Privacy Policy

Last updated: October 25, 2026 · Controller: Chirp USA, LLC, 336 E. College Ave, Tallahassee, Florida 32301, USA, a US company · Questions and requests: info@syntheticbrew.ai

Lobby Engine is an AI concierge for hotels, made by Chirp USA, LLC ("Chirp USA", "we", "us", "our"). It answers a hotel's guests in a chat on the hotel's website, on a hosted page behind a printed code, in the browser by voice, and on the phone, from the facts the hotel gives it.

This Privacy Policy explains what personal data is processed when you use Lobby Engine or our website, why, on what legal basis, who receives it, where it goes, how long it is kept, how it is protected, and what rights you have. It covers these groups of people, and says which is which throughout:

• Guests: anyone who chats with or calls a hotel's assistant;
• Hotel customers: the people who open and use a Lobby Engine account for their hotel, and staff whose phone numbers a hotel gives us;
• Partners: people at businesses that take part in our partner program, such as web studios that work for hotels;
• Visitors: people who visit our website, lobbyengine.ai, book a call with us, or write to us;
• Business contacts: people at hotels and partners we deal with or contact about our service.

This policy does not cover how a hotel itself uses what you told its assistant, which the hotel's own privacy notice explains, or the websites and services of others that we link to.

In short

• If you are a guest, the hotel you are talking to decides what happens with your conversation, and we process it on the hotel's behalf.
• The assistant is an AI and says so at the start of every call, and the chat is labeled as one.
• Your voice is not recorded. Conversations are kept as text and erased 90 days after they end.
• We do not sell personal data, use it for advertising, or use conversations to train AI models. We do not create voiceprints.
• Our servers are in Germany. Some of the companies that help us run the service are in the United States, and transfers to them are protected as the law requires.
• On our website, analytics and marketing cookies are used only if you allow them, and you can change your mind at any time.
• You can ask us at any time what we hold about you, and have it corrected or erased: info@syntheticbrew.ai.

1. Who is responsible for my data?

Guests. The hotel you are talking to is the controller of your conversation: it decides why and how your data is processed. We run the assistant for the hotel and act only on its documented instructions, as its processor under the EU and UK General Data Protection Regulation (GDPR), and as its service provider or processor under United States state privacy laws. Our Data Processing Agreement with every hotel sets out what we may and may not do. The hotel's own privacy notice tells you how the hotel uses what you said, and the hotel is your first point of contact. You may also write to us at info@syntheticbrew.ai; we will pass your request to the hotel and help it answer.

Hotel customers, partners, visitors and business contacts. We are the controller of your account data, of the data collected on our website, of the data of our partner program, and of our dealings with you. A partner working in a hotel's console acts for that hotel, which is the controller of its guests' data there.

AI. Under the EU AI Act, we are the provider of the Lobby Engine assistant, and each hotel that uses it is a deployer.

Contact. Our channel for every data protection matter, including requests under Brazilian law, is info@syntheticbrew.ai, or by post to Chirp USA, LLC, 336 E. College Ave, Tallahassee, Florida 32301, USA.

2. What data does Lobby Engine collect, and why?

Guests who chat with or call a hotel's assistant

We collect this data on the hotel's behalf, from you, while you talk to the assistant. The hotel is the controller and decides the legal basis; hotels usually rely on taking steps at your request before a booking, on performing your booking, or on their legitimate interest in answering guests' questions.

What is not collected. No audio: when you speak to the assistant, in the browser or on a call, your voice is passed to the company that runs the conversation (§3) so that it can be heard and answered, and neither we nor that company record it. Only the words are kept, as text. No voiceprint is made, and you are not identified by your voice. No payment details: the assistant takes no payments. No precise location. No advertising or tracking identifiers of any kind. The chat sets no cookies on the hotel's website.

You do not have to give personal data to ask the assistant a question. If you do not leave a way to reach you, the hotel cannot come back to you about a request.

