Privacy Policy

1. Who we are

BlurEffect LLC is a limited liability company registered in Wyoming, United States, at 103 Capitol Ave, Suite 420A, Cheyenne, WY 82001, USA. Nido is a product of BlurEffect LLC.

For any privacy question or request, write to partners@meetnido.com.

2. Our role: controller and processor

We are the controller (in Colombia, "responsable del tratamiento") of personal data about our Customers and their staff: the people who sign up for, buy, administer or use Nido accounts, and the people who contact us or visit meetnido.com.

We are a processor (in Colombia, "encargado del tratamiento") of the personal data about hotel guests that a hotel enters into Nido or receives through it, including reservations and guest details delivered by booking channels such as online travel agencies, by the hotel's booking engine and website, and by online check-in. The hotel is the controller of that data. We process it only to provide the Service to that hotel and on its documented instructions, as set out in our Terms of Service and any data processing agreement we sign with the hotel.

If you stayed at or booked a hotel that uses Nido and want to exercise your rights over your guest data, please contact the hotel first. If you write to us, we will pass your request to the hotel and help it respond.

3. The personal data we handle

• Staff account data (controller): name, email address, phone number, role and permissions, the properties a person works at, sign-in records and the actions taken in the Service, such as check-ins, charges, refunds or approvals.
• Customer business data (controller): the hotel's legal name, tax identification, address, billing contacts and the details of our contract.
• Guest identity and contact data (processor): name, email address, phone number, nationality, date of birth, identity-document type and number, address, tax details needed for invoices, and companions travelling with the guest.
• Identity-document images and scans (processor): photos of identity documents and passports taken at the desk or sent by the guest during online check-in, and the text read from them, plus the guest's signature on the registration card. Images are marked with a watermark that limits their use to hotel registration.
• Stay and reservation data (processor): dates, rooms, rates, party size, special requests, the booking channel and its reservation code, folios, charges, payments, invoices and messages between the hotel and the guest.
• Payment data (processor): see section 4. Nido stores a payment token issued by the payment provider, the card brand, the last four digits, the cardholder name and the expiry month and year. Nido never stores full card numbers or security codes (CVV).
• Usage and technical data (controller): IP address, browser and device information, pages and features used, error reports and server logs, used to run, secure and improve the Service.
• Cookies and similar storage: see section 9.

We do not ask for special categories of personal data. Hotels may record data about minors who stay with an adult when the law requires them to register every guest; we process it only on the hotel's instructions.

4. Card payments

Card payments in Nido are processed and tokenised by the hotel's payment provider (currently Wompi or Mercado Pago). When a card is entered, at the desk or by a guest on a hotel's booking site, the card number and security code are typed into the payment provider's own secure form and go directly to the provider. The provider returns a token, and Nido stores only that token with the card brand, the last four digits, the cardholder name and the expiry month and year, so the hotel can recognise the card and charge it under its agreement with the guest.

When a booking channel sends a virtual card with a reservation, Nido removes the card number, security code and other card details before storing the reservation; only the amount, currency and the date from which the card can be charged are kept. Staff who need to keep such a card on file enter it through the payment provider's secure form.

Each hotel contracts its payment provider directly. The provider's own terms and privacy policy apply to the payment data it processes.

5. How we use personal data and our legal bases

• To provide the Service under our contract with the hotel: creating and securing accounts, running reservations, check-in and check-out, folios, payments, invoices, channel distribution, booking engines and websites. Legal basis: performance of a contract, and for guest data, the hotel's instructions.
• To read identity documents when a hotel uses document scanning or online check-in, so the registration is filled accurately. Legal basis: the hotel's instructions; the hotel relies on its own legal obligation to register guests or on the guest's authorisation.
• To issue electronic invoices to the Colombian tax authority (DIAN) when the hotel turns on e-invoicing. Legal basis: the hotel's instructions and its legal obligation.
• To send service emails, such as account invitations, password resets, booking confirmations and messages the hotel sends to its guests. Legal basis: performance of a contract and the hotel's instructions.
• To keep the Service secure and reliable: detecting abuse and fraud, investigating incidents, keeping logs and backups. Legal basis: our legitimate interest in protecting the Service, our Customers and their guests.
• To support Customers and improve the Service, using usage and technical data. Legal basis: our legitimate interest in providing and developing a useful product.
• To tell business contacts about Nido. Legal basis: our legitimate interest in B2B communication, or consent where the law requires it. You can opt out at any time.
• To meet legal obligations, such as tax and accounting rules, and to establish or defend legal claims.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use guest data for our own marketing.

6. Service providers (sub-processors)

We use the following providers to run Nido. Each one processes personal data only to provide its service to us or to the hotel.

