GreetScribe Privacy Policy
Version: 2.2
Updated: 2026-11-05
Operator: Qevinto Oy
This notice covers GreetScribe guest assistance, the public website and demo, customer accounts, and Qevinto's own administration and product development. It applies when published and does not retrospectively change an accepted customer contract.
1. Who is responsible
Qevinto Oy, Business ID 3583823-3, Sarkakatu 3 F23, 96460 Rovaniemi, Finland. Privacy and support contact: contact@qevinto.com.
| Processing | Responsible party and role |
|---|---|
| A customer's guest chat, booking assistance, customer knowledge content and customer-requested conversation records | The hospitality customer is the controller. Qevinto processes the data on that customer's documented instructions under the Data Protection Addendum. |
| Qevinto's website enquiries, public demo, website advertising measurement, business contacts, account administration, invoicing and its own security and legal records | Qevinto is the controller. |
| Qevinto's independent development of GreetScribe using identifiable guest information | Qevinto is a separate controller for that development activity, subject to section 4. This is distinct from processing on the customer's instructions. |
| A customer's booking engine, payment checkout or other independently operated system | The customer and relevant provider explain their own processing in their notices. |
Providing the software or using the same information does not by itself make Qevinto and the customer joint controllers. These standard arrangements do not establish joint controllership.
For a chat on a hospitality business's website, that business's privacy notice explains its purposes and legal basis. Requests may be sent to that business or to Qevinto for routing and assistance.
2. Information handled
Guest information can include messages, replies, source references, conversation events, session identifiers, selected accommodation or activities, travel dates, occupancy counts and other values entered into a configured flow. A contact-request feature can collect a name and an email address or telephone number when the guest supplies them. Features and collected fields depend on the customer's enabled flow.
Information comes from the guest, the Customer and its authorised users, the Customer-selected integrations, and technical events generated during use. Qevinto obtains development excerpts from these service conversations or from material supplied by the Customer, subject to section 4.
Free-text messages and uploaded customer knowledge can themselves contain personal data. Do not enter passwords, API keys, payment-card details, health information or other sensitive information. GreetScribe does not require payment-card details or precise GPS location for its guest-assistance service.
Customer and staff information includes names, email addresses, organisation membership, permissions, authentication and session records, support correspondence, billing contacts and customer integration configuration. Authentication records can include password hashes, passkey credentials, multifactor-authentication material, and IP/device information; these are not guest booking-payment records.
Website forms send the fields you submit, including contact details, business information and your message, to Qevinto by email. Technical processing includes request IP addresses, browser and session information, rate-limit data, usage counts, security/audit events and operational diagnostics.
3. Purposes and legal bases
| Qevinto's controller activity | Purpose and basis |
|---|---|
| Business enquiries and account/contact administration | Responding to requests and operating the business relationship: legitimate interests in managing that relationship; Article 6(1)(b) where the individual is themselves the contracting party or requests pre-contract steps. |
| Public demo | Providing the requested demonstration and protecting it against misuse: legitimate interests in demonstrating and securing GreetScribe. The chat on the demo page is the real GreetScribe software running on demo data in Qevinto's own demonstration account. Opening the demo page starts a chat session with the production guest runtime; chat text typed there, including any name or contact detail entered, is sent to the production guest runtime and can be sent to the AI services described in sections 5 and 6 (answer generation and embedding-based retrieval). Qevinto is the controller for this demo processing. If the chat cannot be loaded, the page says so. The example conversation on the home page is a pre-recorded playback and sends no chat text. Do not enter real guest information or other personal data into the demo. The widget and its chat are loaded from app.greetscribe.fi (Qevinto's application hosting, section 6); ordinary website requests reach the website's hosting service. |
| Website advertising measurement (Google Ads) | Measuring which ads bring visitors to the website and reaching earlier visitors with ads: your consent under Article 6(1)(a), which you can withdraw at any time. See section 8. |
| Invoicing and accounting | Contract performance where applicable; compliance with statutory accounting/tax obligations for records the law requires. |
| Security, abuse prevention and necessary legal claims | Legitimate interests in protecting users, systems and confidential information and establishing or defending claims; a legal obligation where a specific law requires processing. |
| Privacy requests | Compliance with data-protection obligations. |
| Independent product development | Only development of GreetScribe, subject to the separate lawful-basis and minimisation requirements in section 4. Neither a customer's signature nor acceptance of this notice is a guest's consent. |
For customer-directed guest processing, the customer determines and communicates the lawful basis. Qevinto's authority as processor is the customer's documented instructions, not Qevinto's own legitimate interest in product development.
You may object to processing based on legitimate interests. Qevinto assesses an objection and stops that processing unless the conditions for continuing under applicable law are met.