Please do not share card numbers or other sensitive details. The assistant never needs a payment card number, a password, or an identity document number, and you should not give them. If you mention health, accessibility, dietary or similar needs so that the hotel can help you, they are passed to the hotel with the rest of the conversation and erased on the same schedule. Tell the hotel directly if you would rather not have them in a conversation.

If you ask for a person in a chat, what you asked and the number you left in that conversation are sent to the hotel's owner as a text message, through the telephone operator in §3, so that somebody can come to you. This happens only where the owner has given us a mobile number for these texts. About a day after the operator has taken the text, we erase its copy at the operator, and our record of it with it; the operator says a deleted message may stay in its backups for up to 30 days. If the operator does not yet allow the copy to be erased a day after taking it, we keep trying and erase it as soon as the operator allows; the operator says that in rare cases this takes up to 14 days. Meanwhile our record of the text holds only the operator's reference for it, with none of your words and no number, and if the copy still cannot be erased after 14 days, we ask the operator's support to erase it by that reference. In the rare case that we lose track of a text the operator has taken, because its answer to us is lost or our sending is cut off, and cannot find it there afterwards, that copy stays with the operator under its own terms. A text that could not be sent is erased 30 days after it was given up on, or sooner. The text on the owner's phone is theirs, like any message they receive.

If you call and the hotel is to call you back, because you left a message or a request, or the assistant put you through to the hotel and the telephone operator tells us nobody answered, your phone number is sent to the hotel's owner as a text message through the telephone operator in §3, with the hotel's name and a link to the call, so that somebody can call you back. The number is the one you gave the assistant or, if you gave none, the one you called from. A withheld number is never sent, and none of your words are in the text. This happens only where the owner has given us a mobile number for these texts and has not switched them off. Our record of the text holds your number until it is erased or cut down to the operator's reference as described above.

When the hotel steps in. The hotel can read your conversation and reply in the chat itself; its replies are marked as coming from the hotel. On a call, the assistant can put you through to a number the hotel has given.

Hotel customers

We collect this data from you when you open and use an account, from Google if you sign in with Google, and from Stripe when you pay.

We never see or store your card details: Stripe holds them. Giving us the data needed for your account is required by our contract; without it we cannot provide the service. We do not send you marketing email without your consent; letters about your account, your bills, security and changes to the service are part of the service.

Staff of a hotel. If a hotel gives us your mobile number for texts or for calls put through to you, we received it from the hotel and use it only for that, as the hotel's processor. Ask the hotel, or us, to stop.

Partners

We collect this data from you when you join our partner program and use your partner panel, and from the hotels that link you. Your sign-in and your account are handled as for hotel customers above.

What hotels see about you. A hotel that links you sees your company's name and the access it gave you, and, if you set up and look after assistants yourself, the email address, phone number and line you gave for clients. It also sees the record of what you did in its console.

Guests' data in a hotel's console. What you see and do in a hotel's console, you do for that hotel, as its processor or as a person it authorizes, and not for us. This policy does not cover what you do with that data; your agreement with the hotel does.

Visitors to lobbyengine.ai

Google Analytics runs in Google's consent mode. Before you choose, and if you decline, Google receives only cookieless signals, such as the page, your browser type and the fact that consent was not given, and no cookie or identifier is stored on your device; Google uses these signals for aggregate modeling.

Amplitude does not load at all unless you allow statistics. It then records each page you view, its title and address, the page that sent you, and the campaign tags in the link you followed, such as utm_source and utm_campaign; your browser, device, operating system and language; and your IP address, from which Amplitude derives your approximate country, region and city. It keeps a random device identifier and your session in a cookie, and the campaign that brought you in a second cookie (§6). It does not record what you type, the text of what you click, or a replay of your visit: we have switched off its capture of clicks, forms and downloads, we do not use its session replay, and our website does not accept capture settings from Amplitude's side, so they cannot be switched on there without a change to our website.

Ahrefs Web Analytics loads only after you allow statistics. It measures page URLs, referrers, link clicks and other interactions, browser and device information, language, and approximate country or city. According to Ahrefs' Web Analytics documentation, it uses no cookies or persistent identifiers by default. It processes the IP address to derive location and a daily visitor count, discards the raw IP address without storing it in its database or logs, and replaces and deletes the salt used for daily counting every 24 hours. This daily rotation does not mean that historical traffic reports are erased every day. Ahrefs also uses aggregated data for service improvements and anonymized studies.

