# GreetScribe Privacy Policy **Effective date:** 2026-05-17 **Version:** 1.1 **Operator:** Qevinto Oy This Privacy Policy explains how Qevinto Oy handles personal data in connection with GreetScribe. GreetScribe is a website-based chatbot and guest-assistance service for hotels, accommodation providers, hosts, activity providers, and other hospitality companies. This policy describes current processing practices. Some third-party provider regions may vary by account setup, customer configuration, product settings, and vendor terms. --- ## 1. Who we are GreetScribe is operated by: **Qevinto Oy** Business ID: 3583823-3 Sarkakatu 3 F23 96460 Rovaniemi Finland Contact email: contact@qevinto.com Privacy contact email: contact@qevinto.com Qevinto Oy has not appointed a Data Protection Officer. Qevinto Oy is established in Finland. An EU representative is therefore not used. Qevinto Oy has not appointed a UK representative. For guest chat and booking-assistance data, Qevinto Oy and the customer hotel or accommodation provider act as joint controllers according to the current operator position. --- ## 2. What GreetScribe does GreetScribe provides a chatbot and guest-assistance system for hospitality companies. The service may help guests: - ask questions about accommodation, activities, or services; - provide booking-related information; - receive accommodation or activity information; - receive recommendations; - continue to a booking or payment flow operated by the customer or provider. GreetScribe does not collect hotel guest payment card details for accommodation or activity bookings. Guest booking payments are handled outside GreetScribe through the customer’s or provider’s own payment flow. Qevinto Oy may use Stripe for GreetScribe subscription billing. --- ## 3. Current service status GreetScribe is live and may process real guest data. The broader commercial website and public rollout may continue to be updated. --- ## 4. Who the service is for GreetScribe is intended for business customers. Typical customers include: - hotels; - accommodation providers; - hospitality operators; - hosts; - activity providers. GreetScribe is primarily focused on Finland and the EU. The service may also be available to customers or users outside Finland. GreetScribe does not specifically target California consumers at this stage. --- ## 5. Personal data we process ### 5.1 Guest data GreetScribe may process the following guest data: - guest name; - guest email address; - booking dates; - number of adults; - number of children; - selected accommodation; - selected activities; - chat messages; - chat transcripts; - booking and session data. GreetScribe does not intentionally collect the following from hotel guests: - guest phone number; - guest address; - guest payment card data; - precise GPS location. ### 5.2 Business customer and admin data GreetScribe may process the following business customer and admin data: - admin account data; - customer account data; - provider integration metadata; - provider/API secrets; - subscription billing data; - privacy and support request emails. ### 5.3 Technical data GreetScribe may process technical data, including: - cookies; - sessionStorage; - localStorage; - session identifiers; - technical logs; - security-related request data; - IP addresses where needed for security, abuse prevention, rate limiting, or server operation. ### 5.4 Sensitive information GreetScribe does not intentionally request sensitive information such as health data, religious views, political opinions, biometric data, or similar information. Because the service includes free-text chat, users may type sensitive information even though GreetScribe does not request it. ### 5.5 Children-related information GreetScribe is not directed to children. GreetScribe may collect the number of children only for accommodation occupancy or booking-capacity purposes. GreetScribe does not intentionally collect child names, child contact details, or child dates of birth. Third-party provider forms may request their own information outside GreetScribe. --- ## 6. Sources of personal data GreetScribe may receive personal data from: - guests using the chatbot; - business customers and admin users; - customer hotel websites; - browser cookies and storage technologies; - Supabase database services; - provider APIs controlled by customer or provider accounts; - analytics and marketing technologies; - Stripe for Qevinto subscription billing; - OpenAI for chat assistance and recommendations; - Make.com and WhatsApp/Meta for technical error alerts; - Google/Gmail for company email and privacy requests. --- ## 7. Why we process personal data GreetScribe may process personal data for these purposes: - to provide the GreetScribe chatbot; - to answer guest questions; - to collect booking-related details; - to show accommodation and activity options; - to provide recommendations; - to support customer/provider API integrations; - to operate admin and customer accounts; - to provide subscription billing; - to send technical error alerts; - to maintain security and prevent abuse; - to use analytics and marketing tools; - to handle privacy and support requests. The lawful basis for each processing activity may depend on customer configuration, the role of Qevinto Oy and the customer, and the relevant jurisdiction. --- ## 8. Service providers and recipients GreetScribe uses service providers to operate the service. | Provider | Status | Function | Country / region | |---|---:|---|---| | UpCloud | Current | Application and website hosting | Finland | | Supabase | Current | Database | Sweden | | OpenAI | Current | Chat assistance and recommendations | EU or global depending on customer configuration | | Stripe | Current | Qevinto subscription billing | EU/EEA, United States, and other locations depending on Stripe services and account configuration | | Google/Gmail | Current | Company email and privacy requests | EU/EEA, United States, and other locations depending on Google services and account configuration | | Hostinger | Current | Domain hosting | EU/EEA and other locations depending on Hostinger services and account configuration | | Make.com | Current | Technical error alert automation | EU/EEA and other locations depending on Make services and subprocessors | | WhatsApp / Meta | Current | Technical error alerts | EU/EEA, United States, and other locations depending on Meta services and account configuration | | Google Analytics | Current | Analytics | EU/EEA, United States, and other locations depending on Google services and account configuration | | Meta Pixel | Current | Marketing measurement | EU/EEA, United States, and other locations depending on Meta services and account configuration | | TikTok Pixel | Current | Marketing measurement | EU/EEA, United States, Singapore, and other locations depending on TikTok services and account configuration | | LinkedIn Insight Tag | Current | Marketing measurement | EU/EEA, United States, and other locations