Momentum legal
Privacy Notice
Effective date: September 6, 2026
This Privacy Notice explains how the operator of Momentum (“Momentum,” “we,” “us,”or “our”) handles personal information through our websites, guest-request pages, staff workspace, notifications, and related services (collectively, the “Service”). It applies to hotel guests, hotel and management-company personnel, workspace administrators, and visitors to our website.
This Notice does not cover a hotel’s activities outside Momentum, such as reservations, check-in, payment, security systems, or loyalty programs. Those activities are governed by the hotel’s own notices and practices.
1. Who is responsible for the information
For guest requests and other information a hotel submits to the Service, the hotel, management company, ownership group, or chain using Momentum (the “Property”) decides why and how the information is used. The Property is the business or controller, and Momentum generally acts as its service provider, contractor, or processor.
Momentum is the business or controller for information used to create and secure accounts, operate our website, communicate about the pilot, provide support, prevent misuse, and meet our own legal obligations.
2. Personal information we collect
Depending on how a person uses the Service, we may collect:
- Account and staff information: name, work email, authentication credentials, role, department, shift, invitation status, and account activity.
- Property and room information: property name, type, location, logo, time zone, room identifiers, floors, room types, operational status, service menus, response targets, notification recipients, and retention settings.
- Guest-request information: room number, requested service, request details, room-entry preference, request status and history, optional guest name, optional email address or mobile number, optional photographs, guest messages, and staff notes.
- Communications: support messages, pilot feedback, onboarding communications, and delivery information for emails or text messages.
- Device, security, and usage information: browser or device information, approximate network information, timestamps, page and feature activity, request identifiers, audit events, notification results, and cryptographic hashes derived from IP address and device information for rate limiting and abuse prevention.
Momentum does not need payment-card information, government identification numbers, account passwords, medical records, or other highly sensitive information to fulfill a guest request. Please do not include that information in request text, messages, notes, or photographs.
3. Where the information comes from
We collect personal information:
- directly from guests, account holders, administrators, and staff;
- from the Property, including when an administrator configures rooms, invites team members, or updates a request;
- automatically from browsers, devices, and our hosting infrastructure when the Service is used; and
- from our service providers when they report authentication, hosting, email, text-message, storage, or security events.
4. Why we use the information
Momentum uses personal information as needed to:
- provide, maintain, and secure the Service;
- authenticate users and administer Property workspaces;
- route guest requests to authorized staff and record their progress;
- send requested email or text updates when a guest provides contact information and consents;
- provide browser-based request tracking without requiring guest contact information;
- support customers, troubleshoot problems, and improve the Service’s reliability;
- detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity; and
- comply with law and enforce our agreements.
5. How we disclose information
We may disclose personal information to:
- The Property and its authorized personnel. Staff access is limited by workspace, role, and department configuration. A Property may also designate people to receive operational notifications.
- Service providers. Our current core infrastructure providers include Supabase for authentication, database, realtime features, and private file storage, and Vercel for hosting and application delivery. We may use Resend for email and Twilio for text messages when those notification channels are configured.
- Professional advisers and authorities. We may disclose information to lawyers, auditors, insurers, security specialists, regulators, courts, or law enforcement when reasonably necessary to protect rights, investigate misuse, or comply with law.
- A successor organization. Information may be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to applicable law.
Service providers may process information only to perform services for us or the Property, subject to contractual and legal restrictions. We do not publish guest requests or make guest photographs publicly available.
6. No sale, targeted advertising, or significant automated decisions
Momentum does not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or profile people to make decisions that produce legal or similarly significant effects. We have not done so in the preceding 12 months. We also do not knowingly sell or share the personal information of anyone under 16.
7. Cookies, browser storage, and tracking choices
The Service uses essential cookies or similar storage to maintain authenticated sessions. A guest’s browser may also store a request identifier and a secret tracking token so that the guest can return to the request-status page on the same device. Hosting and security providers may receive standard technical logs when a page or API request is delivered.