Google Tag Manager loads the tag container; it is separate from Google Analytics. Loading the container sends Google the technical information in a browser request. It does not give optional tags permission to ignore your consent. We do not use its noscript iframe, so browsers with JavaScript disabled do not load that fallback.

These analytics installations cover our public marketing pages, not the account console or a hotel's guest chat or voice surfaces. Our marketing website has no forms that collect what you type. You can change or withdraw your choice using the cookie icon on a marketing page. If you withdraw statistics or marketing consent, the page refreshes to unload the trackers that were already running. Withdrawal does not undo processing that took place before your choice changed.

Business contacts

If you work for a hotel or a partner we deal with, or we contact you about Lobby Engine, we use your name, role, business contact details and our correspondence, which we get from you or from public business sources such as your hotel's website. We do this on the basis of our legitimate interest in developing and running our business. You can object at any time, and we will stop.

Our legitimate interests

Where we rely on legitimate interests, they are: keeping the service and our website secure and working; preventing abuse and fraud; keeping records of agreements and our dealings; protecting hotels' accounts and showing a hotel what a partner did in it; paying accurate commissions; answering enquiries; and developing our business with hotels. We rely on them only where they are not overridden by your interests and rights, and you can object (§11).

3. Which companies process data for Lobby Engine?

Each of these companies processes the data on our instructions, under a contract that obliges it to protect the data, except that Telegram, Google and Ahrefs also act under their own terms for the services described.

The telephone operator that carries a call keeps its own record of it, with the numbers, the time and the length, as any telephone operator does, for as long as its own terms say.

Partners a hotel links. If a hotel customer links a hotel to a partner, such as the web studio that runs its website, that partner sees in its partner panel the hotel's name, its state (for example, in setup, live or paused), its plan tier, when it was linked and with what access, and, for each payment of the hotel's plan, its date, the amount the commission is based on, the commission and its status. Only the hotel customer can create the link, and nothing is shown to a partner before it does. After the link ends, the partner still sees the hotel among its former clients, with the commissions it earned. We disclose this because the hotel customer asked us to by linking the partner, and to pay and account for the partner's commission (contract with the hotel customer, and our legitimate interest in accurate commissions). Within the hotel's console, the partner sees what the access chosen by the hotel customer allows, and acts for the hotel, not for us. A partner is a separate business and handles this data under its own responsibility.

Signing in with Google. If you choose to sign in with Google, Google tells us your name, email address and Google account ID, and handles the sign-in under its own privacy policy.

Booking a call with us. If you book a call from our website, the booking is taken by Calendly, which collects your name, your email address and the time you chose, and does so under its own privacy policy. We receive those three things from it so that we can hold the call.

Others. We disclose personal data to others only:

• where the law requires it, for example to answer a valid court order or a lawful request from an authority, which we check and, for guests' data, refer to the hotel where we can;
• to our professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality;
• to our bank, to pay a partner the commissions we owe it;
• to protect the rights, property and safety of people or of our service, including to investigate fraud and abuse;
• if our business, or part of it, is merged, sold or reorganized, to the new owner under the same commitments, telling you before it happens.

When the list above changes, the new version is published here with a new date. Hotels are told before a new company starts processing their guests' data, as the Data Processing Agreement sets out.

4. Is my data transferred outside Europe?

Our servers are in Germany. Several of the companies in §3 are in the United States or elsewhere outside the European Economic Area, so data passes to them. We protect these transfers as follows:

Ahrefs. Its Privacy Policy describes its international processing. Its Data Processing Addendum and US Data Processing Addendum explain the applicable terms and how transfer clauses are executed. We do not treat publishing those terms as proof that separately signed clauses are in place, or claim that permission for statistics by itself supplies an international-transfer safeguard. The Web Analytics data practices are described separately in §2. You can contact us for information about our arrangements.

