Privacy policy

This policy describes how Estevano processes personal data within its SaaS service for hotels. It is aligned with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on data protection.

1. Controller

Controller: POLARGATE, S.L. (Spanish tax ID B24895005), owner of Estevano. For any question about this policy or to exercise your rights, contact us at hello@estevano.com.

2. Dual role: controller and processor

Estevano acts in two distinct roles depending on the data:

• Controller for hotelier accounts (hotel staff who sign up to use the service): we process their email, name and usage data to deliver the service and manage the contract.
• Processor for guest data entered by the hotel or generated by guests using the app (name, room number, requests, chat messages, bookings). The hotel is the controller of that data; Estevano processes it solely on the hotel's behalf and following its instructions.

3. What data we process

• Hotelier account: email, name, hashed password, role within the hotel, technical usage data (access logs, IP).
• Hotel operational data: hotel name, service configuration, content, schedules.
• Guest data (on behalf of the hotel): name, room, requests, chat messages with the assistant, bookings, incidents. If the hotel uses them: phone number or email to send the access and other messages, conversations with the voice assistant and the device identifier for notifications.

4. Purposes and legal basis

• Delivering the service. Basis: performance of contract.
• Maintenance, security and improvement of the service. Basis: legitimate interest of Estevano and the hotel.
• Compliance with legal obligations (billing, authority requests). Basis: legal obligation.

5. Providers and sub-processors

To deliver the service we rely on technology providers acting as processors or sub-processors, under contract and following our instructions. They fall into these categories:

• Cloud hosting and database (based in the US): store the service data, manage account sign-in and serve the web app. They receive the data described in section 3.
• Artificial intelligence for the chat assistant and request handling (based in the US): generates the chat assistant's replies, reads the conversation of each request to pull out useful hotel information, and tags requests and incidents. It receives the chat messages, the request conversation (including staff messages), incident descriptions and the hotel information needed to reply.
• Artificial intelligence for translation and search (based in the US): translates messages between the guest and the staff and searches the hotel's information for what the guest asks in the chat and the voice assistant. It receives the text of the messages being translated and the guest's questions.
• Voice assistant (based in the US): handles conversations with the hotel's voice assistant, by phone and, if the hotel turns it on, in the app. It receives the audio of the conversation, its transcript, the details the guest gives in it (for example, name or room) and, for calls, the caller's phone number.
• SMS, WhatsApp and phone lines (based in the US): sends SMS and, if the hotel turns it on, WhatsApp messages (for example, access to the app or booking notices) and receives the replies. It also provides the hotel's phone number through which calls reach the voice assistant. It receives the phone number, the content of the messages and, for calls, the caller's number and the audio while it passes the call to the assistant.
• Email delivery (based in the US): sends the service emails (for example, access to the app, booking confirmations, staff invitations or password resets). It receives the email address, the content of the message and whether the email is opened and which links are clicked.
• Notifications on phones and browsers (based in the US): the operating systems' and browsers' notification services deliver notifications to the device. They receive the device notification identifier and the content of each notification, which may include the guest's or staff's message and the room number.
• Payment processing: charges the hotel's Estevano subscription. It receives the hotel's billing and payment details and the email of the person who subscribes. It does not receive guest data.

6. Retention

We keep the data for the duration of the contract with the hotel and afterwards for the applicable legal periods (typically up to six years for accounting). Guest chat messages and requests are kept according to the hotel's configuration and may be deleted on request.

7. International transfers

Providers marked as based in the US may process data outside the European Economic Area. That transfer relies on the EU-US Data Privacy Framework where the provider is certified (adequacy decision under Article 45 GDPR) and, where it is not, on the Standard Contractual Clauses approved by the European Commission or other appropriate safeguards under Article 46 GDPR.

8. Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction and portability by writing to hello@estevano.com. If you are a guest of a hotel that uses Estevano, please address your request to the hotel, which is the controller of your data; we will help route it. You have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

How to delete your account and your data, step by step: Delete your account and your data.

9. Security

We apply reasonable technical and organizational measures: TLS in transit, role-based access control, logical tenant isolation, backups and audit logging. We do not claim certifications we do not hold.

10. Changes

We may update this policy. The last-updated date appears in the header. For material changes we will notify the hotel customer through usual channels.