Privacy Policy

1. Information about the Controller

1.1. The controller of personal data (hereinafter referred to as “we,” “us,” “GuestReply AI,” or the “Company”) is:

GuestReply LLC

• Legal form: a company registered in the State of Delaware (USA)
• EIN (Tax ID): 994905314
• Address: 1401 Pennsylvania Avenue, Wilmington, DE 19806, USA
• Country/Jurisdiction of registration: United States

1.2. All questions, requests, or comments regarding this Privacy Policy and the processing of personal data should be directed to the following email address: support@guestreply.ai

1.3. GuestReply AI provides services for automating guest communication and managing short-term rentals, using integrations with PMS systems and tools supporting reservation management. Our clients may also include residents of the European Union (EU) or the European Economic Area (EEA), which requires compliance with additional GDPR regulations.

2. Scope and Purpose of this Policy

2.1. This Privacy Policy sets out how we collect, store, and process personal data (hereinafter referred to as “Personal Data”) of users (hereinafter “you” or “Users”) in connection with:

• Our website, e.g., https://guestreply.ai, and its subdomains,
• Our applications (if any – mobile or desktop),
• Integrations with third-party Property Management Systems (PMS),
• Any other services described on our website.

It also covers people we email about our services (section 15).

2.2. The processing of data is necessary for providing our services, including automating guest communication, optimizing reservations, and managing short-term rentals.

3. Data We Collect

3.1. Identification and Contact Data

• Full name – used to identify the User or the person representing a company,
• Company name – if you use our services in a business context,
• Email address, phone number – for service-related communication, technical support, billing, etc.,
• Billing information (e.g., NIP/EIN, business address) – required for invoicing and financial settlements. Card payments are handled by our payment processor, Stripe: a valid payment method is needed to start the 30-day free trial, we do not store full card numbers (only the card brand and last four digits), and refunds are made through Stripe to the original payment method.

3.2. Data Collected in the Course of Service Provision

• Property data – information such as property name, number of rooms, location, if necessary for rental management,
• Data from PMS (Property Management Systems) – details on reservations, guests, and booking history, which are essential for automating communication and delivering our services,
• Communication records (e.g., email correspondence, chat) – needed to ensure efficient support and service operation.

3.3. Technical and Analytical Data

• IP address, device type, browser – automatically collected to ensure security and the proper functioning of our services,
• Cookies and similar tracking technologies – used for traffic analysis, saving user preferences, and improving user experience (see section 11 for details).

3.4. Data Sources

• Registration or contact forms filled out by the User,
• Publicly available sources (e.g., company registers) if we need to verify data,
• For people we email before they're customers, see section 15.2,
• No external login: we do not allow logging in via Google, Facebook, or similar services.

4. Purposes of Data Processing

We process personal data to:

• Automate guest communication – providing 24/7 AI-assisted responses,
• Manage short-term rentals – integrating with PMS, syncing bookings, increasing occupancy,
• Provide technical support – responding to inquiries, helping with setup,
• Analyze and develop services – improving our tools, creating statistics, enhancing functionality,
• Conduct marketing activities (if applicable) – informing about new features and offers, sending newsletters (if consent is required),
• Ensure security – detecting and preventing misuse.

5. Legal Basis for Processing

This depends on the User’s place of residence and the nature of the processed data:

• Users in the USA – we follow federal and state regulations (e.g., in the State of Delaware).
• Users in the EU/EEA – we comply with GDPR, specifically:
  • Necessity for performance of a contract (Article 6(1)(b) GDPR),
  • Consent (Article 6(1)(a) GDPR) – e.g., for sending newsletters,
  • Legitimate interest (Article 6(1)(f) GDPR) – analytics, direct marketing, ensuring security,
  • Legal obligation (Article 6(1)(c) GDPR) – e.g., retaining accounting documents.
• People we email about our services – legitimate interests, or consent where the law needs it (section 15.3).

If we serve California residents (CCPA) and meet relevant thresholds, we comply with CCPA provisions regarding information and data deletion rights.

6. Sharing Data with Third Parties

We may share personal data with:

1. Service Providers (Processors)
   • Hosting companies, cloud providers,
   • Payment and accounting systems,
   • Analytical tools: Google Analytics, used in the GuestReply AI app (app.guestreply.ai). The website itself doesn't use it. It counts page views without cookies instead (section 11.4),
   • PMS systems for integration.
2. Public Authorities – when required by law or when official authorities request information based on their legal powers.
3. Potential Buyers or Investors – in case of asset sales, acquisitions, or mergers, always subject to adequate privacy safeguards.

