Privacy Policy

Who we are and our role

The Service is provided to hotel companies and chains (our “customers”) for their sales teams. You normally have an account because your employer invited you.

For the personal data of a customer’s employees that is processed through the Service, the customer is the data controller and we act as its data processor: we process that data only to provide the Service and on the customer’s documented instructions. The customer decides what data is entered and who in its organisation can see it.

For the limited data we handle for our own purposes (keeping the Service secure, monitoring errors, answering requests you send us, and managing our relationship with customers) we are the data controller. Our lawful basis for this is [HUKUKİ DAYANAK].

The main data protection law that applies is the UK GDPR together with the Data Protection Act 2018. To the extent that the EU GDPR or the Turkish Personal Data Protection Law (KVKK) also applies to you, this policy is intended to meet it as well.

The personal data we process

Depending on the features you use, the Service processes the following.

Account and identity

Your name, work e-mail address, hotel, job title and permission level (sales rep, hotel manager or chain manager), the date the account was created, and an internal flag recording whether you are exempt from mandatory two-step login. Passwords and two-step login codes are handled by our authentication provider (Supabase); we do not see or store your password in readable form.

Invitations

If your employer invited you through a bulk import: your name, work e-mail address, hotel and job title, the invitation status and dates, and a one-way hash of your personal invitation code (the code itself is not stored). Personal invitation codes expire after 30 days.

Work activity

Tasks you complete (status, an optional note and the manager’s decision), experience points (XP) and the points ledger, rewards you request and their status, job-title change requests and the audit trail of title changes, and the results of team goals.

Performance figures

Monthly revenue figures that your hotel or head office record against you (hotel, month and amount), together with hotel-level figures and budgets.

Evidence files

Images or PDF files you upload as proof that you completed a task, with their original file name, type, size and upload date.

AI practice

For the AI simulator and meeting preparation: the score you receive, the type of exercise, a short scenario label (the fictional buyer or the company type), the date and time, and a daily usage counter. The text of your practice conversation is not stored by us. Meeting-preparation profiles you create (client code name, company type, decision-maker title, annual volume, competitors, known objections, personality style and meeting goal) are stored together with the briefing generated for them, your last score and your number of attempts.

Preferences

Your language and light/dark theme choice. These are kept in your browser; when you are signed in, your chosen language is also saved to your account so that our e-mails (for example a password reset) reach you in that language.

Technical data

Our hosting, database and e-mail providers process technical data such as IP address, request time and browser or device information so that the Service can be delivered and kept secure. Error reports are described under “Service providers and where data is processed”.

Who can see your data

You

You can see your own data.

Colleagues in your chain

Other users in the same hotel chain can see leaderboard information: your name, hotel, job title and points (XP). Users and data of other chains are not visible to you or to anyone in your chain.

Hotel managers

Managers see data for their own hotel: task completions and evidence files, reward and title-change requests, AI practice scores and revenue figures.

Chain managers (head office)

Chain managers see the same for every hotel in their chain. A chain can also choose to make revenue figures visible to all of its users; this is a chain-level setting.

AI practice scores

Your hotel manager and your chain managers can see your latest AI practice score, your 30-day average and your number of attempts. You are told this inside the AI simulator and meeting-preparation screens. The conversation text is not saved and cannot be seen.

Us and our providers

We and our service providers can access data where needed to operate, support and secure the Service.

AI features

Some features use AI models provided by Anthropic: the AI simulator, meeting preparation, and the translation of tasks, rewards and campaigns written by managers. This is what is sent to Anthropic:

• Simulator: the practice messages you type and the conversation so far, together with a built-in role-play instruction that describes a fictional buyer. When you ask for an evaluation, the conversation is sent again with an evaluation instruction and the name of your language.
• Meeting preparation: the meeting-profile fields you wrote (client code name, company type, decision-maker title, annual volume, competitors, known objections, personality style and meeting goal) and the messages you type. E-mail addresses and phone numbers in these free-text fields are masked automatically before sending.
• Translation: the titles and descriptions of tasks, rewards and campaigns that managers write, so that they can be translated into the other supported languages.

Your name, e-mail address, user ID, hotel and job title are not included in these requests. Anything you type in free text is sent, so please do not enter personal data about real clients or colleagues.

Anthropic uses this data to produce the AI response. How long Anthropic keeps it, and whether it may be used to train models, are governed by Anthropic’s terms: [ANTHROPIC SAKLAMA KOŞULLARI].

