Privacy Policy

Hello.ai is a guest messaging platform for hotels, operated by Insights.AI (Private) Limited, No. 205/D/1, Kalapaluwawa Road, Koswatta, Battaramulla 10120, Sri Lanka ("Insights.ai", "we", "us").

Hello.ai lets hotels talk with their guests on WhatsApp and other channels. It answers guest questions with AI, takes requests such as room service and housekeeping, passes them to hotel staff, and sends updates and offers the hotel has chosen to send.

This policy explains how we handle personal information when:

• a guest messages a hotel that uses Hello.ai;
• a hotel, its staff or its representatives use the Hello.ai dashboard, staff app or onboarding tools, including connecting a WhatsApp Business Account through Meta;
• anyone visits hello-ai.app or contacts us.

For guest data, the hotel is in charge and we act on its instructions. When you message a hotel that uses Hello.ai, that hotel decides why and how your information is used; it is the data controller. Insights.ai processes your information on the hotel's behalf, under a contract with the hotel, as its data processor. The hotel's own privacy notice also applies, and you can contact the hotel directly about your data.

For our own business data, we are in charge. Insights.ai is the data controller for information about our hotel customers' staff and representatives, people who visit hello-ai.app or contact us, and the operation and security of our service.

We use guest information only to provide the hotel's guest service and as the hotel instructs:

• answer your questions about the hotel and its services;
• take your requests and orders and pass them to the right hotel staff;
• send you messages you expect, such as a welcome message, updates on your requests and a feedback request after your stay;
• send offers or promotions from the hotel, only where the hotel has a lawful basis and you have not opted out;
• keep a record of conversations so hotel staff can follow up and resolve issues;
• produce reports for the hotel about service levels and requests.

We use information about hotel staff and website visitors to run and secure our service, support our customers, bill them, and respond to enquiries.

AI processing. Hello.ai uses large language models, hosted through Microsoft Azure AI services, to understand guest messages and draft replies based on information the hotel provides. Azure's content filters screen for harmful content. Hotel staff can see every conversation and take over at any time. AI replies are not used to make decisions that have legal or similarly significant effects on you.

We do not sell personal information, and we do not use guest conversations to advertise our own services.

To stop receiving messages, tell the hotel in the chat or contact us.

We share personal information only with the hotel you are staying at and with the service providers below, who process it for us under contract and only to run Hello.ai.

We may also disclose information if the law requires it, to protect people's safety, or as part of a merger or sale of our business, in which case this policy continues to apply.

Insights.ai is based in Sri Lanka, and our service providers process data in other countries, including the United States and the Azure regions where Hello.ai is hosted. When personal information moves across borders, we rely on contracts with our providers that require them to protect it, such as standard contractual clauses where the GDPR applies, and on the transfer rules in Sri Lanka's Personal Data Protection Act.

We keep information only as long as needed for the purposes above, or as the hotel instructs.

When a hotel's contract ends, we delete or return its guests' data within 90 days, unless the law requires us to keep it.

We encrypt data in transit (TLS) and at rest, host Hello.ai on Microsoft Azure, limit access to staff who need it, and give each hotel role access only to what it needs. No system is completely secure; if a breach affects your personal information, we will notify the hotel and, where the law requires, the authorities and you.

Depending on where you live, including under Sri Lanka's Personal Data Protection Act and the EU and UK GDPR, you can ask to:

• access the personal information held about you;
• correct information that is wrong;
• delete your information;
• object to or restrict how it is used, including for marketing;
• receive your information in a portable format;
• withdraw consent you have given.

If you are a hotel guest, the hotel decides on these requests; you can ask the hotel or us, and we will pass your request to the hotel and help it respond. We reply to requests sent to us within 30 days. You can also complain to your local data protection authority; in Sri Lanka, that is the Data Protection Authority of Sri Lanka.

To ask for your Hello.ai data to be deleted:

1. Email privacy@hello-ai.app with the subject "Delete my data".
2. Include the phone number you used on WhatsApp and the hotel you contacted.
3. We will confirm your identity, delete your data or pass the request to the hotel within 30 days, and tell you when it is done.

Hotels can ask us to delete a guest's conversation history.

Hello.ai is not aimed at children. Hotels should not use it to send marketing to people under 18, and we do not knowingly collect children's information except as part of a family's stay arranged by an adult.

We may update this policy. We will post the new version on this page with its effective date, and tell hotel customers about significant changes in advance.

Insights.AI (Private) Limited, No. 205/D/1, Kalapaluwawa Road, Koswatta, Battaramulla 10120, Sri Lanka

Email: privacy@hello-ai.app · Phone: +94 77 260 8766