{"id":1301,"date":"2026-09-10T16:53:27","date_gmt":"2026-09-10T14:53:27","guid":{"rendered":"https:\/\/sbit-hospitality.com\/?p=1301"},"modified":"2026-09-11T21:08:06","modified_gmt":"2026-09-11T19:08:06","slug":"guest-data-chatgpt-hotels","status":"publish","type":"post","link":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/","title":{"rendered":"Where your hotel\u2019s guest data goes when your staff use ChatGPT."},"content":{"rendered":"
\n

Chapter 01<\/p>\n<\/div>\n\n

\n

It is happening at your front desk today. Nobody is doing anything wrong.<\/h2>\n<\/div>\n\n
\n

A guest in room 412 has been charged twice. It is 9:20pm, the duty manager wants the apology out before the guest goes to bed, and the receptionist writing it is not a writer. So she opens a free AI tool, pastes in the guest\u2019s message along with the name, the booking reference and the dates of the stay, and asks for something polite. Ten seconds later she has a good email. In those same ten seconds your hotel lost the ability to say where that guest\u2019s data went.<\/p>\n<\/div>\n\n

\n

The instinct is right, the route is not<\/h3>\n<\/div>\n\n
\n

Start by noticing what she got right. She wanted the guest answered tonight rather than tomorrow. She wanted the tone to be better than she could manage at the end of a shift. She used the fastest tool available to do a job her employer wants done. Every part of that judgement serves the hotel.<\/p>\n<\/div>\n\n

\n

What she did not have was a route that was both fast and safe. That is not a training problem and it is not a discipline problem. It is a provisioning problem, and it belongs to whoever decides what tools sit on the desk.<\/p>\n<\/div>\n\n

\n

Why this is not a hypothetical<\/h3>\n<\/div>\n\n
\n

Ask any front office manager how their team handles a difficult email in a foreign language at 11pm and you will hear some version of this story. The tools are free, they are on every phone, and they are genuinely good at the task. The only real question is whether the usage is visible to you or not.<\/p>\n<\/div>\n\n\n

\n

The receptionist made a reasonable decision with the options in front of her. The options were the problem.<\/p>\n<\/div><\/blockquote>\n\n\n

\n

Chapter 02<\/p>\n<\/div>\n\n

\n

What actually happens to the text you paste<\/h2>\n<\/div>\n\n
\n

The uncomfortable part is not that consumer AI tools are careless. It is that after the fact you cannot prove anything. Where the text was processed, whether it was retained, whether it contributed to a model, who at the provider could have seen it: on a personal account, none of that is answerable by you.<\/p>\n<\/div>\n\n

\n

Processing, retention and proof are three different questions<\/h3>\n<\/div>\n\n
\n

Consumer tools process what you type on the provider\u2019s infrastructure, frequently outside the EU. Retention and training practice vary by tool and by plan, and they change. You may well be using a provider whose terms are perfectly reasonable this month. The point is that you are relying on a claim rather than a control, and you have no record either way.<\/p>\n<\/div>\n\n

\n

For ordinary office text that is an acceptable trade. A draft agenda, a rewritten paragraph of marketing copy, a translation of an internal notice: if that leaks, you have a bad day, not a notifiable incident. Guest data is a different category. A name attached to a booking, the dates of a stay, a passport scan, a health note in a special-request field. Once that has gone through an unmanaged account there is no path back and no record to produce.<\/p>\n<\/div>\n\n

\n

The two named risks worth knowing<\/h3>\n<\/div>\n\n
\n

If you want the vocabulary your security people will use, the OWASP Top 10 for LLM Applications ranks prompt injection first and sensitive information disclosure second. The second is the one that applies here, and it does not require an attacker. It only requires an employee, a deadline and a text box.<\/p>\n<\/div>\n\n

