Privacy Policy.

1. Data Controller

Gryponisiotis EE
Tax ID (AFM): 801244565
Registered address: P. Tsaldari 67, Xylokastro, Greece
Contact email: [email protected]
Data Protection Officer (DPO): [email protected]

2. Data We Collect

2.1 Data you provide

• Contact / demo request form: Full name, email, hotel name, phone number
• Customer account (after sign-up): Business details, contact information

2.2 Data collected automatically

• Analytics cookies: Google Analytics 4 — anonymous browsing data, only after your consent
• Marketing cookies: Google Ads conversion tracking — only after your consent
• Technical data: IP address, browser type, operating system
• Voice assistant identifier: when you start a conversation with the website voice assistant, a random identifier is stored on your device so the conversation can be kept continuous. No identifier derived from your device's characteristics is used, and the identifier is removed when you clear your browsing data.

2.3 Data from platform usage (customers)

• Voice calls (AI VoIP Receptionist): Call transcripts — stored for service improvement, deleted within 90 days
• WhatsApp messages: Conversation history via WhatsApp AI Receptionist
• Booking data: Guest details synced through booking integrations

3. Purpose and Legal Basis

Purpose	Legal basis (GDPR)
Responding to demo/contact requests	Consent (Art. 6.1.a)
Providing the Hotelio AI service	Performance of contract (Art. 6.1.b)
Analytics (Google Analytics 4)	Consent (Art. 6.1.a)
Marketing (Google Ads)	Consent (Art. 6.1.a)
Email communications (Brevo)	Consent (Art. 6.1.a)
Security and abuse prevention	Legitimate interest (Art. 6.1.f)

4. Third Parties — Data Processors

Provider	Purpose	Country / Safeguards
Google Analytics (Google LLC)	Web analytics	USA — EU-US Data Privacy Framework
Google Ads (Google LLC)	Conversion tracking	USA — EU-US Data Privacy Framework
Brevo (Sendinblue SAS)	Transactional & marketing emails	France (EU)
Anthropic (Anthropic PBC)	AI voice processing	USA — Standard Contractual Clauses (SCCs)
ElevenLabs Inc.	Website voice assistant	USA — Standard Contractual Clauses (SCCs)
Cloudflare, Inc.	Content delivery network (CDN) and DDoS protection	USA — Standard Contractual Clauses (SCCs)
Viva Wallet (Viva.com)	Payment processing	Greece (EU)
Scaleway S.A.S.	Website hosting	France (EU)

5. Retention Periods

Data category	Retention period
Contact form data	12 months from last communication
Customer account data	Duration of contract + 6 months
Call transcripts	90 days
Analytics cookies	14 months (Google Analytics default)
Billing data	5 years (tax law requirement)

6. Your Rights (GDPR)

• Access: Learn what data we process about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Restriction: Request restriction of processing
• Withdraw consent: At any time, without retroactive effect

Contact: [email protected]. Response within 30 days.

7. Cookies

Category	Cookies	Requires consent
Necessary	Session, CSRF protection	No
Analytics	Google Analytics 4	Yes
Marketing	Google Ads, conversion tracking	Yes

Manage via cookie banner or "Cookie Settings" in footer.

8. Security

TLS encryption, controlled access, regular backups.

9. Data Protection Authority

Hellenic Data Protection Authority (HDPA):
Kifisias 1-3, 115 23 Athens, Greece
Tel: +30 210 6475600
Website: www.dpa.gr

10. Changes

Changes published on this page with updated date.