Privacy Policy

2.What we collect#

• Guests: the room number and reservation reference the Property shares with us; the guest's first name only, where the Property provides it (we never ask for email addresses; a surname only when the Property's system needs it to hold a room a guest books by phone, deleted after 30 days at the latest); the phone number on the booking, used during the stay for verification and, where enabled, SMS delivery of the stay access code, and after the stay we keep only its last four digits; dietary or allergy information only when a guest adds it to an order themselves (an optional note for that order's kitchen; it is never kept in the conversation or a guest profile and is cleared with the order's notes after 90 days); messages the guest sends to Phil and Phil's replies; requests, orders, reservations and offer claims; the device identifier and browser type used to open the stay link; and, for room charges, the evidence needed to support a charge (phone last four digits, verification method, time, the last lines of the relevant conversation).
• Voice calls with Phil (where the Property uses them): the time, length and outcome of each call, a one-line summary, links to what was booked and a redacted transcript. Call audio is never recorded or stored.
• Staff: first and last name, role, department, the mobile number they sign in with (verified by a one-time code), the personal access key issued to them if any, sign-in times, and a record of every action taken in the dashboard (accept, reject, post, reverse, take over) with time and user.
• Website visitors: pages viewed, messages typed into the "Need help?" guide, and any details you give us in a contact or demo form (name, email, property, role).
• Usage analytics, where allowed: how people move through the website, the guest app and the staff dashboard (clicks, taps, scrolling, mouse movement), recorded by Microsoft Clarity with typed text masked. See Usage analytics below.
• We never collect payment card numbers from guests. Subscription payments are handled by our payment provider, the merchant of record named on the Property's invoice; we receive the invoice status, not the card.

3.Why we use it#

• To run the Service: answer guests, route requests to the right department, record orders and reservations, notify staff, and keep the guest informed of status.
• To verify identity before anything is charged to a room: remembering the device that opened the stay, checking the room against the booking, and the signed stay link or the room number and stay access code (given by the front desk or, where texting is switched on for the hotel, sent by SMS to the phone on the booking at check-in).
• To keep an audit trail the Property can rely on in a dispute: who asked, who decided, when, and how the guest was verified.
• To operate, secure and improve the Service: monitoring errors, rate-limiting abuse, and measuring aggregate usage such as response times and request volumes.
• To answer enquiries from prospective properties and, with consent, to follow up.

4.AI processing#

Phil uses a large-language-model provider, OpenAI, to understand messages and draft replies. Message text and the conversation context needed for a reply are sent to OpenAI with each request. OpenAI does not use data sent through its API to train its models by default, and may retain API inputs and outputs for up to 30 days for abuse monitoring before deleting them. No guest or Property data is used to train models, ours or a provider's. The guest chat tells guests on screen that Phil is an AI assistant. Safety-critical routing (emergency language, money, confirmations) is handled by deterministic rules that do not depend on a model.

During a Property's first 30 days, our team reviews its conversations to correct wrong or missing answers and to tune Phil's knowledge and instructions for that Property (its menus, rooms and the way its guests ask). This review is done on the Property's behalf and for that Property only; its results are not shared with other properties, and no model (ours or a provider's) is trained on the conversations.

After 30 days, we may anonymise conversation data, removing names, phone numbers, room numbers and anything else that identifies a guest or the Property, and use the anonymised text to improve the Service. We keep these anonymised copies of conversations and their outcomes to improve Phil, also after the originals are deleted. Anonymised data cannot identify a guest or a Property. Personal data is never used to train public or third-party models.

The model provider is listed under Sub-processors below.

5.Where data is stored#

Our primary database runs in Frankfurt, Germany (AWS eu-central-1, operated by Supabase). Every record carries its Property's hotel identifier, and our server scopes every staff and guest request to the hotel in the signed session, so one Property's staff cannot read another's data. The website and its APIs run on Vercel, with server functions in Frankfurt; our automation engine runs on a virtual server in Frankfurt (Hostinger). OpenAI processes API requests in the United States, and messaging providers may process data outside the EU. Foyer is operated from Türkiye, and our team accesses and supports these systems remotely from there.

6.How we protect it#

• Encryption in transit (TLS) everywhere and at rest in the database.
• Staff register with a one-time link or key from the hotel's manager, then sign in with their mobile number and a one-time code sent by text, or with a personal access key issued by the manager; links, keys and accounts can be revoked at any time. Everyone at the hotel except its admin sees only the last 4 digits of a teammate's number. Sessions use httpOnly cookies and last up to 12 hours, or up to 30 days when "Keep me signed in" is chosen. Every session ends after 12 hours of inactivity, including remembered sessions.
• Tenant separation is enforced in our server code: every staff and guest request is scoped to one Property, and content edits and staff actions go through server-side checks of role and Property.
• Guest stay links are signed. A link opens the stay on the first device, subject to access revocation checks. Another device needs the room number and the stay access code, from the front desk or by text where texts are on. Room QR entry uses the room number and stay access code. Guest access ends at checkout; stay records follow the retention schedule below.
• Rate limits on public endpoints; all staff actions are logged with user and time.

