Data Processing Agreement

Last updated: October 25, 2026 · Between the hotel business that opens a Lobby Engine account (the controller, "you") and Chirp USA, LLC, 336 E. College Ave, Tallahassee, Florida 32301, USA, a US company (the processor, "we") · info@syntheticbrew.ai

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you and us. You accept it when you open an account. It sets out the terms required by Article 28 of the EU General Data Protection Regulation (GDPR) and the UK GDPR, the Swiss Federal Act on Data Protection, and United States state privacy laws, for the personal data we process on your behalf when we run Lobby Engine for your hotel.

It covers the personal data of your guests, and of the staff whose numbers you give us. Your own account data is not covered here: for that we are the controller, and the Privacy Policy says what we do.

1. Definitions

Terms defined in the Terms of Service have the same meaning here. In addition:

• "Data Protection Laws" means all laws on privacy and personal data that apply to the processing under this DPA, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act (CCPA) and other US state privacy laws, the Brazilian LGPD, the Turkish KVKK, and the Saudi and UAE personal data protection laws.
• "Personal Data" means personal data, or personal information, as defined by Data Protection Laws, that we process on your behalf in providing the Service.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• "Standard Contractual Clauses" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the Standard Contractual Clauses issued by the UK Information Commissioner.
• "Sub-processor" means a company engaged by us that processes Personal Data.
• "Controller", "processor", "data subject", "processing", "business", "service provider" and "supervisory authority" have the meanings Data Protection Laws give them.

2. Roles and scope

Roles. You are the controller of Personal Data, and we are your processor. Under the CCPA and similar US state laws, you are the business and we are your service provider or processor (§13). Under the EU AI Act, we are the provider of the Lobby Engine assistant and you are its deployer.

Subject matter and duration. We process Personal Data to provide the Service for as long as your account exists, and afterwards only until it is erased under §12. The nature, purposes, categories of data and data subjects, and retention are described in §3 and in Annex I.

Your responsibilities. You are responsible for the lawfulness of the processing you instruct, for having a lawful basis for it, including for any special categories of data, for the information you give your guests, and for any consent the law requires of you, as §6 of the Terms of Service sets out. You will not instruct processing that breaks Data Protection Laws.

3. What we process, and why

Only on your instructions. We process Personal Data only on your documented instructions, including with regard to transfers outside the European Economic Area, unless the law requires us to do otherwise, in which case we tell you before processing, unless that law forbids telling you. Your instructions are: run the assistant for your hotel, answer your guests from the facts you gave it, record what was said so that you can read it, and pass a request or a contact to you; give the persons you authorize in the console access to Personal Data, as §6 describes; and, where you order them, carry out the setup and care services described in the Terms of Service. These Terms, this DPA, your orders for those services and the way you configure the assistant and its access in the console are your complete instructions; any additional instruction must be agreed in writing. If we believe an instruction breaks Data Protection Laws, we will tell you, and may decline to follow it until it is confirmed or changed.

Special categories of data are not asked for and not required. A guest may nonetheless mention something of that kind, such as a health, accessibility or dietary need; it is then treated like the rest of the message and erased on the same schedule.

Voice is heard, not recorded. When a guest speaks, in the browser or on a call your phone forwards to the assistant, their voice is passed to the company that runs the conversation so that it can be heard and answered; a call reaches it through the telephone operator that holds the number of your line. Neither we nor they record the audio: the assistant is set up not to keep it. What was said is kept as a written transcript, like a typed conversation, and erased on the same schedule.

4. What we will not do

We will not:

• process Personal Data for our own purposes, including to train, fine-tune or evaluate AI models, to build profiles, or to improve services for anyone else;
• sell Personal Data, or share it for cross-context behavioral advertising or targeted advertising;
• retain, use or disclose Personal Data for any purpose other than the business purposes in §3, or outside our direct business relationship with you;
• combine Personal Data with personal data we receive from or on behalf of anyone else, or collect from our own interactions with a person, except as Data Protection Laws allow to provide the Service to you;
• create voiceprints, biometric identifiers or voice embeddings, identify anyone by their voice, or infer emotions or sensitive characteristics from guests' voices or words;
• attempt to re-identify data that has been de-identified.

5. How long

Conversations and their messages are erased 90 days after they end: our copy, and the copy held by the company that runs the conversation, whose retention we set explicitly for this.

Requests and the contacts a guest left with a request are kept while your account exists, because they belong to the request.

The telephone operator that carries a call keeps its own record of it, with the numbers, the time and the length, as any telephone operator does, for as long as its own terms say; we do not set it. When your hotel is erased, everything goes with it after the 30-day window in the Terms of Service.