For people in the United Kingdom and Switzerland, the same clauses apply with the UK Addendum and the Swiss amendments, and the UK and Swiss extensions of the Data Privacy Framework apply to certified companies. You can ask us for a copy of these safeguards at info@syntheticbrew.ai.

Guests' data from other countries. Where the law of a hotel's country sets its own rules for sending personal data abroad, such as Turkey, Brazil, Saudi Arabia or the United Arab Emirates, we sign the standard clauses that law requires with the hotel on request.

5. How long is my data kept?

We keep personal data only as long as needed for the purposes in §2, and then erase or anonymize it.

A hotel may ask us to erase a conversation or a contact sooner, and we do. We keep data longer only where the law requires it, or to establish, exercise or defend legal claims, and then only what is needed.

6. Which cookies and local storage does Lobby Engine use?

Cookies are small files a website stores in your browser; local storage and session storage work in a similar way. Some are strictly necessary for a service you asked for and need no consent. Others need your consent.

In a hotel's chat, on the hotel's website. The chat sets no cookies. It keeps one random, signed identifier in your browser's local storage, under a key beginning with hotels.visitor., so that a returning browser is shown its own earlier conversation and nobody else's. It contains no name, email or anything else about you, it is sent only to us, and it stays until you clear your browser's site data. The hotel operates its website and is responsible for its cookie notice.

On our hosted pages and in the console:

On lobbyengine.ai:

The details view of the cookie banner lists every cookie with its provider, purpose and lifetime, and is kept up to date by Cookiebot's regular scans. You can open it again, and change or withdraw your choice, at any time from the cookie icon at the bottom of every page. You can also delete or block cookies in your browser's settings, although some parts of a site may then not work. Ahrefs has no cookie entry because its default Web Analytics tracker is cookieless, but we still require statistics consent for it. Tag Manager's request-log retention is documented in Google's privacy and security notice. We do not respond differently to browser "Do Not Track" signals. Rejecting optional categories stops Ahrefs and Amplitude and prevents Google Analytics cookies; Google's limited cookieless consent-mode signals and the technical Tag Manager requests described in §2 can still occur.

7. How does the AI assistant use my data?

It tells you it is an AI. The assistant says so in the first sentence of every call, and the chat is labeled as an AI assistant. Hotels may not remove or contradict this.

How it works. The assistant listens to what you say or reads what you type, turns speech into text, finds the answer in the facts the hotel gave it, and replies in writing or in a synthetic voice. The AI providers in §3 process the conversation to produce the replies.

No significant automated decisions. The assistant does not make any decision with a legal or similarly significant effect on you. It answers questions and passes requests to the hotel, and people at the hotel decide what to do with them. You can always ask to reach a person.

No training, no voiceprints. We do not use conversations to train or fine-tune AI models. We do not create voiceprints, biometric identifiers or voice embeddings, and we do not identify anyone by their voice. We do not infer emotions or sensitive characteristics from what you say.

Accuracy. AI can make mistakes. If an answer matters to you, such as a price, an opening time or a policy, confirm it with the hotel.

8. Sensitive data, payment cards and children

Sensitive data. The assistant does not ask for health information or other special categories of personal data. If you share them so that the hotel can accommodate you, they are treated like the rest of the conversation, passed to the hotel, and erased on the same schedule.

Payment cards. The assistant takes no payments and is not designed to receive card numbers. Do not give a card number, security code or bank details in a chat or on a call; the hotel will take payment in another way.

Children. Lobby Engine accounts are for adults acting for a business; you must be 18 or older to open one. The assistant answers whoever contacts a hotel and does not ask for anyone's age, but it is not directed at children, and hotels may not use it on services directed at children. We do not knowingly collect personal data from children under 13 in the United States, or under the age of digital consent where they live in Europe (from 13 to 16, depending on the country; 15 in Greece). If you believe a child has given personal data in a conversation, tell the hotel or write to us, and it will be erased.

