Privacy policy | Smart Concierge

Data controller

Denys Hurskyi (self-employed / autónomo), Tax ID (NIF) Z3135092J, professional address at Avda. Diego Ramírez Pastor, Torrevieja (Alicante), Spain, trading as "Smart Concierge" (smartconciergeservice.com). Contact: info@smartconciergeservice.com.

Data we process

Business contact details (email, phone); end-customer WhatsApp messages processed on behalf of the business; Google account email and Google Calendar data when a business owner connects Google Calendar (calendar list, calendar identifiers, and event data needed to check availability and create, update, or cancel bookings); and technical logs (IP, timestamps) to operate the service. Where a business enables rebooking reminders: the end customer's phone number, the date and service of their last visit, and a record of their reminder choice (yes/no, date, and how it was given).

Purpose

Providing the WhatsApp concierge: bookings, FAQ answers, and handoff to human staff. Google Calendar access is used only to show free slots and to create, update, or cancel appointment events for that business. We do not sell personal data. Optional, only if the business switches it on: a WhatsApp reminder to book again a set time after a visit (chosen by the business). It is sent only to end customers who agreed to it, one reminder per visit, and it contains no promotions or offers.

Google user data — sharing and disclosure

Google user data obtained via Google APIs (OAuth tokens, connected Google account email, calendar list, and calendar event data) is used solely to operate Smart Concierge for the connecting business. We do not sell Google user data. We do not share, transfer, or disclose Google user data to advertisers or data brokers. We do not share Google Calendar contents with other tenants. Limited disclosure may occur only to infrastructure sub-processors that host or process the service under contract (currently Hetzner for EU hosting), and only as needed to run the application. We do not transfer Google user data to Meta or Stripe. OpenAI may process WhatsApp conversation text to understand booking intent; we do not send Google Calendar payloads or Google OAuth tokens to OpenAI for model training or unrelated purposes.

Data protection mechanisms

We protect sensitive data with industry-standard controls: TLS encryption in transit; encryption at rest for Google OAuth refresh and access tokens stored in our database; access limited to authenticated admin users for their own tenant; logical isolation of each business’s data (multi-tenant separation); and hosting in the EU (Hetzner) with provider security measures under contract. Access to production systems is restricted to authorized operators.

AI / machine learning and Google Limited Use

Smart Concierge uses third-party AI (OpenAI) to interpret WhatsApp messages for booking and FAQ flows. The use of raw or derived user data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace or Google Calendar user data—raw, aggregated, or derived—to create, train, or improve foundational or generalized machine learning or artificial intelligence models. Google user data is not transferred or sold for such training.

Legal basis (GDPR)

Contract performance with the business; legitimate interest in security and service operation; end-customer consent where applicable (voluntary WhatsApp messages). Rebooking reminders: the end customer's consent, asked once in the WhatsApp chat after their booking (a clear yes/no question naming the business). Consent is optional, is not a condition of booking, and can be withdrawn at any time. Nothing is sent without it.

Sub-processors

Meta (WhatsApp Cloud API), OpenAI / DeepSeek (natural language processing of WhatsApp messages), Google (Google Calendar API when connected by the business), Hetzner (hosting in the EU), and Stripe (billing when used). Each provider is engaged under contract with appropriate security and data-processing terms.

Business customer and data processing agreement

WhatsApp messages and booking data of end customers are processed on behalf of the business they contact: that business is the data controller. Smart Concierge acts as processor (GDPR Art. 28). The data processing agreement (DPA) is signed together with the service contract; creating an admin account is not enough. Message history is kept for 12 months, plus up to 14 days of technical execution copies on the automation platform.

Retention

For the duration of the contract and legal retention periods. WhatsApp message history is kept for 12 months and then deleted automatically. Google OAuth tokens and calendar linkage are kept while the integration remains connected and are removed or invalidated when the business disconnects or the account is deleted. The business may request export or deletion per contract. Customer and booking records are kept for the duration of the contract with the business and deleted when the business or the customer asks for it. The record of a customer's reminder choice (date, source) is part of that customer record and is deleted together with it. To keep the thread of a conversation, the most recent messages are held temporarily, for up to 7 days.

Your rights

Access, rectification, erasure, restriction, portability, and objection: contact by email. Complaint to the AEPD (Spain). Rebooking reminders: every reminder includes a «Stop reminders» button and a short note that you can reply STOP; either one withdraws your consent immediately and free of charge, and you will not be reminded again. You can also ask the business, or email us, to remove your data.