Let the user register a site when they create a UUID (Account). You are not storing private data. Let the user make cors request using the UUID as an authorization token. If the website and the UUID match, the server responds with the content.
Hi, found an earlier comment of yours mentioning you changed to being a hotel owner. We make a free hotel PMS -- would you like to get in touch and see how we can make it better for you? https://hoteliera.com/