The privacy question: booking sunbeds without watching guests

There are three ways to know whether a lounger is occupied. You can watch it with a camera. You can put a pressure pad under it. Or you can not measure it at all, and instead only track whether a guest has reserved it. All three work as pool operations. Only the third one avoids watching guests.

Cameras solve occupancy accurately and cheaply, and they also introduce a permanent surveillance surface that a hotel will now be responsible for, in every jurisdiction it operates in. GDPR is only the loudest of the constraints; the cultural reality is that a camera pointed at a pool deck is a camera pointed at guests in swimwear. Even the best-intentioned deployment eventually has a bad day.

Pressure pads and PIR sensors avoid the imagery but still track people: every time a specific guest sits down, gets up, or walks past, an event is logged against a lounger. That log is a behavioural record, and unlike a camera, it is invisible to the guest. In some ways this is worse: nothing to opt out of because nothing looks like it is watching.

The third approach, tracking the reservation and not the occupancy, is what SunDibs does. We know whether a lounger has been pinned. We know whether the guest confirmed arrival. We do not know whether they are currently on it. This is the architectural constraint that makes the privacy story real: we cannot tell you a lounger is occupied because we have no way to observe that, and no future policy change can add one without new hardware.

The trade-off is that we cannot detect a guest who sits down without pinning, and we cannot detect a guest who leaves for a two-hour lunch and comes back. We treat both cases the same way: the arrival window is what matters. If the guest reserved and confirmed, the lounger is theirs for the day. If they did not, someone else will pin it. Occupancy in the moment is not something the system needs to know.

This is the shape of privacy that is worth having: not a policy that can be revised in a settings screen, but a design that makes the surveillance option unavailable. It is the difference between a lock and a promise.