A hotel’s data in AI Otel: separation, export, retention and hosting

In AI Otel, each hotel's data is separated at the database level, and KVKK consent, data export and retention periods are built into the data model; both are built, ahead of launch. The promise that a hotel's knowledge stays its own is architected. Hosting and AI processing in Türkiye are on the roadmap, not done.

The data question usually arrives late, often when a new owner or a data contact asks where the guest records actually sit. By then the answer is in a contract annex that nobody read, and the hotel's current software is already running the front desk. After reading this, you will be able to ask the right questions before you sign, know which of AI Otel's data claims you can test today, and know which are still plans.

What should a hotel ask about its data, from any provider?#

Four questions cover most of it: separation, export, retention and location. A fifth, who inside the provider can open your records, decides how much the first four are worth.

Separation asks whether records are kept apart in the database itself or only filtered by the software. A filter that is forgotten once is a leak; a database that keeps rows apart is a structural barrier. Export asks for the file format, whether you can run a test export before signing, and whether the export carries history or only current records. Retention asks how long each kind of record is kept, what happens to backups, and who is allowed to delete. Location asks where data is stored and, separately, where it is processed, because an AI step can run in a different place from the database.

Put the answers in the contract annex, not in a sales email. A sentence that survives a change of account manager is worth more than a demonstration. And ask the same questions of your channel manager, your booking engine and your accounting link: the weakest answer in the chain sets your real position.

How does AI Otel keep one hotel's data apart from another's?#

Each hotel's data is separated at the database level, and that is working software ahead of launch. That is the whole published claim, and we do not add table counts or policy counts to it.

Multi-tenant software serves many hotels from one running system. Separation is what stops hotel A's records appearing in hotel B's screens. Two common designs exist. One keeps all hotels in shared tables with a hotel identifier on every row, enforced by database rules. The other gives each hotel its own schema or its own database.

The trade-off is real. Shared tables are cheaper to run and harder to keep safe; separate stores are cleaner and heavier to operate. Neither is automatically better for a small property. AI Otel's published line is that separation happens at the database level; we do not state which of the two designs we use, and we do not publish counts of tables or policies.

Separation is not access control. Separation keeps hotels apart from each other; access control decides which person inside one hotel sees which record. A buyer can check three things: ask for a written description of the separation, ask what happens when a support engineer opens a record, and ask whether that access is logged. A hotel group should ask a third question as well: whether the group's own properties are separated from each other, or only from other customers. For the general picture, read how each hotel's data stays apart in multi-tenant hotel software.

What is built into the data model for consent, export and retention?#

KVKK consent, data export and retention periods are built into the data model, which means they sit with the records themselves rather than in a separate procedure. KVKK is the Turkish personal data protection law.

Consent as a record means a date, a purpose and a scope attached to the guest's record, so it can be shown later. A paper form in a drawer cannot answer the question six months on. Export means the data model can produce a hotel's data as a file; ask for the format and whether history is included, because a current-state export is a snapshot, not a handover. Retention means a period attached to each kind of record, so old data can be found and removed rather than kept forever by default. The useful question is not "do you delete" but "how would you find everything that is due".

In most hotel software arrangements the hotel decides why personal data is processed and the provider processes it on the hotel's instructions. Confirm your own case with your adviser, because the contract decides it.

What we do not claim: no KVKK certificate, no "KVKK-safe AI", and no statement about scanning identity documents. Those claims are not made here and should not be read into the line above. This article describes the duty in general terms; dates, penalties and your own situation belong to an accountant or legal adviser. For the wider duty, see KVKK for hotels: notices, consent, staff access and retention.

Which of these claims are built, and which are still designs?#

Two of the claims in this article are built and three are not. The status word is the difference between something you can test and something you are being asked to believe.

The vocabulary is fixed and short. Built means working software, ahead of launch, not in customers' hands. Architected means designed. Roadmap means planned. A built item can go into a contract as a description of the software; an architected item can only be a direction, and a roadmap item is a plan that may slip.

Nothing in AI Otel's technology is live. OtelCiro, the ecosystem's hotel growth and consultancy arm, works with paying hotel clients today; the hotel operating system itself is built and working, ahead of launch. Ask any provider for the same split. "We do that" without a status word is not an answer, and a demonstration is not a status either. The split protects the buyer: it tells you what to test now, what to write into the contract as a direction, and what to ignore until it exists.

How would learning across hotels work without exposing one hotel?#

The Platform Brain is designed to learn patterns across the network with privacy thresholds, so that no single hotel can be identified. It is architected, and there is no trained model yet.

A privacy threshold in plain words: a pattern is only used when enough properties contribute to it, so no one property's numbers can be read back out of the result. We do not publish the threshold values, and we do not claim that data never leaves a hotel or that learning happens inside the hotel. Neither statement would be true today.

What runs today is narrower: the PMS assistant answers questions about a hotel's own property from that hotel's own data, and a person confirms anything sensitive. The honest position on models is this: we have no trained model yet, and the product says so on screen. What exists is the architecture, the decision infrastructure a model would run inside, and a benchmark to choose the model. The Hotel Brain, which understands one property, is architected and entering training; the Platform Brain is designed; the Industry Brain is on the roadmap.

If a provider offers cross-hotel learning, ask three questions: is contribution opt-in or opt-out, can a hotel see what it contributed, and what is the minimum number of properties behind a published pattern. The design of the Platform Brain and learning across hotels without exposing any single hotel is published for exactly that kind of scrutiny.

Is hotel data hosted in Türkiye?#

Not today. Moving hosting and AI processing into Türkiye is on our roadmap, and until it is done we do not claim it.

State it plainly: a roadmap item is a plan, not a control, and it must not appear in a contract as a present fact. Separate storage from processing, because an AI step can send data to a different place from the database, so a provider that answers only the storage question has answered half of it.

Words we avoid, and why: sovereign, Türkiye-resident, and "data never leaves". Each is a claim about today, and none of them is true yet. What to ask any provider: the current location in writing, the date it last changed, which subcontractors are involved, and whether you will be told before it changes. A dated written answer is worth more than a promise; if the location changes next year, the dated answer is what lets you renegotiate. Confirm your own transfer and residency position with a legal adviser, because the rules depend on your contracts and your data.

What should you ask your counsel before you sign?#

Take the contract and the provider's written data description to your own KVKK adviser, and run a test export during the trial, not after you have moved.

Ask for the separation description in writing and attach it to the contract as an annex, so a later change of account manager does not change the answer. Run a test export while you can still walk away: check that history, attachments and open bills are included, and that the file opens without the provider's software. Get retention and deletion in writing, including backups and what happens at contract end. "We delete it" without a period and a method is not an answer.

Ask where storage and processing happen, and ask for a duty to notify you before either changes. Keep a dated record of every answer; a provider that answered in writing once will answer again, and the record is what you show an owner or an auditor. This article describes duties in general terms; confirm dates, penalties and your own case with an accountant or legal adviser before you rely on any of it.

What to do next#

The article is one chain: separation keeps hotels apart, the data model makes consent, export and retention findable, the status words tell you which of those you can test today, and the hosting line tells you what is still a plan. The next step is a written request: ask for the separation description, a sample export and the retention list, then take all three to your adviser. If you want those answers from us in one conversation, request a briefing at https://ai-otel.com/contact.