A text to you when a guest in a chat asks for a person carries what the guest asked and the number they left. About a day after the telephone operator has taken it, we erase its copy at the operator, and our record of it with it; the operator says a deleted message may stay in its backups for up to 30 days. In the rare case that we lose track of a text the operator has taken, because its answer to us is lost or our sending is cut off, and cannot find or erase it there afterwards, that copy stays with the operator under its own terms. If the operator does not yet let us erase its copy a day after taking the text, we keep trying and erase it as soon as the operator allows; the operator says that in rare cases this takes up to 14 days after it took the text. Meanwhile our record of the text holds only the operator's reference for it, with none of the guest's words and no number. If the copy still cannot be erased 14 days after the operator took the text, we ask the operator's support to erase it by that reference. A text that could not be sent is erased 30 days after it was given up on, or sooner. When your hotel is erased, the operator's copies go before ours, except one the operator does not yet let us erase a day after taking it, which goes as just described. The text on your phone is yours to keep or delete.

A text to you when a caller is to be called back carries the hotel's name, the caller's number and a link to the call, and none of the caller's words. Until our record of it is erased, or cut down to the operator's reference as described above, it holds the caller's number; otherwise it is handled as a text about a guest in a chat, above, and a text that could not be sent is erased with the number 30 days after it was given up on, or sooner.

Technical events received from the company that runs the conversation have their content cleared after 30 days and are deleted after 90 days. IP addresses used to limit abuse are kept for one day.

You may ask for a conversation or a contact to be erased sooner, and we will do it.

6. Confidentiality and personnel

Everybody we authorize to process Personal Data is bound by a duty of confidentiality, by contract or by law, and has access only to what they need for their work. We keep the number of people with access to a minimum.

Our staff doing setup and care. When you order the setup or care services described in the Terms of Service for a hotel, our staff work in your account for that hotel, with access to its Personal Data, while the order is open or the care service runs, and only for that work.

Persons you authorize. We give access to Personal Data in your account to the persons you authorize in the console, including the users of a Partner you link to a hotel, at the level of access you choose. Granting, changing and revoking that access are your instructions, and a change takes effect at once. Such persons act for you, not for us: they are not our Sub-processors, and what they do with the access you give them is not processing on our behalf. You are responsible for having with them the agreements Data Protection Laws require. We record, by the hour, the changes a Partner makes in your hotel and the parts of the console holding Personal Data that it opens, and show the record to you in the console; we keep it for 90 days.

7. Security

We implement and maintain the technical and organizational measures in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing and the risks to data subjects. Annex II describes what is actually in place, not what is planned: if a measure is not there, it is not listed, and the annex says so where a common measure is absent. We may change the measures as the Service develops, provided that the overall level of security is not reduced.

8. Sub-processors

Authorization. You give us general authorization to engage Sub-processors. The current Sub-processors are listed in Annex III, which you approve by accepting this DPA.

Changes. We publish the list on this page and tell you at the address on your account at least thirty days before a new Sub-processor starts processing Personal Data, or as soon as we can where a replacement is urgently needed to keep the Service running or secure.

Objection. You may object to a new Sub-processor on reasonable data protection grounds by writing to info@syntheticbrew.ai within that time. We will then discuss your concerns in good faith and try to offer an alternative. If we cannot, you may end your subscription for that reason, and we will refund the unused part of what you paid.

Obligations. We impose on each Sub-processor, by a written contract, data protection obligations that are no less protective than those in this DPA, and we remain fully responsible to you for its performance. On request, we give you the information you need about a Sub-processor's terms, which may be summarized or redacted to protect confidential information.

9. Transfers outside the European Economic Area

Our Sub-processors. ElevenLabs and OpenRouter, with the AI model provider OpenRouter passes a request to, process data in the United States. The transfer rests on the European Commission's Standard Contractual Clauses (Module Three, processor to processor), with these supplementary measures: everything written or said in a browser is encrypted in transit on every leg between the browser, us and these companies; the retention held by the company that runs the conversation is set explicitly by us rather than left at its default; special categories of data are neither asked for nor required; and a guest is known to us only by a signed random string, never by an account. A copy of the mechanism is available at info@syntheticbrew.ai.

Twilio, the telephone operator that holds the numbers of phone lines, processes a call in the United States, and so does the text it delivers to you when a guest in a chat asks for a person or a caller is to be called back. That transfer rests on the EU-U.S. Data Privacy Framework, under which Twilio Inc. is certified, and on the Standard Contractual Clauses of Twilio's data protection addendum where the Framework does not apply. A telephone call and a text message travel over the public telephone network, which is not encrypted, as any call or text does.