Hotel websites built with Nido may also load analytics tools the hotel chooses, such as Google Analytics or the Meta Pixel. These load only after the visitor accepts them in the site's cookie banner, and the hotel is responsible for them.

We will update this list before we start using a new provider that processes personal data, such as a messaging provider for WhatsApp. We may also disclose personal data when the law requires it, to protect rights and safety, or as part of a merger, acquisition or sale of assets, in which case this Policy continues to apply to the data transferred.

7. International transfers

BlurEffect is based in the United States, and Nido's application, database and files are hosted by Amazon Web Services in the United States (us-east-1 region). Personal data of hotels and guests in Colombia, the rest of Latin America, the European Union and elsewhere is therefore transferred to and stored in the United States. Some providers listed above process data in other countries, such as Colombia for payments and e-invoicing.

We rely on our contracts with Customers and on the data processing terms of our providers, which include the European Commission's Standard Contractual Clauses where applicable. For transfers from Colombia, we apply the guarantees required by Ley 1581 de 2012 and the instructions of the Superintendencia de Industria y Comercio.

8. How long we keep data

• Account and Service data are kept while the hotel's subscription is active. After it ends, the hotel can export its data for 30 days; we then delete or anonymise it within 90 days, except where the law requires us to keep it longer.
• Identity-document images follow the retention the hotel sets in Nido. By default, images taken at the desk are deleted 5 years after the guest's check-out, images sent during online check-in 90 days after check-out, and uploads from an online check-in that was never completed after 7 days. A hotel may choose a different period where its local law requires it.
• Invoices and accounting records are kept for the period tax law requires.
• Server logs and security records are kept for a limited period and then deleted. Deleted data may remain in backups until they are overwritten.

9. Cookies and similar technologies

• meetnido.com sets no cookies and loads no third-party trackers or analytics.
• The Nido staff app keeps the signed-in session in the browser's local storage and uses a cookie to remember the chosen language. The sign-in pages may also set cookies to keep you signed in securely. These are strictly necessary for the app to work.
• Booking engines and hotel websites use a cookie to remember the language and cookies that remember the visitor's consent choice for up to 180 days. Analytics or advertising cookies chosen by the hotel load only after the visitor accepts them.

10. How we protect data

• Encryption in transit: the Service is served only over HTTPS (TLS).
• Tenant isolation: each hotel's data is separated by workspace, and the database enforces row-level security so one hotel's queries cannot read another hotel's records.
• Access control: staff permissions are set by role and by property, and access by our own team is limited to people who need it to operate and support the Service.
• Encryption at rest for stored files such as identity-document images, and additional AES-256-GCM encryption for the payment-provider and channel credentials hotels connect.
• No storage of card numbers or security codes, as described in section 4.
• Records of sensitive actions, and review and automated testing of changes before they reach production.

No system is perfectly secure. If we become aware of a breach that affects personal data, we will notify the affected hotels without undue delay and help them meet their own notification duties, and we will notify authorities and individuals where the law requires us to.

11. Your rights

For data we control, you can exercise the rights below by writing to us. For guest data, the hotel is the controller; contact the hotel, and we will help it answer. We will not discriminate against you for exercising your rights.

Colombia (Ley 1581 de 2012 and Decreto 1377 de 2013, habeas data): you have the right to know, update and correct your personal data; to request proof of the authorisation you gave; to be informed of how your data has been used; to revoke your authorisation or ask for deletion when the law allows it; to access your data free of charge; and to file a complaint with the Superintendencia de Industria y Comercio after first contacting us. We answer queries within 10 business days and complaints within 15 business days, extendable as the law allows.

European Union and United Kingdom (GDPR): you have the right to access, correct and erase your data, to restrict or object to its processing, to data portability, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. Guests from the EU who stay at a hotel using Nido have these rights against the hotel as controller.

United States (including the California Consumer Privacy Act where it applies): you may request to know what personal data we hold about you, to correct it, and to delete it. We do not sell or share personal data as those laws define it. For guest data we act as a service provider to the hotel.

To exercise a right, write to partners@meetnido.com. We may need to verify your identity before we act on a request.

12. Children

Nido is a business tool for hotels and is not directed at children. We do not knowingly create accounts for anyone under 18.

13. Changes to this Policy

We may update this Policy. We will post the new version on this page with a new effective date and, if the changes are material, tell our Customers in advance by email or in the Service.

14. Contact

BlurEffect LLC, 103 Capitol Ave, Suite 420A, Cheyenne, WY 82001, USA. Email: partners@meetnido.com. Phone: +1 (323) 414-2211.