Privacy Policy

Ovelio

• Your account: name, e-mail address, password (stored only as a hash), language, whether your address is confirmed and when you accepted the terms. If you sign in with Google: your Google account's id and picture.
• Sign-ins: IP address, browser and times.
• What you do in the platform: the activity log records who changed what and when.
• Hotel requests: the hotel's details, a phone number and your message.
• API keys and connected AI apps you create (keys are stored only as a hash).
• The e-mails we send you and whether they were delivered.

• To run your account and the platform, and to send the e-mails that go with it (confirmation, new password, invitations, requests): performance of a contract (Article 6(1)(b) GDPR).
• For security, preventing misuse and the activity log: legitimate interests (Article 6(1)(f)).
• Where the law requires us to keep or hand over data: legal obligation (Article 6(1)(c)).

We don't sell data, show ads, or send marketing e-mails without consent.

Only those needed to run the platform, as our processors:

• The provider that hosts our servers.
• Resend (sending e-mail).
• Google: only if you sign in with Google, or a hotel connects a mailbox for CVs.
• Anthropic (Claude): reads the CVs a hotel receives, when it uses recruiting.
• Stripe, Wrapp (myDATA), Channex and PostShiba: only when a hotel uses online payments, tax documents, booking sites or newsletters; mostly the hotel's data.

Where data goes outside the EEA (for example to the USA), it does so under the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

• An account whose e-mail address is never confirmed: deleted automatically 7 days after sign-up.
• Your account: as long as it exists; ask us to delete it at any time.
• Sign-ins: expire a year after last use.
• Hotel requests: deleted 12 months after the decision.
• Activity log: as long as the hotel data it belongs to.
• Backups: 14 days.

The platform uses only necessary cookies, with no advertising or analytics cookies:

• sign-in (to keep you signed in for up to a year, and for several accounts in one browser);
• the list of accounts that signed in on this browser (a year; remove them with × on the sign-in page);
• your language and the hotel you are working in;
• your light/dark theme choice, kept in the browser.

Hotels' websites and booking engines have their own notice; each hotel sets up visitor analytics there.

E-mails hotels send their guests through the platform (newsletters, pre-check-in, bookings) record, unless the hotel turns it off, when they were opened and which links were clicked, with an invisible image and links through the hotel's address; IP addresses are not stored.

HTTPS only, passwords and keys stored as hashes, secrets (such as providers' keys) encrypted, role-based access, an activity log and daily backups.

You can ask for access, correction, deletion, restriction, portability, and object to processing: write to us at the contact details. If you think your rights were breached, you can complain to the Hellenic Data Protection Authority (www.dpa.gr).

For data a hotel keeps about you (for example as a guest), contact the hotel; we will help it answer.

If anything material changes, we tell you by e-mail or in the platform. The date at the top shows the last change.