Guest data belongs to the hotel. We only keep it safe.

Xplai is operated by a company registered in the European Union. We process personal data under GDPR rules.

How we protect data

Storage in the EU

Data is stored on servers in the European Union. The specific data center is stated in the contract.

Encryption

Data is encrypted in transit and at rest. Only a limited group of engineers has access to the servers.

Roles and access

The hotel admin decides who sees what. Every data action is recorded in the log.

Guest data deletion

At the request of the guest or hotel, we delete their conversation and card. You set the automatic deletion period after check-out.

AI and your data

Guest conversations are not used to train general models. The hotel's knowledge is used only to answer guests of that hotel.

Access only during the stay

Via the QR in the room, the guest has access only while staying at the hotel. After check-out, access closes automatically.

Who sees what

Access is set up by the hotel administrator. Each employee sees only what they need for their job.

Administrator

All conversations, guests and tasksSettings, knowledge base, accessData export and deletion

Shift manager

Conversations and guest profilesReply approvalTasks from all departments Access settings and data deletion

Department staff member

Only own department's tasksRoom number and the request Guest conversations and contacts

GDPR and guest rights

Who is the data controller?

The hotel. Xplai acts as a data processor and acts only on the hotel's instructions.

Is there a data processing agreement?

Yes, we sign a data processing agreement (DPA) with every hotel.

How does the guest learn about data processing?

With the first message the guest receives a short notice and a link to the hotel's privacy policy.

Can a guest get or delete their data?

Yes. The request goes to the hotel, and the administrator exports or deletes the guest's data in the panel.

Is data transferred outside the EU?

Only if the connected channel requires it, for example WhatsApp. In that case Meta's terms and the EU standard contractual clauses apply.

Data questions: hello@xplai.eu Privacy policy

We'll show Xplai using your hotel as an example

30 minutes, free and with no obligation.

Book a free demo