\n

Chapter 03<\/p>\n<\/div>\n\n

\n

Why banning it makes the problem harder to see<\/h2>\n<\/div>\n\n
\n

The reflex is to block the tools. It is decisive, it is cheap, and it is the single most expensive mistake available in this area. A ban does not remove the demand that created the behaviour. It removes your view of it.<\/p>\n<\/div>\n\n

\n

What a ban actually changes<\/h3>\n<\/div>\n\n
\n

The work still has to be done and the tools still exist. What changes is the device and the account. Usage moves from a corporate browser you can see to a personal phone you cannot, and from a work account with a contract behind it to a personal account with nothing behind it. You have not reduced exposure. You have converted a measurable risk into an invisible one, and you have taught your team that the honest answer to \u201care you using AI?\u201d is no.<\/p>\n<\/div>\n\n

\n

That last part is the real cost. The moment the truthful answer becomes career-limiting, you stop receiving information about your own operation. Six months later you cannot answer a customer\u2019s security questionnaire about AI usage, because your inventory says zero and your inventory is fiction.<\/p>\n<\/div>\n\n

\n

The test that separates policy from theatre<\/h3>\n<\/div>\n\n
\n

A useful check: if your rule were followed exactly, would the work still get done on time and to standard? If the honest answer is no, you have not written a policy. You have written a reason for people to route around you.<\/p>\n<\/div>\n\n

\n

Chapter 04<\/p>\n<\/div>\n\n

\n

Make the safe path the fast path<\/h2>\n<\/div>\n\n
\n

The way out is not less AI. It is a route that is quicker than the personal phone and safe by construction, so that reaching for the unmanaged tool becomes the slower option rather than the forbidden one. Four things do most of the work.<\/p>\n<\/div>\n\n

\n
\n

What actually reduces the exposure<\/h3>\n
\n
\n

See what is in use<\/h4>\n

You cannot govern what you cannot see. Establish which AI tools are actually being used, across browsers, devices and accounts, before deciding anything. The first inventory is usually uncomfortable and always useful, because it tells you which needs are real rather than which ones you assumed.<\/p>\n<\/div>\n <\/div>\n

\n

Catch the data before the tool<\/h4>\n

A redaction layer sits between the person and the provider and strips names, booking references, stay dates and passport numbers out of the prompt. The receptionist still gets her apology email in ten seconds. What leaves is a request about a double charge, not a guest.<\/p>\n<\/div>\n <\/div>\n

\n

Give them one good route<\/h4>\n

An approved AI environment, available on the machines people actually work on, fast enough that nobody resents it. This is the part most organisations skip, and it is the part that makes the rest hold. A safe option nobody enjoys using is a ban with extra steps.<\/p>\n<\/div>\n <\/div>\n

\n

Write one rule people remember<\/h4>\n

Not a policy document, one sentence a tired person can recall at 11pm. Guest details never go into an AI tool that is not the approved one. Short enough to repeat at handover, specific enough to act on, with no exceptions that need interpreting at speed.<\/p>\n<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n

\n

Redaction is the piece worth understanding<\/h3>\n<\/div>\n\n
\n

Of the four, redaction is the one that changes the arithmetic rather than the odds. Visibility tells you where you stand, an approved tool changes behaviour, a clear rule sets expectation. But redaction means that even when someone gets it wrong, and someone will, the thing that leaves is not the thing that hurts. It is the only control on the list that assumes failure and still holds.<\/p>\n<\/div>\n\n

\n

Chapter 05<\/p>\n<\/div>\n\n

\n

What you gain besides not leaking<\/h2>\n<\/div>\n\n
\n

Treated as a compliance chore, this is a cost. Treated properly, it produces two things you can use commercially, and both arrive as a side effect of doing the work rather than as an extra project.<\/p>\n<\/div>\n\n