We aim to enter into appropriate Data Processing Agreements or any other documents required by law with all such parties to ensure a suitable level of protection and security.

For the providers that handle prospect data, see section 15.4.

7. International Data Transfer

Since GuestReply LLC is based in the United States, personal data may be transferred outside the EU/EEA. In such cases:

• We rely on Standard Contractual Clauses (SCC) approved by the European Commission, the EU-US Data Privacy Framework, or another mechanism the law allows. Where a provider hasn't named its safeguard, we say so below.
• For the providers that handle prospect data (section 15.4): Google and Salesforce are certified under the EU-US Data Privacy Framework and its UK extension. Google, Salesforce, Composio and Anthropic also sign Standard Contractual Clauses. MillionVerifier hasn't named the safeguard for its US providers.
• We commit to applying additional safeguards (e.g., encryption, pseudonymization) if required by EU law.

If you wish to obtain a copy of the safeguards in place (such as SCC), please contact us at support@guestreply.ai.

8. Data Retention Period

We only store data for as long as necessary to achieve the purposes described above:

• Account and registration data – until the account is deleted or the cooperation ends,
• Accounting and billing documents – in line with legal requirements (e.g., U.S. or EU tax regulations),
• Technical data and logs – for the period necessary to analyze incidents and ensure security,
• Prospect data – see section 15.5.

After the retention period ends, the data is irreversibly deleted or anonymized, making it impossible to retrieve. Copies in our backups are gone within 4 weeks. One exception is our do-not-contact list. If you opt out of our sales emails, or ask us to delete the data we hold about you as a prospect, we keep only your address (or a sole trader's domain), the reason and the date, for as long as we send sales email, so we never email you again (section 15.5).

9. User Rights

9.1. Users in the EU/EEA and the UK (GDPR and UK GDPR)

• Right of access – request information on whether we process your data and obtain a copy of such data,
• Right to rectification – if your data is outdated or incorrect,
• Right to erasure (right to be forgotten) – in specific circumstances,
• Right to restrict processing – e.g., if you contest the accuracy of your data,
• Right to data portability – if processing is based on consent or contract,
• Right to object – if processing is based on legitimate interests. You can object to direct marketing at any time, free and without giving a reason (section 15.6),
• Right to withdraw consent – if processing is based on consent (this does not affect the lawfulness of processing before withdrawal),
• Right to lodge a complaint (Article 77 GDPR) – with the data protection authority where you live, work or the problem happened, or with the UK's ICO. You can also contact UODO, the Polish data protection office, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.

9.2. Users in California (CCPA), if applicable

• Right to know – the types of data we process,
• Right to delete – in specific circumstances,
• Right to opt-out of data sales (if applicable),
• Right to non-discrimination – for exercising these rights.

9.3. Other Jurisdictions

We comply with local (federal/state) laws in the United States regarding privacy rights.

To exercise any of the above rights, please contact us at support@guestreply.ai.

10. Data Security

We have implemented appropriate technical and organizational measures to protect your data against unauthorized access, disclosure, alteration, or destruction, including:

• SSL/TLS encryption for data transmission,
• Securing servers (firewalls, passwords, restricted access),
• Regular backups,
• Security audits and testing.

Despite these measures, please note that no method of transmitting data over the Internet is 100% secure, and there is always some level of risk.

11. Cookies and Tracking Technologies

11.1. Our website (www.guestreply.ai) sets two cookies of its own. It uses no third-party analytics, advertising or tracking cookies.

• gr_consent (strictly necessary): remembers your cookie choice, so we don’t ask again. It is kept for 180 days and is used by this website only.
• gr_touch (campaign attribution): records the first and the latest link or campaign that brought you to our website: the campaign tags in that link (such as “ref” and “utm_source”), the page you landed on, the website you came from, and when. It is kept for 90 days. It is shared with app.guestreply.ai, so that if you sign up for GuestReply AI we know which campaign brought you. When you sign up, or leave your details in our chat, this information is stored with your account or enquiry. We use it only to learn which of our campaigns and posts work.

11.2. If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, or we can’t tell where you are, we set gr_touch only after you click Accept in the cookie banner. If you click Reject, we set no gr_touch and delete any existing one immediately. Elsewhere we set gr_touch without asking. If your browser sends a Global Privacy Control signal, we never set gr_touch, wherever you are and whatever you chose before, and we delete any existing one; Accept is then unavailable in the cookie banner.