4. Development of GreetScribe
Qevinto's development activities concern response quality, defect investigation, software, prompts and knowledge content. The development material includes selected original conversations and anonymised findings. It is not used for advertising, sale of guest data, development of unrelated products, or training or fine-tuning AI model weights.
Identifiable guest information must not be reused for independent development solely under a processor instruction or a general Customer Content licence. Before such reuse, Qevinto must establish and document an applicable lawful basis, assess necessity and the guests' reasonable expectations, provide the required information, and make the applicable rights effective. These terms do not themselves establish that assessment or authorise unrestricted reuse.
The development rules require minimum necessary excerpts, access limited to authorised Qevinto personnel with a specific task and confidentiality duties, and removal of unnecessary identifying and sensitive information. Identifiable development copies must be deleted when the task ends and no later than 30 days after the source information was collected, unless a separately documented legal obligation requires retention. Copying or exporting a conversation must not restart that period.
Only material assessed as genuinely anonymous may become a long-term, shared development or knowledge resource. Removing an email address or replacing an identifier alone does not establish anonymity. Original conversations must not be pasted into external AI or development services unless the recipient, purpose, contract, transfer safeguards and lawful basis have first been approved and disclosed.
These are limits on development processing. The service's automated retention sweep does not automatically erase separate development copies.
5. AI processing
GreetScribe combines deterministic conversation paths, knowledge retrieval and AI-assisted answers. Its standard AI provider is Scaleway Generative APIs.
For the inspected guest-answer path, the request contains the system instructions, the current guest question and selected knowledge excerpts. It does not automatically attach the full conversation history or dedicated guest contact fields. Nevertheless, names, contact details or other personal information typed into the question or present in knowledge content can be transmitted.
Optional embedding-based retrieval sends the text being embedded, such as a query or knowledge excerpt, to its configured embedding service. Staff AI-authoring functions can send the staff prompt and relevant authoring context. These are separate from the guest-answer request.
See the AI Use Policy for provider retention and the distinction between inference and model training. A technical option to configure another endpoint does not mean that endpoint is an active recipient.
6. Recipients and international processing
Core hosting and PostgreSQL database services are provided by UpCloud. Scaleway provides AI inference, secret/key management and transactional email. The Subprocessor List distinguishes customer-data subprocessors, business/operational services and customer-controlled integrations.
The recorded core database deployment is in Helsinki, Finland. The configured Scaleway services involve France and the Netherlands. This is not a representation that all Qevinto information, support processing or every provider's subprocessing stays in Finland.
Qevinto's enquiry/support mail systems, professional advisers, legally required authorities and authorised operational service providers can receive information relevant to their functions. Customer-selected integrations have their own recipients and locations. Google receives website visit information only if you accept marketing cookies (section 8).
Before a transfer outside the EEA that requires a Chapter V safeguard, Qevinto must establish an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses and any necessary supplementary measures. EU hosting alone does not prove the absence of international transfers. Contact Qevinto for information about the safeguards applicable to your data.
7. Retention
| Information | Retention or deletion criterion |
|---|---|
| Ordinary guest transcripts, session records and guest-contact request/outbox data | The implemented default retention clock is 30 days from creation. Expired eligible records are processed by a scheduled daily purge; deletion is not an exact real-time deadline. |
| Public demo conversations on the demo page | The conversation, its session identifier and any contact details entered follow the ordinary guest-record rules above: by default 30 days from creation and the daily purge. To limit use, the service counts requests for AI-generated answers per chat session and per IP address for each UTC day. Each counter is stored under the session identifier or the IP address and expires automatically no later than two days after the last counted request. |
| Records with an explicit retention instruction or a preservation restriction | The record's applicable instruction controls. A transcript excluded from automatic deletion has no automatic expiry unless separately configured. Any continued retention must be justified, reviewed and ended when that justification expires. |
| Separate identifiable development copies | The policy deadline in section 4 applies. These copies are outside the ordinary automatic sweep. |
| Genuinely anonymous development findings | May be kept while useful; material that remains reasonably linkable to a person is still personal data. |
| Customer/staff accounts and membership information | While required for the account and business relationship, followed by necessary legal, security or dispute retention. Closing an account is a separate workflow, not the guest-data purge. |
| Audit events, security records, usage and integration metadata, staff AI-authoring requests | For the relevant security, accountability, operational or legal purpose. The guest-data purge does not impose a universal expiry on these categories. Retention must be assessed by category. |
| Provider/API credentials | While the authorised integration needs them. Revoked or unnecessary credentials must be revoked/deleted through the credential-management process; there is no general permission to keep them for 24 months after termination. |
| Support, enquiries and privacy correspondence | Until the request and any related contractual or legal follow-up are resolved; retain only what is needed for a continuing obligation or claim. |
| Accounting records | For the applicable statutory accounting and tax retention periods. |
| Database backups | Until the configured backup rotation expires. Active-data deletion does not immediately erase existing backup snapshots. Restored data must be subject to the applicable deletion instructions again. |
The 30-day service clock is not a universal period for all personal data. Request the retention information applicable to your particular record through the privacy contact.
