Privacy notice · 2026-09-26-v5

One service. Two clear data roles.

Last updated 26 September 2026

Operator and contact

AnotherPillow is operated by World Wide Wood AB, Swedish organisation number 556925-3015, Igeldammsgatan 18, 112 49 Stockholm, Sweden. Email privacy and personal-data requests to filip@claridad.io. World Wide Wood AB has not appointed a data protection officer.

When World Wide Wood AB is the controller

World Wide Wood AB is the controller for AnotherPillow website enquiries, feedback, hotel-account identity, service orders, security and audit records, aggregate product measurement, support communication and AnotherPillow billing. We use the information to provide requested setup and account access, answer requests, prevent abuse, administer the business relationship and meet legal obligations.

When the hotel is the controller

For a live booking, the named hotel decides why guest information is used: to provide accommodation, take payment, communicate with the guest and meet its legal duties. The hotel is the controller for that guest data. World Wide Wood AB acts as the hotel’s processor only under written data-processing terms and documented instructions. World Wide Wood AB remains a separate controller for the minimum security, service-integrity and legal records it must keep for its own purposes. The checkout must identify the hotel that is the guest’s contractual party before a real booking can be made.

Hotel accounts and setup

Creating a hotel setup stores the work email, email-verification time, stable account and hotel IDs, contact name, hotel name, room count, selected website path, submitted public web address, setup status, accepted Business Terms version and time, and later the hotel-approved city, website, booking address, currency, language, add-ons, images and facts. Control of the email address enables account verification; a separate human review verifies authority to represent the hotel. For password login we store a salted, one-way password hash, never a readable password. Single-use email links support verification and password recovery. Social login is not required.

Enquiries and feedback

We store the submitted name, email, hotel or company when supplied, message, public page path, viewport size, browser language, time and a traceable reference. Query parameters, cookies, reservation contents and payment details are not attached to feedback. Reports are stored before an email notification is attempted. Never include guest details, card data, passwords, access tokens or confidential security material.

Personal demos and business invitations

When you choose a demo time, Google Calendar collects your name, email, hotel name and website to arrange the appointment and send the Google Meet invitation. The booking page is hosted by Google and is subject to its privacy policy. We use these details to arrange the requested conversation; booking does not subscribe you to marketing.

For relevant business invitations, we may use professional contact details published by the hotel itself where applicable marketing rules permit it. We record the source, the contact’s business relevance, our sending basis and delivery status. Every invitation includes our identity and an opt-out link. Opting out immediately adds a one-way email-address hash to our marketing suppression list. We retain that minimal record while conducting outreach to avoid contacting you again, and retain supporting records only as needed to demonstrate our sending basis and honour objections. This does not stop requested account, security or booking messages.

Browser storage and measurement

With your optional consent, Google Analytics 4 measures visits and registration/contact-link clicks on our public marketing website. The tag is not loaded before consent and never runs in sign-in, registration, setup previews, hotel workspaces or guest booking pages. We send reviewed public page paths, approved campaign labels and a restricted referrer, never form contents, hotel identities, account details, booking data or private tokens. Google processes network and browser information and pseudonymous cookie identifiers to produce usage reports. Google advertising signals, personalised advertising and automatic form or outbound-link measurement are disabled. No advertising pixel is installed.

Choose Only necessary to keep analytics off, or use Cookie settings in the public-site footer to withdraw consent. Withdrawal stops further collection in this browser and deletes the analytics cookies, but does not erase previously collected reports. The consent choice and analytics cookies expire within 180 days. Read the cookie and browser-storage notice and Google’s privacy policy.

A separate daily setup-start counter contains no email, account ID, cookie, IP address or browser fingerprint. If a hotel submits a registration URL containing approved UTM labels, we may save those labels, the current public signup path and an external referrer hostname with that registration. This operational registration record is not sent to Google Analytics.

Necessary browser storage includes a secure sign-in cookie: password sessions last up to 12 hours, or 30 days when Keep me signed in is selected; email-verification sessions last up to seven days. A separate password-recovery cookie expires after 15 minutes and cannot access hotel data. Resetting a password revokes existing sessions. Abuse protection stores temporary hashed account and network rate-limit keys, not passwords. Setup uses a tab-scoped random attempt and one-way fingerprint to prevent duplicate account creation. Inside an authorised workspace, the current Hotel AI conversation remains only in the browser tab. When Cloudflare Turnstile is enabled, it receives a challenge token, expected hostname and security telemetry, but AnotherPillow does not send your email or password to that check. See the cookie and browser-storage notice.

