Privacy, without theatre

Your hotel is the controller of the registration record the law requires it to keep; Arrivo processes that record on the hotel's instruction and for no other purpose. Passport chip data, the live capture used to match it and the resulting biometric template are read and compared on your own phone and are never transmitted to Arrivo or to the hotel—only the outcome of the check travels, together with the document class and the policy version it was judged under. A hotel receives the fields disclosed for one specific stay and nothing carried over from another. Optional preferences are yours to withdraw at any time, and withdrawing them removes them from the stay. Legally required registration and financial records are kept for the period the hotel's approved retention schedule sets, after which they are deleted rather than archived. Arrivo runs in the European Union and does not sell, rent or profile guest data, and no automated decision about you is made without a person able to review it.

Draft status · pending legal review

This is an interim notice written for a closed pilot with synthetic and consenting participants. It states current practice honestly, but it is not the final legal instrument: the approved controller/processor notice, the subprocessor register, the lawful-basis map and the named-property retention schedule are still in external legal review. Completing that review is a launch gate—real identity or payment features cannot be enabled for members of the public until the approved text replaces this page.