Privacy Policy

GScoreARS LLC ("GScoreARS," "we," "us," or "our") is a guest reputation intelligence platform headquartered in Orlando, Florida. We operate the GScoreARS platform at gscorears.com and related web applications.

Joint Controller Arrangement: For data submitted about you by a member property (hotel or hospitality business), both GScoreARS and the submitting property operate as independent data controllers, each determining the purpose and means of processing for their own use of that data. This arrangement is governed by our Business Member Agreement. You may direct data subject requests to either controller.

For GDPR purposes, GScoreARS LLC is the primary point of contact for data subject requests. Contact: privacy@gscorears.com

We collect the following categories of personal data:

• Account Information: Name, email address, nationality, and account credentials you provide during registration.
• Third-Party Submitted Data (GDPR Article 14): Behavioral reports submitted about you by member hotels — including stay history, incident records, positive recognition notes, and dispute outcomes. See Section 5 for your notification rights regarding this data.
• Dispute & Verification Records: Correspondence, evidence, and outcomes from formal disputes you file.
• Usage Data: Pages visited, features accessed, and timestamps of platform activity collected to improve the service.
• Device & Network Data: Browser type, IP address, and device identifiers used solely for security and fraud prevention.

• To calculate and maintain your GScore reputation profile across the network.
• To provide member properties with guest intelligence at check-in (score, tier, relevant behavioral notes).
• To process dispute submissions and communicate outcomes within committed timeframes.
• To send required notices: policy changes, dispute updates, and data-collection notifications.
• To detect, prevent, and investigate fraud and unauthorized access to the platform.
• To comply with legal obligations under applicable law.

We do not use your data for advertising, behavioral tracking for third-party marketing, or any purpose beyond operating and improving the GScoreARS platform.

For users in the European Economic Area (EEA) and United Kingdom, we process personal data under the following legal bases:

• Contractual Necessity (Art. 6(1)(b)): Processing required to deliver the services you registered for, including profile creation, score calculation, and dispute handling.
• Legitimate Interests (Art. 6(1)(f)): Fraud prevention, platform security, and network integrity — where our interests do not override your fundamental rights.
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable law, court orders, or regulatory requirements.
• Consent (Art. 6(1)(a)): Where you have specifically opted in (e.g., optional communications). You may withdraw consent at any time without affecting the lawfulness of prior processing.

When a member hotel submits a behavioral report about you, that constitutes collection of personal data about you from a third party. GDPR Article 14 requires that you be informed of this practice. GScoreARS satisfies this obligation through upfront disclosure at registration — by accepting the Personal Member Agreement, you receive full advance notice that member hotels may submit reports about your stays at any time. No separate per-report notification is sent; the disclosure is made once, in full, before any report can exist.

Specifically, the Personal Member Agreement (Section 5.1) discloses: (a) the categories of businesses that may submit reports (registered GScoreARS member hotels and hospitality businesses); (b) the types of data they may submit (stay dates, behavioral notes, incident records, positive recognition); (c) that reports will affect your GScore and tier; and (d) your right to access and dispute any report through your member account.

You may view all reports associated with your profile at any time by logging into your GScoreARS account. GScoreARS does not send automatic email notifications for individual report events.

We do not sell your personal data. We share data only as follows:

• Member Properties: Hotels and hospitality businesses in the GScoreARS network access your score, tier, and relevant profile data for guest-intelligence purposes at check-in. This is the core function of the platform you consented to when registering.
• Infrastructure Providers: Supabase (database and authentication) and hosting providers process data solely as processors on our behalf, under data processing agreements consistent with GDPR Article 28.
• Google (Font Loading): This website loads fonts from Google Fonts (fonts.googleapis.com). When your browser fetches these fonts, your IP address is transmitted to Google's servers. This is a third-party data transfer. Google's privacy policy applies to that interaction. We are evaluating migrating to self-hosted fonts to eliminate this transfer.
• Legal Authorities: We disclose data when required by law, valid court order, or to protect the legal rights of GScoreARS, our members, or the public.

You have the following rights regarding your personal data. To exercise any of them, email privacy@gscorears.com:

• Access (Art. 15): Request a copy of all personal data we hold about you.
• Rectification (Art. 16): Correct inaccurate or incomplete data.
• Erasure (Art. 17): Request deletion of your data, subject to legal retention obligations.
• Portability (Art. 20): Receive your data in a machine-readable format.
• Objection (Art. 21): Object to processing based on legitimate interests.
• Restriction (Art. 18): Request that we limit processing while a dispute or objection is resolved.
• Withdraw Consent: Where processing is consent-based, withdraw at any time without penalty.
• Lodge a Complaint: You have the right to file a complaint with your national data protection authority (EEA) or the ICO (UK) at any time.

We will respond to all data subject requests within 30 days. Complex or high-volume requests may be extended by an additional 60 days with notice.

We retain personal data for as long as your account is active or as required by applicable law. Specific retention periods:

• Active accounts: Data retained for the duration of membership.
• After account deletion: Personal identifiers removed within 30 days. Anonymized behavioral statistics may be retained for platform integrity.
• Dispute records: Retained for 3 years from resolution date to support appeals and compliance.
• Legal hold: Data subject to a legal proceeding or regulatory inquiry may be retained beyond standard periods until the matter is resolved.

The GScoreARS web application does not use advertising or tracking cookies. Platform functionality relies on browser localStorage and sessionStorage — client-side storage that remains on your device and is not transmitted to third parties. This storage is used to maintain your session state, remember tab selections, and preserve form progress.

You may clear localStorage at any time through your browser settings (Settings → Privacy/Site Data → Clear site data). Clearing this data will log you out and reset any in-progress form data.

Third-party data transfer via Google Fonts: As noted in Section 6, loading this website causes your browser to contact Google's servers to retrieve fonts. This is the only third-party data transfer initiated by standard page loads. No advertising pixels, social tracking scripts, or analytics SDKs are loaded on this platform.

GScoreARS implements the following security measures to protect your data:

• Encrypted data transmission (HTTPS/TLS) on all platform connections.
• Role-based access controls limiting internal data access to authorized personnel only.
• Database-level security rules enforced at the infrastructure layer.
• Regular security reviews of third-party integrations and dependencies.

No system is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify affected individuals and relevant supervisory authorities within 72 hours of discovery, as required by GDPR Article 33/34.

GScoreARS is operated from the United States. If you access the platform from the EEA, UK, or other jurisdictions with data transfer restrictions, your data may be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the legal mechanism for such transfers.

The GScoreARS platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor's data has been submitted to the platform, contact us immediately at privacy@gscorears.com and we will delete it promptly.

We may update this Privacy Policy to reflect changes in our practices, legal obligations, or platform features. Material changes will be communicated via email and a visible notice on the platform at least 30 days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

For all privacy inquiries, data subject requests, or concerns:
privacy@gscorears.com
GScoreARS LLC · Orlando, Florida · United States

If you are located in the EU/EEA and believe your rights have not been respected, you may file a complaint with your local supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.