Between you and us. Our servers are in Germany. To the extent that the processing by us, a US company, involves a transfer of Personal Data from the European Economic Area that is not otherwise covered by an adequacy decision, the Standard Contractual Clauses, Module Two (controller to processor), apply between you as data exporter and us as data importer, and are incorporated into this DPA by reference, with these choices:

• Clause 7, the docking clause, applies;
• Clause 9(a), Option 2, general written authorization, applies, with the notice period in §8 of this DPA;
• the optional language in Clause 11(a) does not apply;
• Clause 13: the competent supervisory authority is that of the Member State in which you are established, or, where you are not established in the European Union, that of the Member State in which the data subjects concerned are located;
• Clause 17: the Clauses are governed by the law of Ireland;
• Clause 18: disputes are resolved by the courts of Ireland;
• Annexes I, II and III of the Clauses are completed by Annexes I, II and III of this DPA.

United Kingdom. For Personal Data protected by the UK GDPR, the UK Addendum applies, completed with the details in this section and Annex I; either party may end it as the UK Addendum allows when it is revised.

Switzerland. For Personal Data protected by the Swiss Federal Act on Data Protection, the Standard Contractual Clauses apply with these changes: references to the GDPR are read as references to that Act; the Federal Data Protection and Information Commissioner is the competent supervisory authority; and the term "Member State" does not exclude data subjects in Switzerland from bringing claims where they live.

Other countries. Where the law of your country sets its own clauses or conditions for a transfer, such as the standard contract under the Turkish KVKK, the clauses approved by the Brazilian ANPD, or the standard clauses of the Saudi Data and Artificial Intelligence Authority, we will sign them with you on request. Any filing or notification that law requires of the controller, such as notifying the Turkish Personal Data Protection Authority of a signed standard contract, remains yours to make, and we will give you what you need for it.

Assessment. A transfer impact assessment has not been carried out. When one is, it will be held with these documents and named here.

10. Requests from authorities

If we receive a request from a public authority for Personal Data, we will:

• refer the authority to you where we can, and tell you of the request unless the law forbids it;
• check the legality of the request, and challenge it where, after careful assessment, we conclude that there are reasonable grounds to consider it unlawful;
• disclose only the minimum the law compels;
• keep a record of the requests we receive and, where the law allows, give you information about them.

We have not created back doors or programs that give authorities access to Personal Data.

11. Helping you

Data subject requests. If a guest writes to us instead of you, we do not answer for you: we pass the request on and tell them we have. Taking into account the nature of the processing, we help you, by appropriate technical and organizational measures, to answer requests to exercise data subjects' rights, including to find, export, correct or erase data, without extra charge.

Security, assessments and consultation. Taking into account the nature of the processing and the information available to us, we help you meet your obligations on security of processing, Personal Data Breaches, data protection impact assessments and prior consultation with a supervisory authority, by giving you the information you reasonably need about the Service and how it processes data.

AI Act. We give you the information you reasonably need to use the assistant in line with the EU AI Act, and we will tell you before we change how the assistant tells guests that it is an AI.

Authorities. We cooperate with supervisory authorities in the performance of their tasks, as Data Protection Laws require.

Records. We keep the records of processing activities that Article 30(2) of the GDPR requires of a processor, and make them available to a supervisory authority on request.

12. Personal Data Breaches

We tell you without undue delay, and no later than 72 hours after becoming aware of a Personal Data Breach affecting Personal Data. We tell you what we know, as it becomes available:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures we have taken or propose to take, including to mitigate its possible adverse effects;
• a contact point for more information.

We take reasonable steps to contain, investigate and remedy the breach. Notifying the supervisory authority and the guests is yours to do, because you are the controller, and we give you what you need for it. We will not name you in a public statement about a breach without consulting you first, unless the law requires it. Our notice of a breach is not an admission of fault.

13. United States state privacy laws

Where the CCPA or a similar US state law applies, we process Personal Data as your service provider or processor. In addition to §4, we:

• process it only for the limited and specified business purposes in §3, which are providing the Service to you, and as the law permits a service provider;
• comply with the obligations that apply to us under those laws, and give Personal Data the same level of privacy protection those laws require of you;
• let you take reasonable and appropriate steps to ensure that we use Personal Data in a manner consistent with your obligations, including by the information and audit rights in §14;
• tell you if we determine that we can no longer meet our obligations under those laws;
• let you, on notice, take reasonable and appropriate steps to stop and remediate unauthorized use;
• help you respond to consumers' requests, as §11 describes;
• tell you of our Sub-processors, as §8 describes, and bind them by written contracts with these same obligations;
• delete or return Personal Data at the end of the Service, as §15 describes.

We certify that we understand these restrictions and will comply with them.

