# GreetScribe Privacy Policy

**Version:** 2.0\
**Updated:** 2026-09-20\
**Operator:** Qevinto Oy

This notice covers GreetScribe guest assistance, the public website and demo, customer accounts, and Qevinto's own administration and product development. It applies when published and does not retrospectively change an accepted customer contract.

## 1. Who is responsible

Qevinto Oy, Business ID 3583823-3, Sarkakatu 3 F23, 96460 Rovaniemi, Finland. Privacy and support contact: [contact@qevinto.com](mailto:contact@qevinto.com).

| Processing | Responsible party and role |
|---|---|
| A customer's guest chat, booking assistance, customer knowledge content and customer-requested conversation records | The hospitality customer is the controller. Qevinto processes the data on that customer's documented instructions under the [Data Protection Addendum](/data-protection-addendum). |
| Qevinto's website enquiries, public demo, business contacts, account administration, invoicing and its own security and legal records | Qevinto is the controller. |
| Qevinto's independent development of GreetScribe using identifiable guest information | Qevinto is a separate controller for that development activity, subject to section 4. This is distinct from processing on the customer's instructions. |
| A customer's booking engine, payment checkout or other independently operated system | The customer and relevant provider explain their own processing in their notices. |

Providing the software or using the same information does not by itself make Qevinto and the customer joint controllers. These standard arrangements do not establish joint controllership.

For a chat on a hospitality business's website, that business's privacy notice explains its purposes and legal basis. Requests may be sent to that business or to Qevinto for routing and assistance.

## 2. Information handled

Guest information can include messages, replies, source references, conversation events, session identifiers, selected accommodation or activities, travel dates, occupancy counts and other values entered into a configured flow. A contact-request feature can collect a name and an email address or telephone number when the guest supplies them. Features and collected fields depend on the customer's enabled flow.

Information comes from the guest, the Customer and its authorised users, the Customer-selected integrations, and technical events generated during use. Qevinto obtains development excerpts from these service conversations or from material supplied by the Customer, subject to section 4.

Free-text messages and uploaded customer knowledge can themselves contain personal data. Do not enter passwords, API keys, payment-card details, health information or other sensitive information. GreetScribe does not require payment-card details or precise GPS location for its guest-assistance service.

Customer and staff information includes names, email addresses, organisation membership, permissions, authentication and session records, support correspondence, billing contacts and customer integration configuration. Authentication records can include password hashes, passkey credentials, multifactor-authentication material, and IP/device information; these are not guest booking-payment records.

Website forms send the fields you submit, including contact details, business information and your message, to Qevinto by email. Technical processing includes request IP addresses, browser and session information, rate-limit data, usage counts, security/audit events and operational diagnostics.

## 3. Purposes and legal bases

| Qevinto's controller activity | Purpose and basis |
|---|---|
| Business enquiries and account/contact administration | Responding to requests and operating the business relationship: legitimate interests in managing that relationship; Article 6(1)(b) where the individual is themselves the contracting party or requests pre-contract steps. |
| Public demo | Providing the requested demonstration and protecting it against misuse: legitimate interests in demonstrating and securing GreetScribe. The current website demonstration runs scripted conversations in the browser. Its chat text is not submitted to the guest-runtime or AI service; ordinary website requests still reach the hosting service. |
| Invoicing and accounting | Contract performance where applicable; compliance with statutory accounting/tax obligations for records the law requires. |
| Security, abuse prevention and necessary legal claims | Legitimate interests in protecting users, systems and confidential information and establishing or defending claims; a legal obligation where a specific law requires processing. |
| Privacy requests | Compliance with data-protection obligations. |
| Independent product development | Only development of GreetScribe, subject to the separate lawful-basis and minimisation requirements in section 4. Neither a customer's signature nor acceptance of this notice is a guest's consent. |

For customer-directed guest processing, the customer determines and communicates the lawful basis. Qevinto's authority as processor is the customer's documented instructions, not Qevinto's own legitimate interest in product development.

