Privacy policy
This policy explains how Hotelwize S.A. collects and uses personal data when you visit www.sesamecreate.com, ask us for a website or for an invitation to SESAME, or use the SESAME app at app.sesamecreate.com.
1. Who we are
SESAME is a service of Hotelwize S.A., which is the controller of the personal data described here.
Hotelwize S.A.Alexandras Av. 213B, 115 23 Athens, Greece
General Commercial Registry (GEMI) 158817201000 · VAT EL801542544
For anything about your personal data, write to our data protection contact at [email protected].
2. The short version
- The website sets Google Analytics cookies only if you accept them in the cookie bar, and works the same if you refuse. Neither the website nor the app uses advertising cookies, and the app uses no analytics at all.
- We do not sell personal data, and we do not use your content to train AI models.
- SESAME runs on Microsoft Azure in the EU (West Europe). A few providers we rely on are in the United States; section 7 explains the safeguards.
- You can ask us for a copy of your data, to correct it or to delete it at any time.
3. What we collect and why
When you visit the website
Like any web server, ours receives your IP address, your browser's user agent, the page you asked for and the time. We use this to deliver the site, keep it secure and investigate errors. Your IP address is also used, in memory only, to limit how many requests can be sent from one address in ten minutes. The website loads its typefaces from Google Fonts, so your browser also sends your IP address to Google when a page loads.
Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
Analytics on the website
The website uses Google Analytics to understand how it is used. When a page opens, the cookie bar asks for your choice, and Google Analytics starts with its storage switched off (Google Consent Mode). Until you accept, and if you refuse, no analytics cookies are set; Google may still receive basic signals without cookies, such as that a page was viewed, from which it estimates overall traffic. Advertising features stay switched off whatever you choose.
If you accept, Google Analytics sets cookies and sends Google information about your visit: the pages you view and how you arrived, your device and browser, your approximate location derived from your IP address, and what you do on the page, such as scrolling or following a link. We use this only in aggregate, to see how the site is used and to improve it. Your choice is kept in your browser for 12 months, and you can change it at any time with Cookie settings at the bottom of every page.
Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of Greek Law 3471/2006), which you can withdraw at any time.
When you ask for a website
The request form on the contact page asks for your property's name, its website, your name, your email and, if you want us to call, a phone number. If you came from a copywriter or a theme on the website, the form also carries that choice. The website emails your request to our sales team and does not keep it in a database. We use it to contact you, confirm the details and build your free demo.
Legal basis: steps you ask us to take before entering into a contract (Article 6(1)(b)), and our legitimate interest in answering enquiries (Article 6(1)(f)).
When you ask for an invitation
The request form asks for your name, your hotel's name, your work email, your current website (optional), how many properties you run, and an optional note. The website emails your request to the SESAME team and does not keep it in a database. We use it to review your request, reply to you and send your invitation.
Legal basis: steps you ask us to take before entering into a contract (Article 6(1)(b)), and our legitimate interest in answering enquiries (Article 6(1)(f)).
When you use the SESAME app
You sign in to the app with your Hotelwize account. From that sign-in we receive your name, email address, Hotelwize user id, the Hotelwize tenant (the company or agency) you belong to, and your roles. Your Hotelwize access token is kept in an encrypted session cookie, so that SESAME can act in Hotelwize Builder as you and with your permissions. Your Hotelwize account itself is covered by the Hotelwize privacy policy.
For each website you make, the app keeps a project record: the property's website address and the choices you made (voice, theme, languages, booking engine and hotel code), the facts read from the property's homepage, the build's progress and report, the Hotelwize site that was created, who owns the project and who it is shared with, each review approval with who gave it and when, and each publish.
Legal basis: performing our contract with you or the organisation you work for (Article 6(1)(b)).
Your Anthropic API key
SESAME builds run on your own Anthropic API key, which you add on your profile page. We check it with Anthropic before saving it, keep it encrypted in Azure Key Vault, and only ever show its last characters again. It is used only for your own builds and for the check that a website is a place to stay. When a build runs, your Hotelwize access token is also held for it, encrypted, and deleted as soon as the build finishes. You can remove your key from your profile at any time, and it is deleted when you do.
Your company's tenant admin can also add one Anthropic API key, and one OpenAI API key, for your whole team, or the SESAME team can add them for your company when you ask. A team key is checked, kept and shown in the same way, with the name and email of whoever added it. It is used for the work of everyone in your tenant who has no key of their own, and only for that. Your own key, when you have one, always comes first. Your tenant admin can remove a team key at any time, and it is deleted when they do.
Legal basis: performing our contract with you (Article 6(1)(b)).
People you invite to a project
When you share a project by email, we store the address and the role you gave it, and send that person an invitation email on your behalf. Replies go to you. Please invite only people who expect to hear from you about the project.
Legal basis: our and your legitimate interest in working on a website together (Article 6(1)(f)).
Information about the property
To build a site, SESAME gathers what is already public or already yours about the property: the content and photographs of its current website, its Booking.com listing, its WebHotelier record, its address and the places near it (from Google Maps), and its legal details such as the company name, tax id and tourism licence number. This can include personal data, for example an owner's or a staff member's name, a business phone number or email address, or people who appear in photographs. We use it only to build and publish the website you asked for, following your instructions, and it appears on that site only after a person has reviewed and approved it.
