Privacy Policy

Last updated: 2026-08-02

1. Introduction

CHATOTELLE LLC operates Chatotelle.com, an AI-powered chat platform used by businesses across hospitality, scheduling, and travel to communicate with their guests and customers. Each business has a private account on Chatotelle.com and manages operations through a dedicated dashboard. Any positioning of the Service around a particular industry is marketing framing only and does not limit the categories of data this policy may cover.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. We do not use or share your information except as described herein.

2. Two Distinct Data Flows

This policy covers two distinct data flows:

Hotel Partner & Staff Data — where CHATOTELLE LLC is the data controller. This covers dashboard accounts, staff login data, access logs, and any information Hotel Partners provide directly to CHATOTELLE LLC in the course of using or setting up the Service.

Guest Data — where CHATOTELLE LLC is a data processor acting on behalf of the Hotel Partner, who is the data controller. This covers all personal data of guests and customers processed through the WhatsApp assistant, ticketing system, and, where enabled, the Flight Booking Service. The terms governing that relationship are set out in our Data Processing Agreement.

3. Data Roles & Responsibilities

For Hotel Partner and staff accounts, CHATOTELLE LLC determines the purpose and means of processing and acts as the data controller.

For guest data processed through the platform, CHATOTELLE LLC acts as a data processor on behalf of the Hotel Partner. Hotel Partners act as data controllers and are responsible for the personal data of their guests, including how it is collected and used. We process guest data strictly according to the instructions of the Hotel Partner.

4. Legal Basis for Processing

We process personal data under the following legal bases: contractual necessity (to provide the Service), legitimate interests (to improve and secure the platform), and consent where applicable.

5. Hotel Partner & Staff Data

As data controller, we collect and store the following data provided directly by Hotel Partners:

Hotel identity and profile: name, address, geographic coordinates, contact details, website, booking URL, social links, and branding assets.

Manager information: name, phone number, and email address.

Operational configuration: department setups, products and services listings, menus, AI behavioral rules, and ticket reply templates.

Technical credentials: Meta API phone number ID and access token required to operate the WhatsApp Business integration.

Staff account data: login credentials (managed via Firebase by Google), dashboard access logs, and session data.

6. WhatsApp Phone Numbers

All WhatsApp phone numbers used to operate the Service are owned and controlled exclusively by CHATOTELLE LLC. No phone number is registered under or transferred to any Hotel Partner. Guest interactions occur through numbers assigned by CHATOTELLE LLC for the duration of the service relationship.

7. Guest Data (Processed on Behalf of Hotel Partners)

When guests interact with a hotel's WhatsApp assistant, we collect and store the following data on behalf of the Hotel Partner:

Identity: phone number, WhatsApp identifier (JID), name, and gender.

Stay details: room number and preferred language.

Interaction data: bot activation status, session records, and interaction timestamps.

Staff notes: written memos added by authorized hotel staff to guest records through the dashboard.

AI summaries: behavioral summaries generated by the AI to improve response quality within a guest's session. These are visible only to the Hotel Partner's authorized staff.

Where the Flight Booking Service is used, we also collect flight-specific data as described in Section 8.

8. Flight Booking Data & Advance Passenger Information

Where a Hotel Partner enables the Flight Booking Service, we collect additional data necessary to search for and book flights on a guest's behalf.

TSA Secure Flight, which applies to all flights within the United States, requires a full legal name and gender — already collected as part of Guest Data (see Section 7) — plus date of birth, which we collect specifically for the Flight Booking Service.

We additionally collect a contact email, used to send booking and payment confirmations, and booking and payment transaction history, retained for billing, refund, and dispute-handling purposes.

For international flights only: passport number, expiry date, nationality, and issuing country (Advance Passenger Information), required by destination-country immigration authorities and passed through to the operating airline as part of the booking. This data is not collected for domestic-only bookings.

Passport-level data is treated as a heightened-sensitivity category: it is encrypted at the field level (see Section 21 — Security) separately from other guest data, and is retained for no longer than 12 months after the travel date, unless a longer period is required by applicable law, airline, or immigration retention rules, after which it is deleted (see Section 20 — Data Retention).

9. Conversation & Message Data

We store the full conversation history between guests and the WhatsApp assistant, including messages sent by the AI and messages sent directly by hotel staff who have taken over a conversation. Stored data includes message text, timestamps, delivery status, media attachments, message reactions, and sender role.