\n

An answer for the questionnaire you are about to receive<\/h3>\n<\/div>\n\n
\n

Your corporate customers are increasingly in NIS2 scope. Article 21(2)(d) requires them to manage security in their direct supplier relationships, and hotels are direct suppliers. The AI section of their questionnaire is already appearing, and it asks which AI services touch their people\u2019s data, what happens to that data and who is accountable. A hotel with an inventory answers in an afternoon. A hotel with a ban and a blind spot answers slowly, badly or not at all, in a procurement conversation where slow reads as unmanaged.<\/p>\n<\/div>\n\n

\n

A team that tells you the truth<\/h3>\n<\/div>\n\n
\n

The other gain is quieter and worth more. When using AI properly is easy and admitting to it is safe, you find out what your people are actually doing, which is the only basis on which you can improve any of it. The receptionist who told you she uses a translation tool every evening has just handed you a use case, a training need and a small piece of your risk picture, for free.<\/p>\n<\/div>\n\n

\n

None of this requires taking a position on whether AI belongs in hospitality. It is already there, tonight, at your front desk, in the hands of someone doing her job well with the wrong tool because it was the only fast one. The decision in front of you is not whether that happens. It is whether you can see it.<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"

It is 9:20pm and a receptionist pastes a guest\u2019s name, booking reference and stay dates into a free AI tool to draft an apology. She made a reasonable decision with the options in front of her. The options were the problem.<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[12],"class_list":["post-1301","post","type-post","status-publish","format-standard","hentry","category-secure360"],"acf":{"post_subtitle":"","post_title":"Where your hotel\u2019s guest data goes when your staff use ChatGPT.","post_title_highlight":"when your staff use ChatGPT.","post_excerpt":"","post_image":1947,"quote":"The receptionist made a reasonable decision with the options in front of her. The options were the problem.","quote_name":"Sandro Migliardi","quote_role":"CEO","quote_company":"Sbit Hospitality ICT Services","sources":null,"post_footer_cta":{"subtitle":"","title":"","text":"","button_1":"","button_2":""}},"yoast_head":"\nGuest Data and Shadow AI in Hotels | Sbit<\/title>\n<meta name=\"description\" content=\"Your staff already use AI tools on guest data. Banning them removes your visibility, not your risk. What to put in place instead.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Guest Data and Shadow AI in Hotels | Sbit\" \/>\n<meta property=\"og:description\" content=\"Your staff already use AI tools on guest data. Banning them removes your visibility, not your risk. What to put in place instead.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/\" \/>\n<meta property=\"og:site_name\" content=\"Sbit Hospitality\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-10T14:53:27+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-11T19:08:06+00:00\" \/>\n<meta name=\"author\" content=\"Sandro Migliardi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sandro Migliardi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/guest-data-chatgpt-hotels\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/guest-data-chatgpt-hotels\\\/\"},\"author\":{\"name\":\"Sandro Migliardi\",\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/#\\\/schema\\\/person\\\/83cfa124bcf24f43bb0d7b0f2bd015c0\"},\"headline\":\"Where your hotel\u2019s guest data goes when your staff use ChatGPT.\",\"datePublished\":\"2026-09-10T14:53:27+00:00\",\"dateModified\":\"2026-09-11T19:08:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/guest-data-chatgpt-hotels\\\/\"},\"wordCount\":1225,\"articleSection\":[\"Secure360\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/guest-data-chatgpt-hotels\\\/\",\"url\":\"https:\\\/\\\/sbit-hospitality.com\\\/guest-data-chatgpt-hotels\\\/\",\"name\":\"Guest Data and Shadow AI in Hotels | Sbit\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/#website\"},\"datePublished\":\"2026-09-10T14:53:27+00:00\",\"dateModified\":\"2026-09-11T19:08:06+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/#\\\/schema\\\/person\\\/83cfa124bcf24f43bb0d7b0f2bd015c0\"},\"description\":\"Your staff already use AI tools on guest data. Banning them removes your visibility, not your risk. What to put in place instead.