1. Roles and responsibilities
Your business generally determines why customer and reservation data is processed and acts as controller. Grinat acts as processor when operating assistants on your instructions, and as controller for its own account administration and security. Our Privacy policy explains these activities. Using Grinat does not automatically make your business GDPR compliant, and this page is not a certification.
2. Data processing arrangements
A controller–processor agreement meeting GDPR Article 28 is required where Grinat processes personal data on your behalf. Contact support@grinat.ai to arrange and confirm the applicable terms before processing customer data. This information page is not a data processing agreement. Your review should cover instructions, confidentiality, subprocessors, security, incident assistance, rights requests, audits, and return or deletion of data.
3. Product controls
- Authenticated workspaces and membership checks separate business records. Partner referrals do not confer workspace access.
- Private file storage and expiring preview links limit access. Customer sharing is configured separately from using a document to answer questions.
- Provider credentials are encrypted server-side. Assistant publishing and channel assignment control customer-facing behavior.
- Scheduled guest journeys check reservation status, permission, assignment, connection state, and assistant status before sending. Guests can withdraw stay-update or promotional permission.
- Voice tests store transcripts and usage rather than raw audio recordings. Operational records support delivery investigation and accountability.
4. Before you use customer data
- Establish and document a lawful basis. Give guests and prospective customers an appropriate privacy notice, including that they are interacting with an AI assistant.
- Collect only information needed for the task. Set suitable retention requirements and restrict staff access.
- Arrange the required processing agreement and review provider and international transfer arrangements.
- Obtain the permissions required for WhatsApp outreach. Treat optional promotional offers separately from stay updates.
- Review automated responses and maintain human handoff. Assess whether your use requires a data protection impact assessment, especially for high-risk processing.
5. Rights requests and incidents
Send data access, correction, export, deletion, or security concerns to support@grinat.ai. Identify the affected business and the request without including unnecessary personal information. We coordinate requests for customer records with the responsible business. For a suspected security incident, describe what happened and when so we can investigate and coordinate the applicable response and notification duties.
6. Providers and international transfers
The platform uses Supabase, Cloudflare, xAI, and connected services such as Meta and Hostaway. See provider roles in our Privacy policy. Review the applicable processing locations and contractual safeguards with us before onboarding data subject to specific restrictions. This page does not assert that a particular transfer mechanism or customer agreement has already been executed.
7. Official guidance
The GDPR governs processing obligations, individual rights, and international transfers. These official resources provide further guidance for your compliance assessment.
Contact Grinat
SC Grinat Software SRL
Pompiliu Teodor 17, Cluj Napoca, Romania
support@grinat.ai
For privacy requests, include the relevant workspace or business name and enough information for us to locate your records. Please do not send passwords, access tokens, or identity documents unless requested through an appropriate secure process.