9. How is my data protected?

We protect personal data with technical and organizational measures suited to the risk, including:

• encryption in transit between your browser, our servers and the companies in §3, except that a telephone call and a text message travel over the public telephone network, which is not encrypted, as any call or text does;
• a server in Germany that only one administrator can reach, with a key rather than a password, and a database that is not reachable from outside that server;
• access to a hotel's data only through its own account, checked on every request;
• passwords stored only as a cryptographic hash, and keys for embedding the chat stored only as a digest;
• guests' words kept out of our application logs, and audio never recorded;
• limits on requests to prevent abuse;
• short retention periods, and erasure that reaches our providers' copies.

The Data Processing Agreement lists the measures in place, including those not yet in place. No system is perfectly secure. If a breach affects your data, we act to contain it and tell the hotel, the authorities and you as the law requires.

10. What are my privacy rights?

Depending on where you live, you have some or all of the rights described in §11 to §15. To exercise any of them, write to info@syntheticbrew.ai.

• Guests: the hotel decides about your conversation, so we pass your request to the hotel and help it answer. We tell you when we do, and to which hotel.
• Verification: we may need to confirm who you are before acting on a request, and ask only for what we need to do so, for example the phone number you called from or the email address on your account.
• Agents: you may use an authorized agent where your law allows; we may ask for proof of the agent's authority and confirm your identity with you.
• Timing: we answer within one month, or within a shorter period where your law requires, and tell you if we need more time as the law allows.
• Cost: requests are free, unless they are manifestly unfounded or excessive.
• No discrimination: we will not treat you differently for exercising a right.
• Appeals: if we decline a request, we explain why. Where your law gives you an appeal, reply to our answer and ask for one, and we will tell you the outcome and how to complain to an authority.

11. Rights in the European Economic Area, the United Kingdom and Switzerland

Under the GDPR, the UK GDPR and the Swiss Federal Act on Data Protection, you have the right:

• to know whether we process your personal data, to receive a copy of it, and to receive information about how it is processed;
• to have inaccurate data corrected and incomplete data completed;
• to have your data erased, for example when it is no longer needed or you withdraw consent;
• to restrict processing, for example while you contest its accuracy;
• to receive data you gave us in a structured, machine-readable format, and to have it sent to another controller, where the processing is based on consent or contract and carried out by automated means;
• to withdraw a consent at any time, without affecting what was done before;
• not to be subject to a decision based solely on automated processing with legal or similarly significant effects; Lobby Engine makes no such decisions.

Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. You may object at any time, without giving reasons, to any use of your data for direct marketing.

Complaints. You can complain to the data protection authority of the country where you live or work, or where you think your rights were infringed: in the European Union, any national authority, such as the Hellenic Data Protection Authority in Greece; in the United Kingdom, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would like the chance to put things right first, so please write to us too; we acknowledge complaints and answer them without undue delay.

12. Notice for United States residents

This section applies to residents of California and other US states with comprehensive privacy laws, to the extent those laws apply to us. It supplements the rest of this policy.

What we collect, and why. In the last twelve months we collected these categories of personal information:

Sensitive personal information. We collect account login credentials (an email address with a password, stored only as a hash) only to let you sign in. A tax form a partner sends us may contain a tax identification number, which we use only to meet our tax obligations. Guests may volunteer sensitive information in a conversation; it is processed only to provide the service. We do not use or disclose sensitive personal information for any purpose that would give a right to limit it.

Retention. How long each category is kept is set out in §5.

Sale and sharing. We do not sell personal information for money, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We do not use guests' or hotel customers' data for advertising. Some state laws may treat allowing Google Analytics to collect data about your visit to our website as a "sale" or "sharing" for cross-context behavioral advertising, or as targeted advertising. On our website this happens only if you opt in to statistics or marketing cookies; you can opt out at any time from the cookie icon at the bottom of every page, which is our "Do Not Sell or Share My Personal Information" choice.

Your rights. Depending on your state, you have the right to know what personal information we collect, use and disclose, and to receive a copy; to have it deleted; to have it corrected; to opt out of its sale or sharing and of targeted advertising; and not to be discriminated against for exercising these rights. Submit a request by email to info@syntheticbrew.ai. We confirm receipt within 10 business days and answer within 45 days, which we may extend once by 45 days when reasonably necessary, telling you why. Verification, authorized agents and appeals work as described in §10.