You may object to processing based on legitimate interests. Qevinto assesses an objection and stops that processing unless the conditions for continuing under applicable law are met.

## 4. Development of GreetScribe

Qevinto's development activities concern response quality, defect investigation, software, prompts and knowledge content. The development material includes selected original conversations and anonymised findings. It is not used for advertising, sale of guest data, development of unrelated products, or training or fine-tuning AI model weights.

Identifiable guest information must not be reused for independent development solely under a processor instruction or a general Customer Content licence. Before such reuse, Qevinto must establish and document an applicable lawful basis, assess necessity and the guests' reasonable expectations, provide the required information, and make the applicable rights effective. These terms do not themselves establish that assessment or authorise unrestricted reuse.

The development rules require minimum necessary excerpts, access limited to authorised Qevinto personnel with a specific task and confidentiality duties, and removal of unnecessary identifying and sensitive information. Identifiable development copies must be deleted when the task ends and no later than 30 days after the source information was collected, unless a separately documented legal obligation requires retention. Copying or exporting a conversation must not restart that period.

Only material assessed as genuinely anonymous may become a long-term, shared development or knowledge resource. Removing an email address or replacing an identifier alone does not establish anonymity. Original conversations must not be pasted into external AI or development services unless the recipient, purpose, contract, transfer safeguards and lawful basis have first been approved and disclosed.

These are limits on development processing. The service's automated retention sweep does not automatically erase separate development copies.

## 5. AI processing

GreetScribe combines deterministic conversation paths, knowledge retrieval and AI-assisted answers. Its standard AI provider is Scaleway Generative APIs.

For the inspected guest-answer path, the request contains the system instructions, the current guest question and selected knowledge excerpts. It does not automatically attach the full conversation history or dedicated guest contact fields. Nevertheless, names, contact details or other personal information typed into the question or present in knowledge content can be transmitted.

Optional embedding-based retrieval sends the text being embedded, such as a query or knowledge excerpt, to its configured embedding service. Staff AI-authoring functions can send the staff prompt and relevant authoring context. These are separate from the guest-answer request.

See the [AI Use Policy](/ai-use) for provider retention and the distinction between inference and model training. A technical option to configure another endpoint does not mean that endpoint is an active recipient.

## 6. Recipients and international processing

Core hosting and PostgreSQL database services are provided by UpCloud. Scaleway provides AI inference, secret/key management and transactional email. The [Subprocessor List](/subprocessors) distinguishes customer-data subprocessors, business/operational services and customer-controlled integrations.

The recorded core database deployment is in Helsinki, Finland. The configured Scaleway services involve France and the Netherlands. This is not a representation that all Qevinto information, support processing or every provider's subprocessing stays in Finland.

Qevinto's enquiry/support mail systems, professional advisers, legally required authorities and authorised operational service providers can receive information relevant to their functions. Customer-selected integrations have their own recipients and locations.

Before a transfer outside the EEA that requires a Chapter V safeguard, Qevinto must establish an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses and any necessary supplementary measures. EU hosting alone does not prove the absence of international transfers. Contact Qevinto for information about the safeguards applicable to your data.