11.3. To decide whether to show the cookie banner, our server looks up the country of your IP address in a database held in its memory. The address and the country are used only for that decision. This check doesn’t store or log your address or your country, or put either in a cookie; like any website, our hosting provider’s request logs record IP addresses (see section 3.3). IP Geolocation by DB-IP, licensed under Creative Commons Attribution 4.0.

11.4. Our server also counts page views, without any cookie. Each day it adds up the views of each page, grouped by whether the visit looks like a person or a robot (a search engine or AI crawler, say) and by where it came from: a search engine, an AI assistant, another website, a campaign tag in the link, or a direct visit. We store only those totals. We don't store IP addresses, browser details or any other identifier, so the counts can't be traced to a person. We use them to see which pages and sources work.

11.5. The GuestReply AI chat keeps your conversation in your browser tab while the tab is open, and remembers in that tab that you closed its invitation. This is needed for the chat to work and ends when you close the tab.

11.6. You can change your choice at any time with “Cookie settings” at the bottom of every page. You can also delete cookies in your browser settings.

12. Minors

• Our services are not directed at individuals under 18 years of age,
• We do not knowingly collect data from minors; if you suspect that we have such data, please contact us so we can delete it.

13. Changes to this Privacy Policy

13.1. We reserve the right to modify this Privacy Policy to reflect changes in our practices or legal requirements.

13.2. We will inform Users of any significant changes via a notice on our website and/or an email notification (if we have your email address).

13.3. We encourage Users to periodically review the current version of this Privacy Policy.

14. Contact

If you have any questions, concerns, or requests regarding your personal data, please contact:

GuestReply LLC
1401 Pennsylvania Avenue, Wilmington, DE 19806, USA
Email: support@guestreply.ai

15. People we email about GuestReply AI

This covers people at rental businesses who get a sales email from Anna, GuestReply AI (anna@guestreply.me).

15.1. Who we are

GuestReply LLC is the controller. Contact us at support@guestreply.ai or reply to any of our emails. We have no data protection officer.

15.2. Where we got your details

From your company's website or a public listing, from your company's email format (checked with MillionVerifier), or because you agreed to hear from us. Each email says which.

15.3. What we keep and why

Your name, role, work email, country, time zone, company details, how we found you, our emails, your replies and any opt-out.

We use them to offer GuestReply AI to your business. That's our legitimate interest in finding customers (GDPR Art. 6(1)(f)). If you agreed to hear from us, we rely on that consent instead, and you can withdraw it at any time. In countries that need consent first, we email only people who've agreed.

15.4. Who handles it

• Google Workspace runs our email.
• Heroku (Salesforce) hosts our contact database in the EU, with backups in the US.
• MillionVerifier, in Hungary, checks addresses exist, using providers in the US, Canada and the UK.
• Mailreach, in France, warms up our sending mailbox and can read its emails, including your replies.
• Composio connects our tools to our guestreply.ai mailboxes, if you write to us there.
• Anthropic's Claude helps us research companies and draft emails.

Google, Salesforce, Composio and Anthropic are in the US, as is GuestReply LLC. Google and Salesforce are certified under the EU-US Data Privacy Framework and its UK extension. All four also sign Standard Contractual Clauses. MillionVerifier hasn't named the safeguard for its US providers. Write to us for a copy of the safeguards.

15.5. How long we keep it

If you never reply, 24 months from when we found you. If you reply but don't buy, 3 years from your last message. If we don't email you within 30 days of finding your details, we delete them, unless you agreed to hear from us. Then we keep your details until you withdraw your consent, or 24 months if we never email you. The same periods apply to the copies in our mailboxes.

If you opt out or ask us to delete your data, we keep only your address (or a sole trader's domain), the reason and the date, for as long as we send sales email. Deleted data leaves our backups within 4 weeks.

15.6. Your right to object

Use the unsubscribe link or reply "stop" at any time, free and without a reason. Either one stops our emails straight away, and we add you to our do-not-contact list within 2 working days. Any other reply, except an out-of-office, also ends our emails and reaches a person.

15.7. Your other rights

You can ask to see, correct, delete or move your data, limit its use, or object to it, at support@guestreply.ai. You can complain to the data protection authority where you live, work or the problem happened, or to the UK's ICO. You can also contact UODO, the Polish data protection office, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl.

Summary

This policy explains how GuestReply LLC handles personal data. Section 15 covers people we email before they're customers. If you want us to delete your data, contact us at support@guestreply.ai and we will, apart from what the law requires us to keep and our do-not-contact entry (section 15.5).