We help properties answer guest requests.
• Asvara's other products have their own notices; for example Maki Trips at makitrips.com.

3. Data we collect and why

We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use customer or guest data to train AI models.

4. Who we share it with

• Service providers that process data for us under contract. The current list, with purpose and location, is in our subprocessor list: hosting, database, email, error monitoring, authentication, payments, messaging, AI model providers and the channel manager.
• Integrations you turn on (WhatsApp, Stripe, Mercado Pago, and — once available — our channel-manager provider Channex.io and its OTAs) receive what they need to work, under their own terms.
• AI assistants the owner connects (OpenAI's ChatGPT, Anthropic's Claude): see §4A.
• Legal and safety: to comply with law, enforce our Terms, or protect rights and safety.
• Business transfers: a buyer or successor, under this policy.

4A. AI assistant connectors (ChatGPT and Claude)

Maki Beds offers a connector, a Model Context Protocol server at mcp.makibeds.com, that lets the owner of a property connect an AI assistant they already use and ask it about their property.

• Off unless the owner turns it on. The connector is off for every property by default. Only the account owner can turn it on for the property, connect an assistant with their own Maki Beds sign-in, and choose what that assistant may read. It requires a paid plan that includes the connector. Other team members cannot use it.
• Who receives the data. When the owner connects an assistant and asks it something, we send the data needed for the answer to that assistant's provider: OpenAI for ChatGPT and Anthropic for Claude. They receive it because the owner chose to connect them, and they may process it outside the United States. What the provider does with the data after we deliver it is governed by the provider's own terms and privacy policy and by the owner's settings with that provider, not by this policy.
• What we send, only within what the owner allowed and the plan includes:
  • booking references (the 8-character code printed in the guest's confirmation email), unit names and rate plan names;
  • stay dates and nights, number of guests and pets, booking status and sales channel;
  • amounts with their currency: totals, amounts paid, balances, quoted prices, taxes, fees, discounts and deposits;
  • for payments, the date, type, method class (for example «card» or «transfer») and status, never card or payment-provider details;
  • occupancy, revenue and booking-pace figures, and counts (arrivals, departures, open maintenance tickets, guest reports, conversations waiting for a reply);
  • titles of maintenance tickets written by the owner or staff, and the recommendations Maki Beds already prepared for the property. Text written by the owner or staff is sent after automatic masking of email addresses and phone-like numbers; that masking is not a guarantee, so the owner should keep guest details out of it.
• What we do not send: guest names, guest email addresses, phone numbers and postal addresses, identity documents, payment card data, the content of messages between the property and its guests, guest notes and the text of guest reports. When the owner searches a booking by part of a guest's name, we use the name the owner typed only to find the booking; the answer carries no name.
• What we receive from the assistant: the inputs a request needs (dates, a booking reference, a unit, or the part of a guest's name the owner typed). We do not receive the owner's conversation with the assistant.
• Turning it off and revoking. The owner can switch the connector off for the property: every connected assistant is refused from its next request. The owner can also revoke one connection: it is refused from its next request, and using it again needs a new connection. The owner can also remove the connector inside the assistant. Switching off or revoking stops future deliveries; it does not recall data the provider already received.
• What we keep. We do not store the assistant's access tokens, the owner's prompts or the content of our answers. For each request we keep an audit record: the user, the connection and the assistant's client identifier; the tool; the inputs, with a guest-name search stored only as its length; the outcome and its size; the internal identifiers of the bookings included; the time and duration; a correlation id; the protocol version; and the assistant's user-agent. We also keep daily usage totals per property, and a record of each connection (assistant, what it may read, created, last used, revoked). We keep these records until the owner asks us to delete them.

5. Retention

• Account and business data: we do not delete it automatically when an account ends; we keep it until the account owner asks us to delete it at [email protected]. Deleted data can remain for a short time in our database provider's point-in-time recovery history before it is gone.
• Invoices and tax records: for the period tax law requires, also after a deletion request.
• Optional attribution: in your browser for 90 days; if you sign up, kept with your business account until the owner asks us to delete it.
• Error reports: for the retention period of our error-monitoring provider's plan.
• AI providers: keep inputs and outputs for up to 30 days for abuse monitoring, longer only if flagged, per their terms.
• AI assistant connector (§4A): request audit records, daily usage totals and connection records are kept until the owner asks us to delete them. What ChatGPT or Claude keep after delivery is set by OpenAI's or Anthropic's terms and the owner's settings with them.

6. Cookies and similar storage

We use as few as we need. You choose in the banner: «Essential only» or «Accept all». To change your choice later, clear the cookies for makibeds.com in your browser and the banner asks again. If we add a new optional purpose, we ask again.

We don't use advertising cookies or third-party ad pixels on makibeds.com.

7. Your rights

• Everyone: you can access, correct, export or delete your account data by writing to [email protected]. We answer within 45 days.
• California and other US states with privacy laws (e.g. VA, CO, CT, TX, OR): rights to know, access, correct, delete, port, and opt out of sale, sharing, targeted advertising and profiling. We don't sell, share or profile, as stated in §3. You can appeal a refusal by replying to our answer. We won't discriminate against you for using your rights. Authorized agents may act for you with proof.
• Mexico (secondary): under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (2025) you have ARCO rights (access, rectification, cancellation, opposition) and may revoke consent. Write to the address above; the authority is the Secretaría Anticorrupción y Buen Gobierno. A Spanish aviso de privacidad integral with the six required elements (Art. 15) is published at makibeds.com/es/privacidad.
• Guests of a property: contact the property. If you write to us, we forward your request to it.

8. Security

• Data is encrypted in transit.
• Access is role-based.
• Payment card data is handled by Stripe.
• Credentials for connected services are stored encrypted.
• We review access and keep audit logs of Karly's actions.
• Our database (Neon) and file storage (Cloudflare R2) encrypt data at rest by the provider's default.
• Files you or your guests upload are stored only in Cloudflare R2, never on our application servers. Those servers hold only the running application and its logs.

If a breach affects your data, we notify you and the authorities as the law requires.

9. International transfers

We are a US company, and the Service's data is stored in the United States:

• application servers at Hetzner in Ashburn, Virginia;
• the database at Neon on AWS us-east-1 (Northern Virginia);
• files at Cloudflare R2 in Western North America.

Some providers operate globally and may process data in other countries to deliver their service: Cloudflare's network edge, Stripe, Meta/WhatsApp, the AI model providers, Sentry and Resend (see our subprocessor list). Where the law requires safeguards for a transfer, we use contractual protections.

10. Children

Maki Beds is a business tool for people 18 and older. It is not directed to children, and we don't knowingly collect personal information from children under 13 (or under 16 where the law sets that age). If we learn we have, we delete it. Guest records a property enters may mention minors in a booking; the property controls that data under the DPA.

11. Changes

We date every version and keep a change log. We tell account holders by email and in the app before a material change takes effect.

What changed (change log)