1. Data controller

Entity:

Horizon AI Agency LLC

Address:

407 Lincoln Rd Ste 708, Miami Beach, FL 33139, United States

Privacy email:

admin@horizonaiagency.com

Product:

Olympus (web application, staff mobile application and the Apollo virtual assistant)

Horizon AI Agency LLC is the data controller for platform users (hotel staff and administrators) and for the technical data of the platform itself.

For guest data, each hotel is the data controller and Horizon AI Agency LLC acts as a processor, following the hotel's instructions and the data processing agreement signed with it. The privacy policy each hotel shows its guests is published on a hotel-specific page inside Olympus.

2. Who this applies to

• Hotel staff and administrators who use Olympus with a user account.
• Guests who talk to the hotel through the virtual assistant on WhatsApp or the web chat, whose data we process on behalf of the hotel.
• People who contact Horizon AI Agency LLC by email or through the website.

3. Data we process

Depending on how you use Olympus, we may process the following data.

• Hotel staff account data: name, email address, role, department, the hotel you belong to and sign-in data.
• Hotel data: trade and legal name, address, tax and contact details, service configuration and service catalogue.
• Guest data, processed on behalf of the hotel: name, phone number, language, booking and stay details, messages exchanged with the virtual assistant and with staff, requests, incidents, preferences, ratings and consents.
• Files sent over WhatsApp: images, audio and documents the guest or the hotel share in the conversation.
• WhatsApp Business connection data: the hotel's WhatsApp Business Account ID, phone number ID and phone number, verified name, Meta business portfolio ID and the access token Meta issues for that account. The token is stored encrypted and is never displayed.
• Technical data: IP address, device and browser identifiers, activity logs, errors and performance traces.

4. Why we use the data

• To provide the service: manage hotel and staff accounts, serve guests, create and track tickets, and send and receive WhatsApp messages on behalf of the hotel.
• To run the Apollo virtual assistant, which answers guests using artificial intelligence and uses the conversation history and stay details as context.
• To keep the platform secure, detect errors and abuse, and improve performance.
• To produce usage statistics for the hotel and for Horizon AI Agency LLC. Once those statistics are irreversibly anonymised they are no longer personal data.
• To comply with legal obligations and respond to requests from public authorities.
• To communicate with you about the service, your account and changes to these terms.

5. Legal basis

• Performance of the contract with the hotel, for everything needed to provide the service.
• The hotel's instructions as data controller, for guest data.
• Legitimate interest in security, fraud prevention and service improvement.
• Guest consent, where the hotel collects it for marketing communications or for uses that require it.
• Compliance with legal obligations.

6. WhatsApp and Meta services

Olympus uses the WhatsApp Business Platform (WhatsApp Cloud API) by Meta Platforms to send and receive messages on behalf of the hotel. When a hotel connects its WhatsApp Business Account to Olympus, it does so through Facebook Login for Business, and Meta provides us with the identifiers of that account and an access token. We use that data only to operate that hotel's messaging: register the phone number, receive guest messages, send replies and approved templates, and check the status of templates and of the account.

We do not use the data we receive from Meta for any other purpose, we do not sell or share it with third parties, and we delete it when the hotel disconnects its account, as described in the retention section and on the data deletion page.

WhatsApp messages are also subject to the WhatsApp Privacy Policy and Meta's WhatsApp Business Terms. Horizon AI Agency LLC complies with the WhatsApp Business Policy and the Meta Platform Policy.

7. Artificial intelligence

The Apollo virtual assistant answers guests using language models from third-party providers. We send those providers the content needed to generate each reply: the guest's message, the recent conversation history and the hotel and stay information needed to answer.

We do not use guest conversations to train our own models and we do not allow our providers to do so. The hotel can step into any conversation and continue with human staff.

8. Who we share data with

We share data only with the providers we need to deliver the service, under contracts that oblige them to process it only on our instructions.

• Meta Platforms (WhatsApp Business Platform), for messaging.
• Artificial intelligence model providers, to generate the virtual assistant's replies.
• Database, authentication and cloud hosting providers.
• Monitoring, error logging and product analytics providers.
• The hotel, which accesses the data of its own guests and staff.
• Public authorities where required by law.

9. International transfers

Horizon AI Agency LLC is based in the United States and some of our providers process data outside the European Economic Area. When we process data of people in the European Union we apply the safeguards provided for in the General Data Protection Regulation, such as the standard contractual clauses approved by the European Commission or the adequacy mechanisms in force.

10. How long we keep data

Guest conversations:

For as long as the hotel is an Olympus customer, with a necessity review every 36 months.

Guest profile:

While there is a relationship with the hotel and a service purpose. After 36 months without stays or interactions it is reviewed and anonymised or deleted according to the hotel's configuration.

Files sent over WhatsApp:

12 months. Files related to incidents, 24 months. Identity or sensitive documents, the minimum needed to complete the procedure.

Technical and error logs:

Up to 180 days.

Virtual assistant action log:

24 months.

WhatsApp account token and data:

Until the hotel disconnects its account or the contract ends.

Data of a hotel that ends its contract:

30 days for export or recovery. It is then deleted from active systems and removed from backups within 90 days at most.

Anonymised statistics:

No limit, since they no longer identify anyone.

We keep data only for as long as needed for the purpose it was collected for. These are the Olympus defaults. The hotel, as controller of its guests' data, can configure shorter periods.

• Where a law requires us to keep data longer, we keep it blocked and only for that purpose.

11. Your rights

You can request access to your data, rectify it, erase it, restrict or object to its processing, and request its portability. Where processing is based on your consent, you can withdraw it at any time.

To exercise them, write to admin@horizonaiagency.com stating which right you want to exercise. We reply within 30 days at most. If you are a hotel guest you can also contact the hotel, which is the controller of your data; we will help it handle your request.

If you believe we have not handled your request properly, you can lodge a complaint with the data protection authority in your country. In Spain that is the Agencia Española de Protección de Datos.

12. Security

We apply technical and organisational measures to protect data: encryption in transit, encryption of WhatsApp credentials at rest, isolation of each hotel's data, role-based access control, activity logging and backups. No system is infallible; if we detect a breach affecting your data we will notify you as required by law.

13. Children

Olympus is aimed at businesses and their adult guests. We do not knowingly process data of children under 16 without the involvement of a responsible adult.

14. Changes to this policy

We may update this policy when the service or the law changes. We will publish the current version on this page with its date, and will notify hotels of relevant changes in advance.

15. Contact

For any privacy question, write to admin@horizonaiagency.com or to the postal address given at the top.