How we handle personal data — for people who visit this site, hotel staff who use our dashboard, and hotel guests whose calls our service answers.
ALLHOURDESK LIMITED (“AllHourDesk”, “we”, “us”), a private company limited by shares with company number 823802, operates the AllHourDesk AI voice concierge service.
For questions about this policy or your personal data, contact support@allhourdesk.com.
This distinction determines who is responsible for what, so it comes first.
If you contact us or book a demo, we collect the details you give us — typically your name, email address, property name and anything you write to us. This site does not use analytics or tracking cookies.
Account details (name, work email, role) and authentication records, plus a log of significant actions taken in the dashboard.
Where a hotel has enabled our service on its line, we may process, on that hotel's instructions:
We never collect card numbers. Payment happens on a hosted payment page provided by our payment processor. Card details are not spoken on the call, not captured by the agent, and are never stored by us or passed to the hotel.
The agent answering the call is an AI, and it says so at the start of every call, in the caller's language, as required under the EU AI Act.
Whether calls are recorded, and for how long recordings are kept, is configured per hotel and per country, because consent requirements differ across jurisdictions — some require only one party to consent, others require all parties. Where recording is enabled, the purpose is stated at the start of the call and consent is captured where local law requires it. A caller who does not wish to be recorded can ask to be transferred or call back during staffed hours.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and running demos | Legitimate interests, or steps prior to entering a contract |
| Providing the service to a hotel | Performance of our contract with the hotel |
| Handling a guest's booking on a call | Determined by the hotel as controller — typically performance of the guest's booking contract |
| Recording calls | Consent, or the hotel's documented legitimate interests, depending on jurisdiction |
| Security, fraud prevention and service reliability | Legitimate interests |
| Meeting legal and accounting obligations | Legal obligation |
We use a small number of specialist providers to deliver the service. Each is bound by a data processing agreement and may only act on our instructions.
| Provider | Role |
|---|---|
| Twilio | Telephony — carrying the phone call itself |
| ElevenLabs | Speech recognition and speech synthesis for the voice agent |
| Meta Platforms (WhatsApp Business Platform) | Delivery of payment links and booking confirmations by WhatsApp |
| Sendmode | SMS delivery |
| Stripe | Payment processing and hosted payment pages |
| Amazon Web Services | Hosting, databases and identity infrastructure |
| The hotel's own property management system | Receiving and storing the resulting reservation |
Our infrastructure is hosted in the European Union by default. Some of the providers listed above are established outside the EEA; where personal data is transferred internationally, we rely on the European Commission's Standard Contractual Clauses or another valid transfer mechanism.
Enquiry correspondence is kept for as long as needed to deal with your enquiry and a reasonable period afterwards. Hotel account data is kept for the life of the contract plus any period required for accounting and legal purposes.
Guest call recordings, transcripts and booking records are kept according to the retention schedule agreed with each hotel, and are deleted at the end of it.
Under the GDPR you may request access to your personal data, correction of it, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing is based on consent, you can withdraw that consent at any time without affecting what happened before.
To exercise these rights, contact support@allhourdesk.com. If your data was processed as part of a call to a hotel, please contact that hotel as well, as they are the controller.
You also have the right to complain to a data protection supervisory authority.
Access to personal data is restricted to those who need it. Credentials and tokens belonging to hotels are encrypted at rest, data is segregated by tenant, and access to production systems is logged. No system is perfectly secure, but we treat payment data and call recordings as the two most sensitive things we touch and design accordingly — which is why card data never enters our systems at all.
We will update this policy as the service develops and will change the date at the top when we do. Material changes affecting hotels will be notified directly.