AI output is generated automatically, can be wrong, and is meant for practice and coaching. The Service does not make automated decisions with legal or similarly significant effects about you: scores are shown to managers as information, and decisions remain with people.

Service providers and where data is processed

Supabase

Database, authentication and file storage. Our project is hosted in the European Union (Frankfurt, Germany).

Vercel

Hosting of the web application. The application’s server functions are configured to run in Frankfurt (Vercel region fra1).

Resend

Sends our account e-mails (such as sign-up confirmation, password reset and e-mail change). Region: Ireland.

Anthropic

AI features, as described above.

Sentry

Error monitoring, when it is switched on. Sentry receives technical error reports: the error message and stack trace, the page address, browser and device information, and a 10% sample of performance traces. We have not switched on Sentry’s optional collection of personal data, we do not attach your name, e-mail address or account ID to reports, and we do not use session replay. Error messages or page addresses can still contain personal data by accident, and the connection itself carries technical data such as an IP address. Sentry region: [SENTRY VERİ BÖLGESİ].

We do not use advertising or analytics services, social-media plug-ins or third-party fonts; fonts are served from our own server.

Some of these providers may process data outside the UK and the European Economic Area. Where they do, we rely on [ULUSLARARASI AKTARIM DAYANAĞI].

Cookies and local storage

We use only what is needed to run the Service and to remember your own choices. We do not use advertising or analytics cookies or trackers, and we do not load third-party tracking scripts.

Sign-in session cookies

Cookies whose names start with “sb-”, set by our authentication provider when you sign in so that you stay signed in. They are removed when you sign out or when the session expires.

pace_locale (browser storage)

Your language choice.

pace_theme (browser storage)

Your light/dark theme choice.

pace_reset_last_sent (browser storage)

The time of your last password-reset request, so that a short wait between requests can be applied.

You can clear these in your browser settings; you would be signed out and your choices reset.

How long we keep data

• Account and work-activity data (including AI practice scores and revenue figures): [SAKLAMA SÜRESİ].
• Personal invitation codes expire 30 days after they are created. The invitation record (name, e-mail address and status) is kept for [SAKLAMA SÜRESİ].
• Evidence files: files from task completions that a manager rejected, and files that were uploaded but never attached to a task, are removed by our clean-up routine (default windows: 7 days after rejection and 24 hours after upload). We run this routine ourselves; it is not automatic. Files of approved completions are kept with the completion.
• AI practice conversation text: not stored by us (see “AI features” for what Anthropic does with it).
• Meeting-preparation profiles: until you delete them; you can delete them in the app.
• Backups: we take regular backups of the database and uploaded files. Backup copies are kept for [YEDEK SAKLAMA SÜRESİ] and can contain data you have since deleted until they are removed.

Your rights and how to use them

Under the UK GDPR you have the right to be informed, to access your data, to have it corrected, to have it erased, to restrict its use, to receive it in a portable format, and to object to its processing. Where processing is based on your consent, you can withdraw it at any time.

In the app you can edit your name under “My Profile” and request a job-title change. The app does not currently let you download or delete your data yourself. To use any of your rights, e-mail [GİZLİLİK E-POSTASI]; we may ask you to confirm your identity, and we aim to reply within one month.

If you are an employee of a customer, your request may concern data for which your employer is the controller. In that case we may pass the request on to your employer, or ask you to contact them, as the law requires.

You have the right to complain to the UK Information Commissioner’s Office (ICO), ico.org.uk. If you are in the EU or EEA you can also complain to your local supervisory authority, and in Turkey to the Personal Data Protection Authority (KVKK).

Security

• The Service is accessed over HTTPS.
• Access is limited in the database itself (row-level security): users see only the data of their own hotel or chain. A new account always starts at the lowest permission level, and a manager must raise it.
• Passwords must be at least 12 characters. Two-step login is available to everyone and mandatory for hotel-manager and chain-manager accounts unless we have exempted the account.
• Personal invitation codes are stored only as one-way hashes.

No system is completely secure. If a personal data breach occurs we will act as the law requires, including informing the customer, and the ICO where required.

Changes and contact

We may update this policy. The date at the top shows the latest version; for material changes we will also give notice in the Service or by e-mail.

Contact: [İŞLETME ADI], [KAYITLI ADRES]. Privacy requests: [GİZLİLİK E-POSTASI].