This Privacy Policy explains how GuestAI, Inc. ("myGuest", "we") processes personal data in connection with the myGuest services. GuestAI, Inc. is a Delaware corporation with its registered office at 1111B S Governors Ave, #58573, Dover, DE 19904, USA, and its operating address at 169 Madison Ave, STE 42222, New York, NY 10016, USA. Contact: team@myguest.ai.

1. Who We Are and Our Roles

1.1 Guest data — we are a processor. When guests, callers or other people communicate with a hotel or property operator through myGuest (calls, chat, messages), the operator (our "Customer") is the controller of that data. We process it only on the Customer's behalf and instructions, under our Data Processing Agreement (www.myguest.ai/dpa).

1.2 Customer account data — we are a controller. For data about our Customers' staff and contacts (account, contact, billing and support data), GuestAI, Inc. is the controller.

2. Data we process

2.1 Guest interaction data: phone numbers, call recordings, transcripts, chat and message content, conversation summaries, and booking or stay details the Customer makes available to the agent.

2.2 Customer account data: names, business e-mail addresses and phone numbers of Customer staff, account configuration, billing and invoicing data, and a payment token from our payment provider. We do not store full card numbers.

2.3 Special categories. We do not intend to collect special categories of personal data. Guests may disclose such data spontaneously in free-form conversation. Such data is not separately indexed or used, is accessible only to personnel handling Customer support, is deleted under the standard retention periods, and is never used for analytics or model training.

3. Purposes and Legal Bases

3.1 Guest interaction data is processed to answer and route guest enquiries and calls on the Customer's behalf, including transcription, summaries, missed-transfer follow-up, quality control and correction of agent responses for that Customer. The legal basis is determined by the Customer as controller.

3.2 Customer account data is processed to perform our contract with the Customer, provide support, bill and collect fees (contract); to secure the service and prevent abuse (legitimate interest); and to meet accounting and tax obligations (legal obligation).

3.3 No model training. We do not use guest conversations or Customer data to train foundation models, our own or our providers'. Data is used only to provide and improve the service for the Customer it belongs to.

4. AI transparency and Recording

myGuest agents identify themselves as AI at the start of an interaction, and callers can ask to be transferred to a human at any time. Calls and conversations are recorded and transcribed, as this powers core functions of the service. The Customer is responsible for informing its guests about this, and myGuest provides the technical means to do so.

5. Sub-processors and Recipients

We use carefully selected sub-processors in the following categories: telephony and SMS, speech synthesis and recognition, large-language-model providers, cloud hosting, and payment processing. Each is bound by a data processing agreement with the same data protection obligations as ours. The current list of categories, locations and transfer mechanisms is published at www.myguest.ai/subprocessors. The names of individual sub-processors are available to Customers upon request at team@myguest.ai.

6. International Transfers

GuestAI, Inc. is established in the United States, and some of our providers process data there. Transfers of personal data from the EEA are safeguarded by the EU Standard Contractual Clauses and, where the provider holds an active certification, the EU-US Data Privacy Framework. Our cloud hosting runs in an EU region; where remote access from outside the EEA is possible, the same safeguards apply.

7. Retention

• Call recordings: up to 12 months.

• Transcripts and conversation summaries: up to 24 months.

• Customer account and billing data: for the term of the contract, then as long as required by accounting and tax law.

The Customer may instruct shorter periods. After a contract ends, guest data is deleted or returned under the DPA. Data in backups is deleted through backup rotation and remains protected until then.

8. Your Rights

8.1 Guests and callers. As the Customer is the controller of guest data, please direct requests (access, rectification, erasure, restriction, portability, objection) to the hotel or property operator you contacted. We forward any request we receive to the Customer and support them in responding.

8.2 Customer staff and contacts. For account data controlled by us, you can exercise these rights by writing to team@myguest.ai.

8.3 Complaints. Individuals in the EU/EEA may lodge a complaint with the data protection supervisory authority of their country of residence or work.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls, separation of environments, logging, due diligence of sub-processors and confidentiality commitments of our staff.

10. Related Documents

This Privacy Policy should be read together with our Terms of Service (www.myguest.ai/terms), Data Processing Agreement (www.myguest.ai/dpa) and Refund Policy (www.myguest.ai/refund-policy).

11. Changes

We may update this Privacy Policy. Material changes are communicated to Customers in advance by e-mail or in the customer panel. The current version is always available at www.myguest.ai/privacy-policy.