Legal basis: performing our contract with you (Article 6(1)(b)), and our and the property's legitimate interest in presenting the business accurately (Article 6(1)(f)). You confirm that you are allowed to have SESAME use this material (see our Terms of use).
When you contact us
If you email us, we keep the correspondence so that we can help you and keep a record of what was agreed.
Legal basis: our legitimate interest in supporting our customers (Article 6(1)(f)).
4. How SESAME uses AI
SESAME writes a site with Claude, a family of AI models from Anthropic. During a build, the property information described above, together with SESAME's instructions, is sent to Anthropic through its API. Because the build runs on your own API key, Anthropic also processes it under your own agreement with Anthropic. When the SESAME team builds a site for you instead, it uses Hotelwize's Anthropic account. Under Anthropic's commercial terms, content sent through its API is not used to train its models, and we do not use your content to train any model either.
AI output can be wrong. That is why every block of copy has to be approved by a person before a site can be published to Production. No decision with legal or similarly significant effects on you is made by automated means.
5. Cookies
The app uses only cookies that are strictly necessary for it to work. The website uses strictly necessary cookies too, and Google Analytics cookies only if you accept them. There are no advertising or social media cookies. Change your choice at any time with Cookie settings at the bottom of every page of the website.
| Where | Cookie | What it does | How long |
|---|---|---|---|
| Website | Form protection | Protects the request and invitation forms against cross-site request forgery | Browser session |
| Website | Confirmation | Carries your name and email to the confirmation page after you send a request | Removed once read |
| Website | Your cookie choice (sesame.consent, kept in your browser's local storage) | Remembers whether you accepted or refused, so we do not ask on every page | 12 months |
| Website, only if you accept | Google Analytics (_ga, _ga_*) | Tells visits apart and measures how the site is used | Up to 2 years |
| App | Session | Keeps you signed in and holds your encrypted Hotelwize access token | Until you sign out or the session ends |
| App | Sign-in | Links the sign-in request to its answer from Hotelwize | A few minutes |
| App | sesame.af | Protects the app against cross-site request forgery | Browser session |
The home page shows sites built with SESAME in frames. Those sites are served by Hotelwize Builder and follow their own cookie settings.
6. Who receives your data
We share personal data only as far as each purpose needs, and only with:
- Microsoft (Azure): hosting, databases, storage and key management, in the EU (West Europe).
- Twilio SendGrid: sending website and invitation requests to our team, and project invitations to the people you invite.
- Anthropic: the Claude models that write the site, as described in section 4.
- Google: the website's typefaces (Google Fonts), and, if you accept, Google Analytics on the website, and the address and nearby places of a property (Google Maps Platform).
- Hotelwize Builder, our own platform, where the site SESAME builds is created and hosted.
- People in your organisation, according to how a project is shared: its owner, your tenant's administrators, and the people it is made visible to or shared with.
- The SESAME team at Hotelwize, to support you and to build sites when a build cannot run on your key.
- Authorities, when the law requires it.
Our providers act on our instructions under data processing agreements.
7. Transfers outside the EU
Twilio SendGrid, Anthropic and Google may process data in the United States. Where a provider is certified under the EU-US Data Privacy Framework we rely on that; otherwise, or in addition, we rely on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.
8. How long we keep it
| Data | Kept |
|---|---|
| Server and application logs | Up to 90 days |
| Website analytics in Google Analytics, if you accept | 14 months |
| Website requests | 30 days after your request |
| Invitation requests | Until we invite you; if we do not, deleted 12 months after your request |
| Projects | Until the project is deleted by its owner, a tenant administrator or the SESAME team, or 30 days after your organisation stops using SESAME |
| A build's working files (the gathered sources, photos and logs) | Up to 12 months after the build, so that we can support you and investigate problems |
| Your Hotelwize access token, as held for a build | Deleted when the build finishes |
| Your Anthropic API key | Until you remove it, or your access to SESAME ends |
| Your team's API keys | Until your tenant admin removes them, or your company's access to SESAME ends |
| Invited people's email addresses | Until they are removed from the project, or the project is deleted |
| Correspondence with us | Up to 5 years, or longer where the law requires it |
Deleting a project deletes SESAME's record of it. The website it made lives in Hotelwize Builder and stays there until it is removed there.
9. Security
Everything travels over HTTPS. Secrets such as your Anthropic API key live in Azure Key Vault, access tokens are encrypted, our services reach each other with managed identities rather than shared passwords, and every action in the app is checked on the server against your role in the project. No system is perfectly secure, and if a breach puts your data at risk we will tell you and the authorities as the law requires.
10. Your rights
Under the GDPR you can ask us to:
- give you access to your personal data and a copy of it;
- correct data that is wrong or incomplete;
- delete your data;
- restrict how we use it;
- give you the data you provided in a portable format;
- stop using it where we rely on legitimate interests (you can object at any time).
Write to [email protected]. We answer within one month, and may ask you to confirm who you are first. If you think we have not handled your data properly, you can complain to the Hellenic Data Protection Authority, Kifisias Av. 1-3, 115 23 Athens, www.dpa.gr, or to the authority where you live or work.
11. Children
SESAME is a service for businesses and is not meant for anyone under 18. We do not knowingly collect children's personal data.
12. Changes to this policy
When we change this policy we update the date at the top. If a change matters to how we use your data, we will also tell you in the app or by email before it takes effect.