When you submit hotel setup, the preparation page temporarily holds your submitted website, email and setup choices in the same browser tab so it can finish or retry account creation. This handoff is valid for ten minutes and is cleared after success or when the tab closes.

Legal bases

We use contract or steps requested before a contract for account creation, setup, support and ordered services; legal obligation for records the law requires; and legitimate interests for proportionate service security, fraud prevention, audit history, product operation and responding to business enquiries. Where we rely on legitimate interests, we limit the data and balance those interests against the individual’s rights. Optional direct marketing must include a simple objection route and stops for that person after an objection. Consent is used only where the relevant function specifically requires it and can be withdrawn without affecting earlier lawful processing.

Required information

The fields marked required in setup, sign-in, enquiry or booking are needed to provide that function or take the requested pre-contract step. Without them, we cannot create the account, reply or complete the booking. Optional fields may be left blank.

Public Aster House sandbox

Aster House is fictional and not a live hotel. Its public booking flow accepts only server-assigned example identities and stores sandbox dates, guests, room and rate IDs, total, reservation identity, status and simulated payment and prepared-email status. It must never be used for a real guest, card or accommodation contract. Sandbox records are development data and may be removed periodically.

Live payments and messages

The public sandbox does not collect real card details, move money or send a guest email. For production, raw payment credentials must go directly to the hotel’s approved payment provider through hosted components; AnotherPillow stores only the provider references and statuses needed for the reservation. Guest message content may enter a durable delivery queue and is removed after successful delivery, expiry or terminal failure while limited delivery metadata remains for support and audit.

Hotel AI

Hotel AI is disabled until the hotel activates it and the selected provider is approved. When active, an authorised user’s question, approved hotel facts and limited operational totals may be sent to that provider. AnotherPillow does not put conversation text in the booking database; the current conversation remains in the browser tab. We retain limited usage and security metadata such as hotel and account IDs, model, provider request references, token counts, estimated cost, status and time. Do not enter card data, passwords or unnecessary guest personal data. Hotel AI does not make solely automated decisions with legal or similarly significant effects.

Recipients, subprocessors and transfers

Authorised World Wide Wood AB personnel and contracted infrastructure providers receive only the data needed for their role. The application and database run on World Wide Wood AB’s DigitalOcean server. Cloudflare Turnstile is an optional login-abuse check when configured. Google Ireland Limited provides optional website analytics under its processing terms; information may be processed outside the EEA subject to applicable transfer safeguards. Public enquiry and feedback notifications use the configured email provider after the message has been saved in AnotherPillow. Live booking email, payment, AI and hotel-system providers are not treated as active merely because they appear in a demo. A current subprocessor schedule, purpose, location and transfer safeguard must be attached to the hotel’s data-processing agreement before real guest processing. Where information leaves the EEA, an adequacy decision or another lawful safeguard such as the European Commission’s standard contractual clauses must apply. See the data protection framework.

Retention

Hotel account and service data is kept while the account or agreement is active. An unsuccessful setup or enquiry is reviewed for deletion after 24 months. Authentication links expire after 15 minutes. Sign-in sessions expire within the 12-hour, seven-day or optional 30-day limits described above. Contract, security and audit records are retained only for the period needed to establish, exercise or defend claims. Accounting material is retained for the period required by Swedish law. Hotel guest retention is set by the hotel in the production data-processing schedule; termination requires return or deletion subject to documented backup and legal-retention exceptions.

Your rights

Depending on the processing, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests or to direct marketing. You may withdraw consent where consent is the basis. For a hotel booking, contact the hotel first; AnotherPillow assists the hotel under the data-processing agreement. We may need to verify identity before acting. You may complain to the Swedish Authority for Privacy Protection, IMY, or another competent data protection authority.

No production guest data yet

No real hotel may activate guest processing until the hotel-specific legal evidence gate is verified: contractual party and company details, guest booking terms, total-price and cancellation presentation, privacy roles, signed data-processing terms, subprocessor schedule, retention and deletion instructions, accessibility review and incident contacts. This gate is independent of payment, email and inventory certification.