10. Service Requests & Tickets

We store service request data including ticket title, description, category, intent, status history, assigned department, associated items, and timestamps to enable hotel operations and staff coordination.

11. AI Usage Data

We collect AI usage metrics such as model name, request type, token consumption, and invoked functions for billing, monitoring, and optimization purposes. This data is retained for up to 12 months for billing verification.

12. AI Processing Transparency

AI responses are generated using Google Gemini. We do not use guest or hotel data to train, fine-tune, or improve any AI models. Data is processed solely for generating responses within the Service. This is contractually enforced with our AI provider.

13. Location Information

Hotel Partners may provide geographic coordinates to enable map and attraction features. We do not collect real-time location data from guest devices.

14. Device & Technical Data

We may collect device, browser, IP address, and session-related data when hotel staff access the dashboard. This is used for security, analytics, and service improvement purposes.

15. Cookies & Tracking

We use strictly necessary cookies to maintain authenticated sessions for hotel staff accessing the dashboard. These cookies are essential for the platform to function correctly and are not used to track users outside of the Service. We do not use advertising or remarketing cookies.

16. How We Use Your Information

We use collected data to operate the platform, generate AI responses, manage service requests, facilitate flight bookings where enabled, enable staff dashboards, process billing, improve performance, and ensure system security.

17. Service Providers

We use third-party providers to deliver parts of the Service. These providers process data only as necessary and under strict confidentiality obligations.

Current providers include: WhatsApp Business API via Meta Platforms, Inc., Google Gemini for AI processing, Firebase by Google for authentication, Stripe for billing and payment processing, Duffel for flight search and booking fulfillment (where the Flight Booking Service is used), and Hetzner for infrastructure hosting.

18. Data Sharing & Disclosure

We do not sell or rent personal data. Data is shared only with service providers listed above, the respective Hotel Partner for their own guest data, the operating airline and relevant immigration or border authorities where necessary to complete and legally support a flight booking, or when required by applicable law.

19. International Data Transfers

Data may be processed in countries outside your own, including the United States and Germany. Where the Flight Booking Service is used for international travel, Advance Passenger Information is additionally transmitted to the operating airline and the relevant destination-country immigration authorities, as legally required to complete the booking. We ensure appropriate safeguards are in place to protect personal data in accordance with applicable laws.

20. Data Retention

Hotel data, guest records, conversation history, and tickets are retained while the account is active. This is not an indefinite or unbounded retention period — it is tied to the specific purpose for which the data was collected: enabling the Service to recognize returning guests and personalize future interactions based on their history and preferences. Retention ends when that purpose ends, at account termination (see below).

Upon account termination, all associated guest records, messages, tickets, and linked data are permanently deleted in cascade. Hotel Partners may also request deletion or anonymization at any time; requests are processed within 30 days, subject to legal or regulatory obligations.

AI usage logs are retained for up to 12 months for billing verification purposes.

Passport-level data collected for international flight bookings is retained for no longer than 12 months after the travel date, unless a longer period is required by applicable law, airline, or immigration retention rules, and is deleted thereafter.

21. Security

We protect personal data through:

Passport numbers, dates of birth, and other flight-booking data of heightened sensitivity receive additional field-level encryption, independent of general database storage encryption.

Despite these measures, no system is completely secure and we cannot guarantee absolute security. In the event of a personal data breach, we will notify affected Hotel Partners without undue delay and, where feasible, within 72 hours of becoming aware.

22. Data Subject Rights

Hotel Partners can delete an individual guest's data directly from the Guests screen, or delete their entire account, including all associated guest records, via the "Delete Account" option in the app menu. Hotel Partners may also request access, correction, or deletion by contacting us at contact@chatotelle.com.

Guests wishing to exercise rights over their personal data should contact the Hotel Partner directly, as the data controller for guest data. Hotel Partners may contact us at contact@chatotelle.com to facilitate such requests. We will respond within 30 days.

23. Children's Privacy

CHATOTELLE LLC is a business-to-business service intended for hotel professionals. We do not knowingly collect personal data from individuals under the age of 13. If you believe a minor has provided data through the Service, contact us at contact@chatotelle.com and we will delete it promptly.

24. Changes to This Privacy Policy

We may update this Privacy Policy periodically. The date at the top reflects the most recent revision. Continued use of the Service following an update constitutes acceptance of the revised policy.

25. Contact Us

If you have any questions regarding this Privacy Policy, please contact us at contact@chatotelle.com or visit Chatotelle.com.