## 7. Retention

| Information | Retention or deletion criterion |
|---|---|
| Ordinary guest transcripts, session records and guest-contact request/outbox data | The implemented default retention clock is 30 days from creation. Expired eligible records are processed by a scheduled daily purge; deletion is not an exact real-time deadline. |
| Records with an explicit retention instruction or a preservation restriction | The record's applicable instruction controls. A transcript excluded from automatic deletion has no automatic expiry unless separately configured. Any continued retention must be justified, reviewed and ended when that justification expires. |
| Separate identifiable development copies | The policy deadline in section 4 applies. These copies are outside the ordinary automatic sweep. |
| Genuinely anonymous development findings | May be kept while useful; material that remains reasonably linkable to a person is still personal data. |
| Customer/staff accounts and membership information | While required for the account and business relationship, followed by necessary legal, security or dispute retention. Closing an account is a separate workflow, not the guest-data purge. |
| Audit events, security records, usage and integration metadata, staff AI-authoring requests | For the relevant security, accountability, operational or legal purpose. The guest-data purge does not impose a universal expiry on these categories. Retention must be assessed by category. |
| Provider/API credentials | While the authorised integration needs them. Revoked or unnecessary credentials must be revoked/deleted through the credential-management process; there is no general permission to keep them for 24 months after termination. |
| Support, enquiries and privacy correspondence | Until the request and any related contractual or legal follow-up are resolved; retain only what is needed for a continuing obligation or claim. |
| Accounting records | For the applicable statutory accounting and tax retention periods. |
| Database backups | Until the configured backup rotation expires. Active-data deletion does not immediately erase existing backup snapshots. Restored data must be subject to the applicable deletion instructions again. |

The 30-day service clock is not a universal period for all personal data. Request the retention information applicable to your particular record through the privacy contact.

## 8. Browser storage and tracking

The website does not currently install Google Analytics, Meta Pixel, TikTok Pixel or LinkedIn Insight Tag. Advertising through a platform is not the same as installing its tracking code here.

| Storage | Purpose and lifetime |
|---|---|
| `sessionStorage: gsLogoAnimated` | Remembers the website's logo animation during the browser tab session. |
| `sessionStorage: gsPendingAnchor` | Carries an in-site navigation target; removed after navigation is handled or the tab session ends. |
| `localStorage: greetscribe_application_form` | Restores the enquiry form, including entered contact information. It persists until browser/site storage is cleared; the current form has no automatic expiry. |
| Production widget `sessionStorage: greetscribe_widget_state` (where that widget is embedded) | Restores guest-chat state within the tab session. Server-side conversation records have their own retention. This is separate from the scripted website demo. |
| Account session cookies, including `better-auth.session_token` | Authenticate staff/customer sessions on the application. Their configured expiry is separate from the marketing website and guest-chat storage. |

Browser storage is not automatically anonymous. You can clear it in your browser; doing so can remove a saved form or chat state but does not erase server records. A customer's own website may install additional storage or trackers governed by its own notice and consent controls. This notice is not consent to optional tracking.

## 9. Choices, rights and complaints

Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction and portability, object to legitimate-interest processing, and withdraw consent where consent is the basis. Withdrawal does not affect the lawfulness of earlier processing.

Contact [contact@qevinto.com](mailto:contact@qevinto.com). Identify the relevant hospitality business and session or request where possible; do not send passwords or unnecessary identity documents. Qevinto may verify identity proportionately and assist the customer when it is the controller.

You may complain to the [Finnish Data Protection Ombudsman](https://tietosuoja.fi/en/notification-to-the-data-protection-ombudsman), or another competent supervisory authority, particularly in the Member State of your residence, work or the alleged infringement. You need not contact Qevinto first.

Contact and account fields marked as required are needed to respond, authenticate or administer the requested service. Without them, the relevant function may be unavailable. You do not have to disclose sensitive information to use guest assistance.

## 10. Automated assistance and security

GreetScribe suggests information and routes guests to customer/provider booking pages. The LLM does not accept or reject bookings or payments. The described service does not make solely automated decisions producing legal or similarly significant effects about a guest.

Tenant-scoped access, backend authorisation, authentication, secret handling, transport protection and abuse controls protect processing. See the [Security Statement](/security) for the scope and limitations of these measures.

## 11. Changes and document versions

Qevinto updates this notice when processing changes and provides additional information where the law requires it. New purposes requiring further information or a lawful basis are not authorised merely by changing this page. [The previous published wording](/legal/versions/2026-05-17/privacy-policy.md) remains available for historical reference.