8. Browser storage and tracking
The website's only optional tracking technology is the Google tag for Google Ads (tag ID AW-18554265255). Qevinto uses it to measure which ads bring visitors to the website and to reach earlier visitors with ads. It runs only with your consent, given in the website's cookie banner (Article 6(1)(a) GDPR and section 205 of the Finnish Act on Electronic Communications Services). Until you accept, the tag is not loaded and the website sends nothing to Google.
If you accept, your browser sends Google the address and title of each page you view, the address you came from, any ad-click identifier in the page address, a browser identifier stored in the _gcl_au cookie, technical details of your browser and screen, and your IP address. Google Ireland Limited provides the service in the EEA. Google also uses this information for its own purposes and explains that in its privacy policy and its information on how it uses data from websites. Google can process the information outside the EEA, including in the United States, and states that it relies on the EU-US Data Privacy Framework and standard contractual clauses for those transfers. Google can also set and read its own cookies on its own domains, such as google.com and doubleclick.net. The website does not send Google your form entries or chat messages.
You can change your choice or withdraw your consent at any time with the "Cookie settings" button in the website footer. Withdrawing stops the tag and removes the Google Ads cookies and storage listed below from this website. It does not remove cookies on Google's own domains; you can clear those in your browser. The banner asks again after 12 months.
The website does not install Google Analytics, Meta Pixel, TikTok Pixel or LinkedIn Insight Tag.
| Storage | Purpose and lifetime |
|---|---|
sessionStorage: gsLogoAnimated |
Remembers the website's logo animation during the browser tab session. |
sessionStorage: gsPendingAnchor |
Carries an in-site navigation target; removed after navigation is handled or the tab session ends. |
sessionStorage: gsBusinessType |
Remembers the business type chosen on the website (accommodation, activities or both) so the example conversation, the pricing page and the demo-request form follow it; removed when the tab session ends. |
localStorage: greetscribe_application_form |
Restores the enquiry form, including entered contact information. It persists until browser/site storage is cleared; the current form has no automatic expiry. |
localStorage: greetscribe_cookie_consent_v1 |
Remembers your cookie choice, its time and the page language, so the banner does not ask on every page. It is replaced when you change your choice, and the banner asks again after 12 months. |
Cookie _gcl_au, after an ad click also _gcl_aw or a similar _gcl_ cookie, and localStorage: _gcl_ls |
Only after you accept marketing cookies. Google Ads uses them to connect visits and ad clicks to ad measurement. The cookies last 90 days. All of them are removed from this website when you withdraw consent. |
Production widget sessionStorage: greetscribe_widget_state (where that widget is embedded, including this website's demo page) |
Restores guest-chat state within the tab session. Server-side conversation records have their own retention. |
Account session cookies, including better-auth.session_token |
Authenticate staff/customer sessions on the application. Their configured expiry is separate from the marketing website and guest-chat storage. |
Browser storage is not automatically anonymous. You can clear it in your browser; doing so can remove a saved form or chat state but does not erase server records. A customer's own website may install additional storage or trackers governed by its own notice and consent controls. This notice is not consent to optional tracking.
9. Choices, rights and complaints
Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent where consent is the basis. Withdrawal does not affect the lawfulness of earlier processing.
Contact contact@qevinto.com. Identify the relevant hospitality business and session or request where possible; do not send passwords or unnecessary identity documents. Qevinto may verify identity proportionately and assist the customer when it is the controller.
You may complain to the Finnish Data Protection Ombudsman, or another competent supervisory authority, particularly in the Member State of your residence, work or the alleged infringement. You need not contact Qevinto first.
Contact and account fields marked as required are needed to respond, authenticate or administer the requested service. Without them, the relevant function may be unavailable. You do not have to disclose sensitive information to use guest assistance.
10. Automated assistance and security
GreetScribe suggests information and routes guests to customer/provider booking pages. The LLM does not accept or reject bookings or payments. The described service does not make solely automated decisions producing legal or similarly significant effects about a guest.
Tenant-scoped access, backend authorisation, authentication, secret handling, transport protection and abuse controls protect processing. See the Security Statement for the scope and limitations of these measures.
11. Changes and document versions
Qevinto updates this notice when processing changes and provides additional information where the law requires it. New purposes requiring further information or a lawful basis are not authorised merely by changing this page. The previous published wordings (2.1, 2026-10-31, 2.0, 2026-09-20 and 2026-05-17) remain available for historical reference.