Skip to content

Legal documents

Privacy Policy

Last updated:

Zillion Technology Solutions S.L.U. ("Zillion", "we", "us", or "our") is committed to protecting the privacy of hotel guests, platform users, and all individuals whose data we process. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under applicable law.

Data Controller: Zillion Technology Solutions S.L.U. · CIF B24801383 · Son Puig 8

Privacy contact: privacy@1zill.com

This policy applies to:

  • Hotel guests who interact with a Zillion-powered concierge (via WhatsApp, web widget, or other channels)
  • Hotel staff and operators who use the Zillion platform
  • Visitors to our website at 1zill.com

When a guest contacts a hotel through our concierge service, we may process:

  • Phone number (WhatsApp ID)
  • Display name (as provided by WhatsApp)
  • Message content (text, images, audio)
  • Conversation history and timestamps
  • Language preference
  • Support ticket details and resolution status
  • Name, email address, and job title
  • Login credentials (hashed passwords)
  • Usage logs and activity within the platform
  • IP address and browser/device information
  • IP address and approximate geolocation
  • Pages visited and time spent
  • Browser type and operating system
  • Referral source

We use personal data for the following purposes:

Legal document table
PurposeLegal Basis (GDPR Art. 6)
Delivering concierge and messaging services to hotel guestsLegitimate interests (Art. 6(1)(f)) / Contract performance
Processing guest support requests and ticketsLegitimate interests
Providing the hotel management platform to operatorsContract performance (Art. 6(1)(b))
Improving service quality and AI response accuracyLegitimate interests
Security, fraud prevention, and abuse detectionLegitimate interests / Legal obligation
Sending product updates to registered usersConsent (Art. 6(1)(a)) or Legitimate interests
Complying with legal obligationsLegal obligation (Art. 6(1)(c))

We do not sell personal data to third parties. We do not use guest message content for advertising purposes.

Our concierge service uses the WhatsApp Business Platform (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) to deliver messages on behalf of hotels.

  • Messages sent via WhatsApp are processed by Meta under their own WhatsApp Business Terms of Service
  • Zillion acts as a data processor on behalf of the hotel (data controller) for guest messages
  • Message content is stored in our systems only as long as necessary to provide the service
  • We do not use WhatsApp conversations for advertising or profiling

Our platform may use artificial intelligence to generate suggested or automated responses to guest messages. When AI processing is used:

  • Message content is sent to an AI language model provider (such as Anthropic or OpenAI) via encrypted API calls
  • AI providers process data only for inference and do not retain conversation data for model training under our enterprise agreements
  • Hotels can disable AI-assisted responses at any time from their dashboard

We retain personal data for as long as necessary:

  • Guest conversations: 24 months from the last interaction, or as directed by the hotel
  • Support tickets: 36 months from resolution
  • Platform user accounts: Duration of the contract + 12 months
  • Website logs: 90 days

Data may be retained longer where required by law (e.g., tax records: 7 years under Spanish law).

Zillion is based in Spain (EU). Some service providers (including AI processing and cloud infrastructure) may be located outside the EU/EEA. In such cases, we rely on:

  • EU Standard Contractual Clauses (SCCs)
  • Adequacy decisions by the European Commission

If you are located in the EU/EEA, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate or incomplete data
  • Erase your data ("right to be forgotten") where applicable
  • Restrict processing in certain circumstances
  • Object to processing based on legitimate interests
  • Data portability (receive your data in a structured format)
  • Withdraw consent at any time (where processing is consent-based)
  • Lodge a complaint with the Spanish Data Protection Authority (AEPD): aepd.es

To exercise any of these rights, contact us at privacy@1zill.com. We will respond within 30 days.

Our website uses cookies for analytics and functionality. See our Cookie Policy for details.

We implement industry-standard technical and organisational measures to protect personal data, including:

  • Encryption in transit (TLS 1.3) and at rest
  • Role-based access controls
  • Regular security reviews
  • Data minimisation practices

When an authorized hotel operator connects Google Ads to Zillion through Google's consent screen, Zillion receives the Google account email address used to identify the connection, identifiers and metadata for Google Ads customer accounts accessible to that user, and the campaign, ad group, keyword and Hotel Ads data needed for the hotel's reports. Imported performance data can include impressions, clicks, advertising cost, conversions and conversion value. Zillion stores an encrypted OAuth authorization credential so it can refresh these reports while the connection is configured. A Google user must authorize the connection and have access to the relevant Ads account.

Zillion uses the imported data to provide the hotel's advertising dashboards and reports, combine campaign results with the hotel's other analytics, and let authorized users of that hotel's Zillion workspace assess performance. Access is limited to authorized hotel users and the hosting or support providers that process data on Zillion's behalf under contract. Zillion does not sell the imported Google Ads data or use it to advertise Zillion. If the hotel separately enables Customer Match, Zillion may send normalized, SHA-256-hashed customer identifiers and consent signals to Google Ads on the hotel's behalf to manage that hotel's audiences; this is separate from downloading reports and depends on the hotel's authorization and the applicable Google requirements.

Disconnecting Google Ads stops scheduled imports, and the Google user can also revoke Zillion's authorization in their Google Account settings. Historical reports may remain in the hotel's workspace after disconnection for its own analysis. To request deletion of the connection credentials or imported reports, contact privacy@1zill.com. Zillion retains these data for as long as needed to provide the subscribed service, handle a deletion request, or meet contractual or legal obligations, as described in this policy and the customer agreement.

We may update this policy periodically. Material changes will be communicated via email or a notice on our website. The current version is always available at 1zill.com/legal/privacy.

For privacy-related questions, requests, or complaints:

Zillion Technology Solutions S.L.U. Son Puig 8

Email: privacy@1zill.com

Back to top