7.How long we keep it#

• Guest conversations, requests, orders and charge evidence: 12 months after the guest checks out, because the Property needs the audit trail for billing disputes, then deleted (anonymised copies, described under AI processing, are kept). The full booking phone number is kept only for the stay; after checkout only its last four digits remain on the charge record. A surname taken to hold a room booked by phone is deleted 30 days after the booking at the latest, sooner when the stay is over. A Property can ask us to delete or anonymise a specific guest's data at any time; we complete such requests within 30 days. When a guest's data is erased, anyone who shared the stay keeps their own messages and access; the guest's name, phone number and email are removed from the conversation they shared, which is kept because its messages cannot be told apart by speaker. Only what billing needs is kept, without the guest's details: the length of calls for call minutes, the record that the guest asked for a call with only the last four digits of the number, and the count of the stay's check-in.
• We never ask guests for card numbers, identity documents, email addresses or health details. We ask for a surname only when the Property's system needs it to hold a room booked by phone. Card numbers and passwords are redacted before a message is stored. Anything else a guest chooses to type into the conversation is kept as part of that conversation under the rule above.
• Verification codes: expire within minutes and are deleted after use. Stay access codes stop working at checkout.
• Records of a guest's agreement to offer texts (the hotel, the stay, where the guest agreed, the exact wording shown, when they agreed or turned it off, and a one-way hash of the network address): kept only as long as needed to show the guest agreed, then deleted. The record holds no phone number of its own.
• Records of a guest's request for a phone call from Phil (the hotel, the stay, the full number called, the exact wording shown and when they agreed): kept only as long as needed to show the guest asked for the call, then deleted. If the guest's data is erased before then, the record keeps only the last four digits of the number, in the record and in the wording.
• Staff accounts and action logs: the subscription plus 12 months, to support investigations of past decisions.
• Website guide conversations and enquiry forms: 12 months, unless you ask us to delete them sooner.
• After a subscription ends: the Property may export its data for 30 days; we then delete it from live systems, except the anonymised copies described under AI processing, which identify no guest and no Property. Database backups are kept for 7 days and then roll off; records in our automation engine are pruned after 72 hours.

8.Sub-processors#

We share data only with the providers needed to run the Service:

• OpenAI (language model: understanding guest messages and drafting Phil's replies; API data is not used for training by default and may be retained for up to 30 days for abuse monitoring)
• Supabase (database and storage, Frankfurt) · Vercel (website and API hosting) · Hostinger (virtual server in Frankfurt running our automation engine)
• Dodo Payments (billing of Properties, merchant of record) receives the Property's billing contact and payment details only, never guest data.
• Telegram (optional: staff notification cards and staff decisions; guests do not use Telegram).
• Google Workspace (our business email, including the support mailbox; it holds what Properties and guests send us by email).
• Twilio (text messages to guests: the stay link and access code and updates on the guest's own orders and requests, sent through Foyer's Twilio account from Foyer's toll-free number, 1-866-81-FOYER, and one-time sign-in codes through Twilio Verify, which may use Twilio's own numbers; Twilio receives the phone number and the message text. Staff receive only one-time sign-in codes, through Twilio Verify; staff alerts are never texted).
• Microsoft (Clarity: usage analytics on the website, the guest app and the staff dashboard. In the guest app and the dashboard all text, inputs and images are masked in the browser before anything is sent).
• Twilio (phone calls, where a Property has Phil on the phone: callbacks placed at a guest's request to the number on the reservation, and calls to the hotel's Phil line; Twilio receives the phone number and carries the live call audio; calls are transcribed, not recorded, and no call audio is stored).
• Twilio and Meta (WhatsApp, where a Property turns it on: the guest's messages and Phil's replies; they receive the phone number and the message text).
• We do not sell personal data and we do not share it with advertisers.

9.Text messages (SMS)#

Who sends them: Foyer Intelligence LLC, on behalf of the hotel, from one Foyer toll-free number, 1-866-81-FOYER, through Twilio. Every stay text starts with the hotel's name followed by "via Foyer". Sign-in codes come through Twilio Verify, which may use its own numbers and wording. Foyer texts hotel staff only one-time sign-in codes; staff alerts go to the hotel's Telegram groups and the dashboard. Foyer does not provide or resell telephone service and never holds guest funds.

What is sent, only about the guest's own stay: the stay link and access code at check-in, a one-time verification code when the guest opens the app on a new device, and updates on the guest's own orders and requests. No marketing.

Consent: the guest gives the phone number to the hotel when booking or checking in, next to the consent line for these texts.

Message frequency varies, usually 1 to 3 texts per stay. Message and data rates may apply.

