Privacy Policy
GuestPilot AI (“GuestPilot AI”, “we”, “us”, “our”) builds and operates AI-assisted messaging and booking automation for hospitality businesses — car hire operators, tour operators and accommodation providers. This policy explains what personal data we handle when you contact one of those businesses through a channel we operate on their behalf (WhatsApp, Instagram, Facebook Messenger, SMS or email), how we use it, who we share it with, and the rights you have.
We are based in Greece and act in accordance with the EU General Data Protection Regulation (GDPR), Greek Law 4624/2019 and Greek Law 3471/2006 on electronic communications.
1. Who is responsible for your data
When you message a hospitality business that uses GuestPilot AI:
- The hospitality business you contacted is the data controller. They decide why your data is collected and how it is used, and their own terms and privacy notice apply to your booking.
- GuestPilot AI is a data processor acting on that business’s documented instructions. We operate the messaging automation, store the conversation, and pass booking details to the business’s systems.
For questions about a specific booking, contact the business directly. For questions about how the automation itself handles data, contact us at [email protected].
2. What data we process
Depending on the service and what you send, we may process:
| Category | Examples |
|---|---|
| Identity & contact | Name, phone number, WhatsApp/Instagram/Messenger profile name and platform user ID, email address |
| Conversation content | The messages you send and receive, including any photos or files you attach, and timestamps |
| Booking details | Dates, vehicle or tour or room selected, pick-up and drop-off locations, party size, special requests, price quoted |
| Car hire driver details (car hire only) | Date of birth, driving licence category, licence number, licence issue date and issuing country — collected as text you type; a physical licence check is done in person at pick-up |
| Payment status | Whether a payment link was issued or a payment completed. Card and bank details are entered directly with the payment provider and are not seen or stored by GuestPilot AI |
| Technical data | Message delivery and read receipts, and limited diagnostic logs needed to keep the service running |
We do not ask for, and you should not send, government ID numbers, full card numbers, passwords, or health information through these channels.
3. Why we process it and the legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Answering your enquiry and providing a quote | Steps taken at your request prior to entering a contract (Art. 6(1)(b)) |
| Creating, amending, extending or cancelling a booking | Performance of a contract (Art. 6(1)(b)) |
| Meeting legal obligations of the hospitality business (e.g. invoicing, tax, statutory client registers, driver-eligibility checks) | Legal obligation (Art. 6(1)(c)) |
| Keeping conversation history so you don’t have to repeat yourself, and improving the reliability of the automation | Legitimate interests in providing a coherent service (Art. 6(1)(f)) |
| Sending you service messages about a booking you made (confirmations, pre-arrival information, follow-ups) | Performance of a contract, or legitimate interests |
We do not use your messages to send you unrelated marketing, and we do not sell personal data.
4. Automated processing
Your messages are read and answered by an AI assistant. It can quote prices, check availability, and create or change bookings using the details you provide. It is instructed to hand a conversation to a human member of the business’s team whenever it cannot answer confidently or when you ask for a person. No decision that produces a legal or similarly significant effect on you is made solely by the automation without a human able to review it.
5. Who we share it with
- The hospitality business you contacted — the controller, who receives your enquiry and booking details.
- Messaging platforms — Meta Platforms Ireland Ltd (WhatsApp, Instagram, Facebook Messenger) and, where used, an SMS carrier, purely to deliver messages between you and the business. Their handling of your data is governed by their own privacy policies.
- Infrastructure and tooling providers that operate under our instructions as sub-processors, including our self-hosted messaging platform and workflow automation (run on servers we control), the AI model provider that generates replies, our database hosting, and — where a booking requires it — the business’s reservation system, invoicing system and payment provider.
- Authorities or advisors where we are legally required to disclose data, or to establish or defend legal claims.
Where a provider is outside the European Economic Area, transfers are covered by an adequacy decision or by Standard Contractual Clauses.
6. How long we keep it
- Active conversations and booking data are retained for the duration of the booking relationship and then for as long as the hospitality business needs them to meet legal and accounting obligations (in Greece, commercial and tax records are generally kept for five years).
- Enquiries that do not lead to a booking are retained for up to 12 months and then deleted or anonymised.
- Diagnostic logs are retained for up to 90 days.
The hospitality business, as controller, may set shorter or longer periods; we follow their documented instructions.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (“right to be forgotten”), where no overriding legal obligation to keep it applies;
- restrict or object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time where processing is based on consent, without affecting prior processing.
To exercise any of these, contact the hospitality business you dealt with, or contact us at [email protected] and we will route the request to the correct controller and assist them in responding. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
8. Security
Messaging and booking data is held on servers we control, protected by encryption in transit, access controls and network isolation. Access to conversation content is limited to the hospitality business’s authorised staff and to GuestPilot AI personnel who need it to operate and support the service. Payment card details are never transmitted to or stored by us.
9. Children
These services are intended for adults arranging travel services. Car hire in particular is only available to drivers aged 21 or over. We do not knowingly process the data of children.
10. Platform-specific notes
Meta platforms (WhatsApp, Instagram, Facebook Messenger). When you message a business through one of these channels, GuestPilot AI receives your message, your platform-assigned user ID and your public profile name via Meta’s messaging APIs, solely to deliver and respond to that conversation on the business’s behalf. We use this data only for the messaging and booking purposes described above, in line with the Meta Platform Terms and Developer Policies. We do not use it to build advertising profiles and we do not share it with data brokers.
11. Changes to this policy
We may update this policy as our services or legal obligations change. The “last updated” date at the top reflects the current version. Material changes affecting how your data is used will be communicated through the relevant hospitality business.
12. Contact
GuestPilot AI
Email: [email protected]
For data-protection matters, please put “Privacy” in the subject line.