Privacy Policy
Reference translation. The French version is binding.
1. Who processes your data
Margaux Dubois
Sole trader (micro-entreprise)
Registered office: 14 avenue José Maria de Heredia, 44300 Nantes, France
SIREN: 100 741 917
Registered activity: online sale of digital services by subscription to businesses
Email: info@ai-host-mind.com
Website: ai-host-mind.com
Contact for any question relating to personal data: info@ai-host-mind.com
2. Two distinct roles
HostMind AI acts in two different capacities, which are not subject to the same obligations.
For customer establishment data — account creation, subscription management, invoicing, support — HostMind AI acts as controller.
For guest data exchanged with the assistant, the hotel establishment is the controller. HostMind AI acts as processor, on the establishment's instructions. Guests wishing to exercise their rights should contact the establishment concerned in the first instance.
3. Customer establishment data
### Data processed
- Professional identity and contact details: surname, first name, email address, name of the establishment - Account data: credentials, connection logs - Invoicing data: plan subscribed, payment history. Bank card data is processed directly by Stripe and does not pass through our systems - Content entered in the application: description of the establishment, services, practical information - Exchanges with support - Demonstration requests and waiting-list registrations: surname, first name, email address, name and location of the establishment, number of rooms, plan of interest and free-text message
### Purposes and legal bases
- Provision of the service and account management — performance of the contract - Invoicing and recovery — performance of the contract and legal obligation - Support and service-related communications — performance of the contract - Security of the service and prevention of abuse — legitimate interest - Business-to-business marketing — legitimate interest, with a right to object at any time
### Retention periods
- Account data: for the term of the subscription, then thirty (30) days - Accounting documents and invoices: ten (10) years, in accordance with legal obligations - Prospects who have not subscribed: three (3) years from the last contact - Rate-limiting technical logs (containing IP addresses): 24 hours - Host application logs: retained by the host in accordance with its own retention policy
4. Guest data
When a guest interacts with the assistant, the following data is processed on behalf of the hotel establishment:
- The content of the messages exchanged - A technical conversation identifier and its timestamp - The connection IP address, used solely for rate limiting and prevention of abuse
No account is created and no authentication is required of the guest. Except where the establishment has enabled booking requests (see below), the assistant requests neither name, nor contact details, nor payment data.
When the establishment enables booking requests, HostMind AI processes, on the establishment's behalf, the information the guest provides in the request (name, room number, date and time, number of people, comment, language). It is sent to the establishment by email and in its administration area, then deleted according to the conversation retention period chosen by the establishment.
Guests are asked not to communicate any personal or sensitive information in their messages. Information they nevertheless choose to communicate is processed under the conditions described in this policy.
### Retention period
Conversations are retained for the period chosen by the establishment, within the ceiling attached to its plan: thirty (30) days for the Essential plan, twelve (12) months for the Signature plan. They are then deleted automatically.
The establishment may at any time delete a conversation or the entire history from its administration area.
5. Recipients and processors
Data is neither sold, nor rented, nor disclosed to third parties for advertising purposes. It is accessible only to the technical providers necessary for the operation of the service:
- Lovable Labs AB (Sweden) — hosting of the application and the database, Amazon Web Services infrastructure located in Ireland (European Union) - Google, through Lovable's artificial intelligence gateway — generation of the assistant's answers - Stripe — payment processing and invoicing - Email providers: Supabase (SUPABASE PTE. LTD., Singapore) — sending of authentication emails to customer establishments (sign-up confirmation, password reset). Lovable Labs AB (Sweden) — sending of internal summary emails and of booking-request notifications to establishments, already cited above in respect of hosting
Each of these providers acts as a sub-processor and is bound by contractual commitments compliant with the General Data Protection Regulation.
6. Transfers outside the European Union
The service database is hosted in Ireland, within the European Union.
However, messages exchanged with the assistant are transmitted to an artificial intelligence model provider whose processing region is not guaranteed to be within the European Union. Such transfers, where they occur, are governed by the standard contractual clauses adopted by the European Commission.
7. Security
Data is hosted within the European Union, exchanges are encrypted in transit, and access to each establishment's data is partitioned by security rules applied at database level.
Access to production data is limited to those persons who need it to operate the service.
8. Your rights
In accordance with the General Data Protection Regulation, you have a right of access, rectification, erasure, restriction, objection and portability.
For customer establishment data, these rights are exercised with info@ai-host-mind.com.
For data exchanged with the assistant, the request must be addressed to the hotel establishment concerned, which is the controller. HostMind AI provides it with assistance.
You may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75334 Paris Cedex 07, www.cnil.fr.
9. Cookies and trackers
The service uses no cookies and no advertising tracker or third-party tracking tool. The following information is stored locally in the browser, solely for the purpose of operating the service: maintenance of the authentication session for customer establishments, display preferences (theme, language), the selected establishment, and, where the user expressly consents, an approximate location used solely to adapt the display.
This information is not transmitted to any third party. Aggregate audience measurement is carried out on the public pages of the website. It sets no cookie, does not allow visitors to be identified and creates no profile. It therefore falls within the consent exemption provided for audience measurement.
10. Amendment of this policy
This policy may be amended. The applicable version is the one published on the website on the date of consultation. Substantial amendments are notified to customer establishments.