Reply STOP to any text to stop all texts from this number, for every hotel, sign-in codes included; reply START to turn them back on; reply HELP for help, which names the hotel you were last texted for and its front desk number. The number does not read other replies. After STOP, the guest can still use the stay link or ask the front desk. We record a STOP as a one-way hash of the number, never the number itself, and keep it so the number is not texted again.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third parties; only the provider that delivers our texts (Twilio) processes the phone number to send them. Mobile numbers are used only to send the messages described here.

The program, its consent wording, sample texts and replies are on foyerintelligence.com/sms. Our Terms of Service (foyerintelligence.com/terms) cover the same program. Carriers are not liable for delayed or undelivered messages.

10.Voice calls with Phil#

• Where a Property has Phil on the phone, a guest can talk to Phil in the guest app (a voice call in the browser), or ask Phil to call the phone number on the reservation, and callers can reach Phil on the hotel's Phil line. To recognise a guest calling from the phone number on their stay, the caller's number is compared with the numbers on the hotel's stays in house, as a keyed hash; any other caller can make a new room reservation request. A call to Foyer's number, 1-866-81-FOYER, from the phone on a current or recent stay is put through to that hotel's Phil line or front desk; the number is compared with stays only to route the call. Phil says at the start of every call that it is an AI assistant and that calls are transcribed. Calls are transcribed for the hotel, not recorded: no call audio is kept. A call to a guest is placed only at the guest's request, and no other number is ever called.
• Transcribed, not recorded: we never record or store call audio. The audio is processed live to understand the caller and speak the reply, by our language-model provider (OpenAI, under the API terms described under AI processing); phone calls are carried by our telephony provider (Twilio, which receives the phone number for that call). The written transcript is redacted before it is stored: phone numbers, card numbers, email and street addresses, names other than the guest's first name, and health or allergy details are removed.
• For each call we keep its time, length, outcome, a one-line summary, links to what was booked and the redacted transcript for 12 months, then delete them. Only staff of that Property who can see guest requests can read a transcript; it is never shared with another hotel, and, as with chats, after 30 days we may anonymise transcripts (removing names, numbers and anything else that identifies a guest or the Property) and use the anonymised text to improve Phil. Personal data is never used to train public or third-party models. For phone calls, the call record keeps only the last four digits of the number; the separate record of the guest's request for a call (the full number called, the wording they agreed to and when) is kept only as long as needed to show the guest asked for the call, then deleted (an erasure before then leaves only the last four digits of the number on it); for booking-line callers, the first name and the hotel's booking number of a reservation they make, and the surname for up to 30 days when the hotel's system needed it to hold the room.
• A guest who does not want a call keeps using the chat; nothing is lost.

11.Your rights#

Guests: you can ask the Property to access, correct or delete the data held about your stay; the Property instructs us and we carry it out. You can also write to us directly and we will coordinate with the Property. Verification messages are sent only to the phone on your booking; ask the front desk to correct the number if it is wrong.

Staff and website visitors: you can ask us to access, correct, export or delete your data, or to stop follow-up contact, at any time by emailing support@foyerintelligence.com. We respond within 30 days.

If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your data-protection authority. If you live in a US state with a consumer privacy law, you have the rights that law gives you; for guest data, send your request to the Property, which is the business responsible for it, and we help the Property answer. We do not sell personal data or use it for targeted advertising.

12.Cookies#

The guest app and the staff dashboard use strictly necessary cookies: a signed session cookie so the guest or staff member stays signed in, and a device identifier for verification (for guests it lasts up to 400 days in the browser, for staff up to 365 days). We use no advertising cookies. Microsoft Clarity sets its analytics cookies only where analytics is allowed (see Usage analytics), and your choice is kept in a first-party cookie, foyer_analytics, for 6 months. Preferences such as a dismissed welcome card are stored in your browser and never leave it.

13.Usage analytics (Microsoft Clarity)#

We use Microsoft Clarity to see how people use our website, the guest app and the staff dashboard: pages viewed, clicks and taps, scrolling and mouse movement. It shows us what is confusing so we can fix it.

On the website, anything typed into a form or the guide is masked. In the guest app and the staff dashboard every text, input and image is masked, so a recording shows the layout and where people tap, never names, rooms, messages or orders. We never send Clarity a name, email, phone number, room, stay or hotel identifier, and a page whose address carries a code or sign-in link is not recorded.

Microsoft processes this data for us. Clarity keeps recordings for 30 days; recordings we mark as favourites and a small random sample are kept for up to 9 months. Other Clarity data is kept as set by Microsoft Clarity. Advertising storage is always off.

Wherever you are, Clarity runs only after you choose Accept. Change your choice any time with Cookie settings at the bottom of any website page; it covers the guest app and the dashboard too.

14.Children#

Phil is intended for adult guests and staff. Where a child uses a room's guest app, the booking holder is responsible, as with any hotel service.

15.Changes and contact#

We will post changes here with a new date and, for material changes affecting Properties, notify them by email. Data-protection enquiries: support@foyerintelligence.com. Properties can request a signed data-processing agreement at the same address.