Guests. For guests' data we are the hotel's service provider, so we pass your request to the hotel, which decides it.

Financial incentives. We offer none in exchange for personal information.

California "Shine the Light". We do not disclose personal information to third parties for their own direct marketing purposes.

Nevada. We do not sell covered information as Nevada law defines it. You can still send us a request to opt out at info@syntheticbrew.ai.

13. Notice for residents of Brazil

Under the Lei Geral de Proteção de Dados (LGPD), Chirp USA is the controller of the data described in §1, and each hotel is the controller of its guests' data. The purposes, legal bases, recipients and retention periods are described in §2 to §5; international transfers are protected as described in §4, including by standard contractual clauses approved by the National Data Protection Authority (ANPD) where required.

You have the right to: confirmation that your data is processed; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law; portability; deletion of data processed with your consent; information about the public and private entities with which we share data; information about the possibility of refusing consent and its consequences; withdrawal of consent; and review of decisions taken solely on the basis of automated processing. Our channel for data protection matters is info@syntheticbrew.ai. You may also petition the ANPD.

14. Information notice for residents of Turkey

This notice is given under Article 10 of the Personal Data Protection Law No. 6698 (KVKK).

• Data controller: Chirp USA, LLC, for the data described in §1. For guests' conversations, the hotel is the data controller, and we process the data on its behalf.
• Purposes: the purposes listed in §2, including providing the service, billing, security, communications and, with consent, website analytics.
• Recipients and reasons: the companies in §3, for the reasons stated there, and authorities where the law requires; transfers abroad take place as described in §4, under the safeguards the KVKK allows, including standard contracts.
• Method and legal basis: data is collected electronically, through the chat, calls, our website, the console and email, on the bases of the establishment and performance of a contract, legal obligations, our legitimate interests, and, for website analytics, your explicit consent.
• Your rights under Article 11: to learn whether your data is processed; to request information about it; to learn the purpose of processing and whether data is used accordingly; to know the third parties to whom it is transferred in Turkey or abroad; to request correction of incomplete or inaccurate data; to request deletion or destruction under Article 7; to request that correction or deletion be notified to the third parties to whom data was transferred; to object to a result against you arising solely from automated analysis; and to claim compensation for damage from unlawful processing.

Send applications to info@syntheticbrew.ai or by post to our address. We answer within thirty days. You may complain to the Personal Data Protection Board.

15. Notice for residents of Saudi Arabia, the United Arab Emirates and other countries

Saudi Arabia. Under the Personal Data Protection Law, you have the right to be informed of how your data is collected and processed, which this policy does; to access your data and obtain a copy; to have it corrected, completed or updated; and to have it destroyed when it is no longer needed. You may withdraw consent at any time, and complain to the Saudi Data and Artificial Intelligence Authority (SDAIA). Transfers outside the Kingdom take place as described in §4.

United Arab Emirates. Under Federal Decree-Law No. 45 of 2021, you have the right to receive information about the processing of your data, including its categories, purposes, recipients inside and outside the UAE, safeguards for transfers, retention and automated decisions; to access, correct and erase it; to restrict and object to processing; and to complain to the UAE Data Office.

Other countries. Wherever you live, you may ask us what we hold about you and have it corrected or erased. We will honor the rights your local law gives you.

16. Links, changes and language

Links. Our website and the console link to sites of others, such as Calendly, Google and Stripe. Their own privacy policies apply to them.

Changes. When this policy changes, we publish the new version here with a new date at the top. If a change materially affects what is done with your data, we also tell hotel customers at the address on their account before it takes effect, and, where the law requires, ask for consent again.

Language. This policy is written in English. A translation, if provided, is for convenience, and the English version prevails, except where your local law requires otherwise.

17. How do I contact you?

Chirp USA, LLC · 336 E. College Ave, Tallahassee, Florida 32301, USA · info@syntheticbrew.ai