Momentum does not currently use third-party advertising cookies or cross-site analytics trackers. Because we do not sell or share personal information for targeted advertising, browser “Do Not Track” or Global Privacy Control signals do not change our current practices. If those practices change, we will update this Notice and honor legally required opt-out signals. Guests can clear locally stored request-tracking information through their browser settings, but doing so may prevent that browser from reopening an earlier request.
8. Guest contact information and notifications
A guest can submit a request without giving an email address or mobile number and can follow progress in the browser. Email or text updates are sent only when the guest provides the relevant contact information, chooses a channel, and consents. Message and data rates may apply to texts. Consent to notifications is not a condition of receiving hotel service.
9. Retention and deletion
Each Property selects a guest-data retention period between 7 and 730 days; the default is 90 days. The period begins after a request is marked Closed or Canceled. When that period expires, Momentum’s scheduled retention process removes the guest’s contact information, name, request text, photographs, messages, and staff notes from the active request record. A limited operational record—such as the Property and room, request category, status, and timestamps—may remain for security, audit, reporting, and service-integrity purposes.
Account, Property, support, security, and legal records are kept while reasonably needed to provide the Service, maintain security, resolve disputes, comply with law, and enforce our agreements. Information may remain temporarily in protected backups until those backups are overwritten through normal cycles. A Property may be legally required to keep some exported or operational records outside Momentum for a different period.
10. Security
We use reasonable administrative and technical safeguards appropriate to the Service, including account authentication, Property-level access restrictions, database access policies, non-public photo storage, time-limited photo links, and hashed rate-limit identifiers. Only personnel and service providers who need information to operate, secure, or support the Service are permitted to access it. No internet service can guarantee absolute security.
11. U.S. state privacy rights
Depending on where a person lives and subject to legal exceptions, they may have the right to confirm whether personal information is processed; access, correct, or delete it; obtain a portable copy; limit certain uses of sensitive information; opt out of sale, targeted advertising, or certain profiling; and appeal a denied request. Momentum does not currently conduct the sale, targeted advertising, or significant-decision profiling that would require those opt-outs. We will not discriminate against a person for exercising a privacy right.
Guests should first contact the Property where they submitted the request because that Property controls the request information. The Property can handle the request directly or ask Momentum to assist. Account holders and staff may submit a request through the support contact in their workspace or by replying to their Momentum onboarding communication. Please describe the request and the account or Property involved. We may need to verify identity and authority before acting. An authorized agent may submit a request where state law allows, but we may require proof of authorization. If a request is denied, the response will explain how to appeal where an appeal right applies.
12. California disclosures
During the preceding 12 months, Momentum collected the categories described in Section 2 from the sources in Section 3 for the purposes in Section 4. We disclosed those categories for business purposes to the recipient categories in Section 5 as necessary for their roles. We did not sell personal information or share it for cross-context behavioral advertising. California residents may exercise applicable rights using the process in Section 11.
13. Children
The Service is designed for Properties, their personnel, and hotel guests; it is not directed to children to create accounts or independently provide personal information. If a parent, guardian, or Property believes a child submitted unnecessary personal information, contact the Property or Momentum using Section 11 so the information can be reviewed and removed as appropriate.
14. Changes to this Notice
We may update this Notice as the Service or law changes. The effective date above shows when it was last revised. For a material change, we will provide reasonable notice through the Service, the account email, or the pilot-onboarding contact channel before the change takes effect when required by law.
15. Contact and emergencies
Guests with privacy questions should contact the Property where they submitted a request. Customers and staff can contact Momentum through the support channel in their workspace or by replying to their pilot-onboarding communication. These channels may also be used for privacy complaints or appeals.
Momentum is not an emergency service. For urgent safety, medical, or security issues, contact the front desk, 911, or the appropriate local emergency service.