Privacy Policy · OtelyaOtelya · Receptionist AI multilingua per hotel, agriturismi e B&B

Privacy Policy

Last updated: October 21, 2026

Otelya ("we", "the Platform") is a multilingual AI receptionist for Italian hospitality businesses. We process personal data of our customers (owners of hotels, B&Bs, agriturismi, vacation rentals) and of the guests who contact them through the channels we integrate (email, WhatsApp, phone, Messenger, Instagram Direct, website forms).

Data controller: Alfio Moretti · Otelya · hello@otelya.app · Italy.

1. What data we collect

  • Account data: name, email, hashed password, language, property name, city, property type.
  • Communication data: content of emails, WhatsApp messages, phone calls, Messenger and Instagram Direct messages guests send through channels connected to your property.
  • Payment data: handled directly by Stripe. We never store card numbers.
  • Technical data: IP address, browser type, application logs, integration event logs.
  • Website visit statistics for otelya.app (in-house tool, no cookies, no third-party services): pages viewed, referring page, campaign UTM parameters, approximate city and device type, date and time, linked to a random identifier stored in your browser. The IP address is never stored in clear text (only an irreversible hash, used to derive the city). If you arrive by clicking a link in one of our emails, the visit is linked to your business contact.
  • Meta data (Facebook/Instagram): when you connect your Facebook Page and Instagram Professional account, we request via Meta Graph API the minimum required scopes (pages_manage_posts, pages_manage_metadata, instagram_content_publish, instagram_manage_messages, pages_messaging) to publish scheduled posts, read DMs and comments, and reply on your behalf.

2. How we use the data

  • Deliver the service (auto-reply to guests, publish posts, generate blog articles).
  • Improve AI quality through language models (Anthropic Claude, Google Gemini) called in stateless mode — your conversations are not used to train third-party models.
  • Billing and subscription management (Stripe).
  • Operational communications (system emails, security alerts).
  • Respond to legal requests and prevent abuse.

3. Meta Platform Data (Facebook, Instagram, Messenger)

  • Otelya uses the Meta Graph API solely to publish content you authorize us to publish and to read/reply to direct messages your guests send you.
  • We never share Meta data with third parties for advertising purposes.
  • Instagram/Messenger messaging data is processed only to generate AI draft replies and let you respond from the Dashboard.
  • You can revoke access at any time in your Meta Business Manager settings or by disconnecting the integration in the Otelya dashboard. On disconnect, we delete all tokens and stored messages within 30 days.

4. Third-party sharing

  • Anthropic (Claude) and Google (Gemini): AI text processing, stateless.
  • ElevenLabs: text-to-speech, only when you enable AI voice.
  • Twilio: phone calls, only when you enable AI number.
  • Resend: transactional and outreach emails.
  • Stripe: payments and subscription management.
  • Meta Platforms: social publishing and messaging.
  • MongoDB Atlas: EU-hosted database (Frankfurt).

5. Legal basis and retention

  • We process data under contract (Art. 6.1.b GDPR) to deliver the service, and under legitimate interest to prevent fraud and improve the service.
  • We retain account data for subscription duration + 24 months for tax obligations.
  • Visit statistics: processed under legitimate interest (Art. 6.1.f GDPR) to improve the website and, for business contacts already reached by email, to send at most one follow-up message every 30 days, always with the right to object by replying 'remove' (Art. 21). They are deleted automatically after 13 months. You can stop them at any time by clearing this site's data in your browser.
  • Guest messages are retained for 12 rolling months.
  • On account deletion, all data is erased within 30 days unless legal obligations require otherwise.

6. Your rights (GDPR)

  • Right of access, rectification, erasure, portability, objection, restriction.
  • To exercise them, write to hello@otelya.app · we reply within 30 days.
  • Right to complain to the Italian Garante Privacy (www.garanteprivacy.it).

7. Security

  • All communications between your browser and Otelya are TLS 1.3 encrypted.
  • Passwords are hashed with bcrypt.
  • OAuth access tokens (Google, Meta) are encrypted at rest.
  • No Otelya employee reads the content of your guest messages unless you explicitly request support.

8. Data deletion

  • To delete your account and all associated data (including data obtained from Meta Platforms), send a request to hello@otelya.app with subject "Account deletion". Deletion completed within 30 days.

9. Changes to this policy

  • We'll update this page for material changes and notify you by email at least 15 days before they take effect.

10. Contact

  • Alfio Moretti · Otelya · hello@otelya.app
Terms of Service · hello@otelya.app