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/guest-data-chatgpt-hotels\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sbit-hospitality.com\\\/guest-data-chatgpt-hotels\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/guest-data-chatgpt-hotels\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sbit-hospitality.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Where your hotel\u2019s guest data goes when your staff use ChatGPT.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/#website\",\"url\":\"https:\\\/\\\/sbit-hospitality.com\\\/\",\"name\":\"Sbit Hospitality\",\"description\":\"Hospitality ICT Services\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sbit-hospitality.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sbit-hospitality.com\\\/#\\\/schema\\\/person\\\/83cfa124bcf24f43bb0d7b0f2bd015c0\",\"name\":\"Sandro Migliardi\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Guest Data and Shadow AI in Hotels | Sbit","description":"Your staff already use AI tools on guest data. Banning them removes your visibility, not your risk. What to put in place instead.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/","og_locale":"en_US","og_type":"article","og_title":"Guest Data and Shadow AI in Hotels | Sbit","og_description":"Your staff already use AI tools on guest data. Banning them removes your visibility, not your risk. What to put in place instead.","og_url":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/","og_site_name":"Sbit Hospitality","article_published_time":"2026-09-10T14:53:27+00:00","article_modified_time":"2026-09-11T19:08:06+00:00","author":"Sandro Migliardi","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Sandro Migliardi","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/#article","isPartOf":{"@id":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/"},"author":{"name":"Sandro Migliardi","@id":"https:\/\/sbit-hospitality.com\/#\/schema\/person\/83cfa124bcf24f43bb0d7b0f2bd015c0"},"headline":"Where your hotel\u2019s guest data goes when your staff use ChatGPT.","datePublished":"2026-09-10T14:53:27+00:00","dateModified":"2026-09-11T19:08:06+00:00","mainEntityOfPage":{"@id":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/"},"wordCount":1225,"articleSection":["Secure360"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/","url":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/","name":"Guest Data and Shadow AI in Hotels | Sbit","isPartOf":{"@id":"https:\/\/sbit-hospitality.com\/#website"},"datePublished":"2026-09-10T14:53:27+00:00","dateModified":"2026-09-11T19:08:06+00:00","author":{"@id":"https:\/\/sbit-hospitality.com\/#\/schema\/person\/83cfa124bcf24f43bb0d7b0f2bd015c0"},"description":"Your staff already use AI tools on guest data. Banning them removes your visibility, not your risk. What to put in place instead.","breadcrumb":{"@id":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/sbit-hospitality.com\/guest-data-chatgpt-hotels\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sbit-hospitality.com\/"},{"@type":"ListItem","position":2,"name":"Where your hotel\u2019s guest data goes when your staff use ChatGPT."}]},{"@type":"WebSite","@id":"https:\/\/sbit-hospitality.com\/#website","url":"https:\/\/sbit-hospitality.com\/","name":"Sbit Hospitality","description":"Hospitality ICT Services","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sbit-hospitality.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/sbit-hospitality.com\/#\/schema\/person\/83cfa124bcf24f43bb0d7b0f2bd015c0","name":"Sandro Migliardi"}]}},"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/sbit-hospitality.com\/sbit-api\/wp\/v2\/posts\/1301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sbit-hospitality.com\/sbit-api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sbit-hospitality.com\/sbit-api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sbit-hospitality.com\/sbit-api\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/sbit-hospitality.com\/sbit-api\/wp\/v2\/comments?post=1301"}],"version-history":[{"count":6,"href":"https:\/\/sbit-hospitality.com\/sbit-api\/wp\/v2\/posts\/1301\/revisions"}],"predecessor-version":[{"id":1950,"href":"https:\/\/sbit-hospitality.com\/sbit-api\/wp\/v2\/posts\/1301\/revisions\/1950"}],"wp:attachment":[{"href":"https:\/\/sbit-hospitality.com\/sbit-api\/wp\/v2\/media?parent=1301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sbit-hospitality.com\/sbit-api\/wp\/v2\/categories?post=1301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}