depending on LinkedIn services and account configuration | | Bokun | Customer-controlled API integration | Activities/provider API | Customer/provider controlled | | Hostaway | Customer-controlled API integration | Accommodation availability and related information | Customer/provider controlled | | Hospitable | Not currently used according to current intake; may exist as customer-controlled integration | Accommodation provider API | Customer/provider controlled if enabled | Some integrations are controlled by the customer or provider. For example, a hotel or hospitality customer may use its own Bokun, Hostaway, Stripe, Hospitable, or similar provider account. --- ## 9. Make.com and WhatsApp technical alerts GreetScribe may send technical error alerts through Make.com and WhatsApp / Meta. These alerts are intended to include only: - technical error information; - correlation ID. These alerts are not intended to include: - guest name; - guest email; - guest phone; - guest chat text; - booking/session data. --- ## 10. International transfers GreetScribe’s primary application hosting is in Finland through UpCloud. GreetScribe’s database hosting is in Sweden through Supabase. Some service providers may process personal data outside Finland or outside the EU/EEA. This may include OpenAI, Stripe, Google/Gmail, Google Analytics, Meta, WhatsApp, TikTok, LinkedIn, Make.com, Hostinger, and customer-controlled provider systems. International processing may depend on: - customer configuration; - vendor account settings; - provider infrastructure; - contractual terms; - service-specific data processing terms; - customer-selected integrations. --- ## 11. Retention Qevinto Oy currently uses a 24-month retention period for retained GreetScribe data categories, unless a longer or shorter period is required by law, contract, accounting requirements, security needs, dispute handling, or deletion request handling. The 24-month retention period may apply to: - chat transcripts; - technical logs; - session and booking-flow data; - admin/customer account data; - provider integration metadata; - provider/API secrets; - backups; - privacy/support request emails; - Stripe/SaaS billing records. Provider/API secrets may be retained during the customer contract and for up to 24 months after the contract or integration ends, unless earlier deletion is required or technically appropriate. Some data may be deleted earlier when it is no longer needed. Some data may be retained longer where required for accounting, legal, dispute, security, or compliance reasons. --- ## 12. Automated recommendations and decision-making GreetScribe may provide automated recommendations or ranking of accommodations or activities. No LLM accepts or rejects bookings. No LLM accepts or rejects payments. Users choose whether to continue to a customer or provider booking page. Final booking and payment completion happens outside GreetScribe through the customer’s or provider’s booking/payment flow. --- ## 13. OpenAI and LLM processing GreetScribe may use OpenAI for chat assistance and recommendations. OpenAI may receive guest chat messages. OpenAI is not intended to receive full chat transcripts. OpenAI is not intended to receive guest names, guest emails, or guest phone numbers. OpenAI processing may use EU or global processing depending on customer configuration and service settings. Enterprise customers may use alternative or self-hosted LLM arrangements where separately configured. --- ## 14. Cookies and browser storage GreetScribe uses cookies and browser storage technologies. This may include: - cookies; - sessionStorage; - localStorage. These technologies may support: - chatbot sessions; - security; - website functionality; - analytics; - marketing measurement. GreetScribe currently uses or may use: - Google Analytics; - Meta Pixel; - TikTok Pixel; - LinkedIn Insight Tag. A separate cookie notice or cookie settings mechanism should describe exact cookie names, storage keys, vendors, purposes, and durations. --- ## 15. Analytics and marketing Qevinto Oy may use analytics and marketing technologies, including: - Google Analytics; - Meta Pixel; - TikTok Pixel; - LinkedIn Insight Tag. These tools may help measure website use, marketing performance, and campaign effectiveness. Qevinto Oy may use marketing channels including: - Google; - Instagram/Meta; - TikTok; - LinkedIn. Qevinto Oy states that it does not currently sell personal information. Qevinto Oy states that it does not currently share personal information for cross-context behavioral advertising. Qevinto Oy states that it does not currently offer financial incentives in exchange for personal information. --- ## 16. Security GreetScribe uses technical and organizational security measures intended to protect the service. These measures include: - 2FA; - FIDO/passkeys; - Supabase Auth; - server-side service-role key handling; - no service-role secrets in frontend code; - tenant/domain validation; - signed widget/session tokens; - rate limiting; - TLS/HTTPS; - access controls; - admin roles; - backups. Security measures may change as the service develops. --- ## 17. User rights and requests Users and business customers may contact Qevinto Oy about privacy requests at: contact@qevinto.com Depending on the applicable law and the user’s location, privacy rights may include rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. Qevinto Oy may need to verify the requester’s identity before responding. Qevinto Oy may refuse or limit requests where permitted by applicable law. --- ## 18. California and other United States privacy laws GreetScribe does not specifically target California consumers at this stage. Qevinto Oy may have or later receive US customers. Qevinto Oy currently marks CCPA/CPRA applicability as not sure. Qevinto Oy currently marks other US state privacy law applicability as not sure. Qevinto Oy states that it does not currently sell personal information. Qevinto Oy states that it does not currently share personal information for cross-context behavioral advertising. Qevinto Oy states that it does not currently offer financial incentives in exchange for personal information. If US privacy laws become applicable, Qevinto Oy may update this policy with additional state-specific disclosures. --- ## 19. Changes to this policy Qevinto Oy may update this Privacy Policy when GreetScribe changes. When this policy changes, Qevinto Oy may update the effective date. Qevinto Oy may notify business customers directly where appropriate. --- ## 20. Contact information For privacy questions or requests, contact: **Qevinto Oy** Sarkakatu 3 F23 96460 Rovaniemi Finland contact@qevinto.com --- ## 21. Disclaimer This document is a privacy policy draft prepared for publication based on operator-supplied facts and current product information. It is not legal advice. Qevinto Oy should have qualified counsel review this policy before publication, especially if GreetScribe targets customers or users outside Finland and the EU.