14. Audit and information

Once a year, or after a Personal Data Breach, or when a supervisory authority requires it, you may ask for the information you need to satisfy yourself that this DPA is kept, and we will provide it, including written answers to reasonable security questionnaires and a description of our measures. There are no on-site audit terms: the audit is satisfied by the information we provide, and we do not offer inspection of our premises. Where the Standard Contractual Clauses or Data Protection Laws give you a right of audit that the information we provide does not satisfy, you may exercise it with reasonable notice, at your cost, by an independent auditor bound by confidentiality, without access to other customers' data, during business hours, and without unreasonably disrupting the Service.

15. Return and deletion

When your account ends, we erase Personal Data on the schedule in §5 and in the Terms of Service: a hotel you ask us to delete is held for thirty days, during which you may ask us to export its data, and is then erased, including the copies at the provider that runs the conversation. We do not keep a copy afterwards, except where the law requires us to, in which case we tell you what and for how long, keep it confidential and process it only for that purpose. On request, we confirm in writing that the erasure has been carried out.

16. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service, to the extent Data Protection Laws allow; nothing limits either party's liability to data subjects under those laws, or under the Standard Contractual Clauses.

If this DPA conflicts with the Terms of Service on Personal Data, this DPA prevails. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.

This DPA is governed by the law that governs the Terms of Service, except where Data Protection Laws or the Standard Contractual Clauses require otherwise. We may update this DPA as §27 of the Terms of Service describes, and will not reduce the protection it gives Personal Data without your agreement, unless the law requires it.

Annex I — description of the processing

Data exporter and controller: the hotel business that opens a Lobby Engine account, as identified in its account. Contact: the email address on the account. Activities: using Lobby Engine to answer its guests. Role: controller.

Data importer and processor: Chirp USA, LLC, 336 E. College Ave, Tallahassee, Florida 32301, USA. Contact: info@syntheticbrew.ai. Activities: providing Lobby Engine, and the setup and care services the controller orders. Role: processor.

Categories of data subjects: the controller's guests and prospective guests who chat with or call its assistant; people who call the controller's phone line; the controller's staff whose numbers it gives for texts and transferred calls.

Categories of personal data: the content of chats and of calls as transcripts; names, email addresses and phone numbers that guests give; caller phone numbers and call times and durations; requests, with dates and numbers of people; languages; the page address where a chat started; a browser identifier; IP addresses for abuse prevention; staff phone numbers. Audio is processed in real time and not stored.

Sensitive data: none is required or asked for. Guests may volunteer health, accessibility, dietary or similar information in a conversation. Safeguards: short retention, access limited to the controller's account, exclusion from application logs, no use for any other purpose, and the measures in Annex II.

Frequency of the transfer: continuous, whenever guests contact the controller's assistant.

Nature of the processing: collection through chat and calls; real-time speech recognition and synthesis; AI-generated replies from the controller's facts; storage; display to the controller and to the persons it authorizes in its account, including the users of a Partner it links; delivery of texts to the controller's staff; setup and care services that the controller orders, performed by our staff in the controller's account; erasure.

Purpose: answering the controller's guests on its behalf and passing their requests and contacts to the controller.

Retention: as set out in §5.

Transfers to Sub-processors: as listed in Annex III, for the purposes stated there, for the duration of the Service.

Competent supervisory authority: as set out in §9.

Annex II — technical and organizational measures

Last verified against the running deployment on September 7, 2026, and against the code on October 8, 2026.

• Access to the service requires a signed session; a hotel's data is reachable only through a proof of ownership checked on every request, and a hotel that is not yours is answered exactly as a hotel that does not exist.
• The credential a website uses to embed the assistant is stored only as a digest and shown once.
• Operational routes that provision hotels are served on a listener bound to the loopback interface, and the service refuses to start if that listener is bound anywhere else.
• Passwords are stored only as a cryptographic hash.
• What a guest says is kept out of application logs.
• The assistant is set up not to record audio.
• Requests to the service are rate limited to prevent abuse.
• Erasure of a hotel removes its conversations, its facts and its assistants at the conversation provider, and is resumable so that an interrupted run finishes on the next pass.
• Retention periods are enforced by scheduled jobs that erase data when it falls due.
• TLS is terminated by our own edge on the server that runs the service, in Germany, with certificates issued by Let's Encrypt. Neither the service nor the database is reachable from outside that machine.
• The database is not encrypted at rest.
• There are no backups. The data is held on one server, and the loss of its disk would be final. This is stated because this annex lists what is in place and not what is planned.
• One administrator account reaches the server, over SSH and with a key; signing in with a password is disabled. Sign-ins are recorded in the machine's system journal.
• People with access to Personal Data are bound to confidentiality and have access only as needed.

Annex III — sub-processors