Privacy policy

1. Data controller

• Las Tilapias Hotel y Restaurante
• Address: Finca La Zorrita, Km 87 ½ Carretera Troncal del Norte, San Ignacio, Chalatenango
• Email: reservaciones@lastilapiashotel.com
• Phone and WhatsApp: +503 7852-9805

2. What data we collect

• Room bookings: name, email, phone, room type, check-in and check-out dates, number of adults and of children under 10, booking language and any notes you add.
• Table bookings: name, email, phone, date, time and number of people.
• Event quotes: name, phone, email, event type, number of guests and date.
• Contact form: name, email and message.
• Payments: the amount, the payment link we send you and the receipt (image or PDF) you send us. The receipt may include the payer's name, the bank, the transaction reference and the last 4 digits of the card. We never receive or store your full card number: payment is made on the bank's platform.
• WhatsApp: your number and the messages we exchange about your booking.
• Tila assistant: the question you type, the answer, the tools Tila used to answer and whether the conversation was handed to hotel staff. Your IP is not stored: only an irreversible code (a hash with a secret salt) used to group the questions of the same visitor.
• Technical data: our hosting providers log basic data about each visit (IP address, browser, date) for security and for the site to work.

3. What we use it for

• Managing, approving and confirming your bookings.
• Sending you the payment link and checking that the payment was received.
• Sending you your booking confirmation by email (with a calendar file attached so you can add it to your calendar) and by WhatsApp.
• Answering your questions and preparing event quotes.
• Meeting our legal, accounting and tax obligations.

We don't use your data for advertising and we never sell it.

4. WhatsApp messages

We only message you on WhatsApp if you authorize it when booking or if you write to us first. Messages are about your booking (receipt, approval, payment link and confirmation). You can stop receiving them at any time by replying BAJA.

5. Use of artificial intelligence

We use artificial intelligence services through OpenRouter, which routes each request to a third-party model (for example from Google, NVIDIA, Qwen or others). Those providers may keep or use what they receive to improve their models, so we limit what we send:

• Event quotes: only the event details (type, date, number of guests and your notes). Never your name, phone or email. Our system calculates the figures and a hotel staff member reviews anything non-standard.
• Tila, the website assistant: the question you type. The conversation is stored (section 2) to handle handoffs and improve the service; please don't type sensitive personal data in the chat.
• Payment receipts: they are only analyzed with artificial intelligence if we use a provider that doesn't retain or train on the data. Otherwise a hotel staff member reviews them. In every case, the final decision is made by a hotel staff member.

6. Who we share your data with

Only with providers we need to run the service, who process the data on our behalf:

• Supabase: database and file storage.
• Vercel: website hosting.
• Resend: email delivery.
• Meta (WhatsApp): messaging.
• OpenRouter and the models it routes to: artificial intelligence for quotes, the Tila assistant and, only with no-retention providers, receipts (section 5).
• BAC: payment is processed on its platform, under its own privacy policy.

The site also shows YouTube videos and a Google Maps map, and the "Get directions" buttons open Google Maps or Waze; when they load or open, those services may collect data under their own policy. We will only hand data to authorities when the law requires it.

7. International transfers

The providers in section 6 have their servers outside El Salvador (for example, in the United States). By accepting this policy in our forms you expressly authorize that transfer, which is limited to what is needed to provide the service.

8. How long we keep it

• Bookings, payments and receipts: for the period required by El Salvador's tax and accounting laws.
• Contact messages, quotes that didn't go ahead, WhatsApp conversations and Tila conversations: up to 24 months.

After those periods, we delete them.

9. Your rights

The law grants you the rights known as ARCO-POL:

• Access: know what data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Cancellation: ask us to delete your data.
• Objection: object to a specific use.
• Portability: receive your data to take it to another controller.
• Erasure: ask for it to be removed from digital environments.
• Restriction: ask us to temporarily limit its use.

Write to us at reservaciones@lastilapiashotel.com or on WhatsApp at +503 7852-9805. We may ask for details to confirm your identity and will reply within 20 business days at most.

10. How to delete your data

• Send an email to reservaciones@lastilapiashotel.com with the subject "Eliminar mis datos" (delete my data), stating the name and the phone or email you booked with.
• We'll confirm your identity and delete your data within 20 business days at most.
• We'll keep only what the law requires us to keep (for example, accounting records of a payment), and only for the legal period.
• To stop receiving WhatsApp messages, just reply BAJA.
• The full instructions are on Delete my data.

11. Cookies

We don't use advertising or analytics cookies. The admin panel uses session cookies for hotel staff only. YouTube and Google Maps content may set their own cookies.

12. Security

The whole site runs over HTTPS, access to data is restricted to authorized staff and payment receipts are kept in private storage. If a security incident affecting your data ever occurred, we would notify you and the authorities as the law requires.

13. Minors

Bookings must be made by people over 18. We don't knowingly collect data from minors.

14. Changes to this policy

If we change this policy, we'll publish the new version on this page with its update date. If you have questions, visit our contact page. The terms of use of the site are in the terms and conditions.