This Privacy Policy describes how BeSolution Engenharia, Lda., trading as BeVantai (“BeVantai”, “we”), processes personal data in connection with the bevantai.com website, the public concierge demo and the virtual concierges it provides to its clients, including those made available through WhatsApp. It applies to visitors to the site, to people who talk to a concierge and to the representatives of the accommodations that contract the service.
1. Controller and contact details
The entity responsible for the site, the public demo and the provision of the service is BeSolution Engenharia, Lda., a private limited company registered in Portugal under number 507295951, with its registered office at Rua Soar de Cima 21, Largo Almeida Moreira, 3500-211 Viseu, Portugal.
Any request, question or complaint concerning personal data may be addressed to privacy@bevantai.com. We reply within 30 days at most.
2. Definitions
- “Service”: the bevantai.com website, the public concierge demo and the virtual concierges provided to Clients, together with the management dashboard that accompanies them.
- “Concierge”: the virtual assistant that answers in writing, using a language model, the questions of people who contact an accommodation, on a website, in an embedded chat window, on a custom domain or on WhatsApp.
- “Client”: the short-term rental, guesthouse, hotel or other entity that contracts the Service from BeVantai.
- “User”: the person who talks to a Concierge or to the public demo, whether or not they are a guest of the Client.
- “Client Data”: the personal data processed by BeVantai on behalf of a Client, in particular the content of its Users’ conversations.
- “Processor”: the entity that processes personal data on behalf of and under the instructions of a controller, within the meaning of Article 28 of Regulation (EU) 2016/679 (“GDPR”).
3. Scope and roles
BeVantai’s role depends on the context in which the data is processed:
| Context | Controller | BeVantai’s role |
|---|---|---|
| Visiting bevantai.com, requests sent through the site’s form and talking to the public Concierge demo | BeVantai | Controller |
| Talking to a Client’s Concierge, on the Client’s website, in an embedded chat window, on a custom domain or on WhatsApp | The Client | Processor: processes the data on behalf of and under the instructions of the Client, under a data processing agreement that forms part of each Client’s contract |
| Data of the Clients’ representatives and dashboard users | BeVantai | Controller |
Where BeVantai acts as Processor, requests to exercise rights belong to the Client. The User may nevertheless address them to BeVantai, which forwards them to the Client and assists in fulfilling them.
4. Personal data we process
BeVantai processes the following categories of personal data:
| Category | Data | Source |
|---|---|---|
| Conversation content | The messages written by the User and the Concierge’s replies. | User |
| Technical conversation data | Date and time of each message; a random session identifier generated in the browser, used only to keep the thread of the conversation, which neither identifies the User nor follows them across sites; the detected language; response time and language-model usage. | Generated by the Service |
| Derived data | A category, a summary, the topics of the conversation, the questions that went unanswered and whether the request was resolved, generated by artificial intelligence once the conversation ends, with no personal data in the labels. | Generated by the Service |
| User contact details | An email address or a phone number, requested only when the User asks the Client’s team to get back to them later. | User |
| Voice data | On Concierges where the Client has turned dictation on, the audio captured when the User taps the microphone, converted into text by a speech-recognition service in the European Union. The audio is not retained and is not used to identify the User. | User |
| WhatsApp data | The User’s phone number, the identifier assigned by Meta and the User’s WhatsApp profile name, received with every message. If the User has a WhatsApp username, Meta may send the identifier and that username without the number. | WhatsApp Business Platform |
| Requests through the site | The name, the contact details (email or phone), the message and, if given, the property’s website, sent through the proposal request form on bevantai.com. | The person sending the request |
| Client data | The property information and professional contact details provided in the intake form; the dashboard accounts, with name, email address and password; the log of actions performed in the dashboard, with date and IP address. | Client |
| WhatsApp connection data | When a Client connects the Concierge to its business’s WhatsApp, the identifiers of the WhatsApp Business account, of the phone number and of the business portfolio, the name under which the business appears on WhatsApp, an access token and, for numbers that BeVantai registers on the Meta platform, the two-step verification code. | Meta, with the Client’s authorisation |
| User’s IP address | Used momentarily to limit abusive use. Not retained with the conversation; it remains only in the technical access logs of the infrastructure and the network. | User’s connection |
In a website chat, no identification is requested in order to talk to the Concierge. If the User writes personal data during the conversation, it is stored in the content of that conversation like any other sentence.
The Concierge reads text only. Photos, audio, locations and other files sent on WhatsApp are neither opened nor retained; only the type of message is recorded, and the Concierge invites the User to write.
5. Concierge on WhatsApp
Where an accommodation has connected its Concierge to WhatsApp, the User may talk to it through that channel. Everything in this Policy applies, with the following specifics:
- The User’s phone number, the identifier assigned by Meta and the User’s WhatsApp profile name reach BeVantai with every message, by the way the platform itself works. They are stored with the conversation, so that the reply is delivered in the same thread, and are not used for any other purpose.
- Messages are transmitted through the WhatsApp Business Platform, operated by Meta, which delivers them on the Client’s behalf and retains them for at most 30 days for that purpose.
- The Client’s team may read the conversation and reply to the User in the WhatsApp Business app on the same number. While the team is replying, the Concierge does not intervene.
- When a Client connects a number that stays on the WhatsApp Business app, BeVantai does not store that app’s conversation history or contacts.
- The Concierge writes only in reply to a message from the User. It sends no commercial communications and does not start conversations. To stop using it, simply stop writing or block the number in the WhatsApp app itself.
- Use of WhatsApp remains subject to WhatsApp’s own terms and privacy policy.
6. Purposes and legal bases
We process personal data for the following purposes and on the following grounds:
| Purpose | Data | Legal basis |
|---|---|---|
| Answering the User | Conversation content, technical data, WhatsApp data | The Client’s legitimate interest in answering those who contact it and in providing a good service (Article 6(1)(f) GDPR) and, where the User is a guest, performance of the accommodation contract (Article 6(1)(b)) |
| Making its Users’ conversations available to the Client in the dashboard | Conversation content, derived data | The Client’s legitimate interest and performance of the accommodation contract |
| Producing statistics and summaries that help the Client improve its service and the information it provides | Derived data | The Client’s legitimate interest |
| Calculating the cost of the Service and billing it to the Client | Response time and language-model usage | Performance of the contract with the Client (Article 6(1)(b)) |
| Keeping the Service secure and preventing abuse | IP address, dashboard activity log | The legitimate interest of BeVantai and of the Clients in the security of the Service (Article 6(1)(f)) |
| Presenting and improving the product on the site and in the public demo | Demo conversation content, technical data | BeVantai’s legitimate interest (Article 6(1)(f)) |
| Converting dictation into text | Voice data | The User’s consent, given by tapping the microphone and confirming the notice that explains it (Article 6(1)(a)); it may be declined or withdrawn at any time, the conversation continuing in writing |
| Answering proposal and contact requests made on the site | Requests through the site | Steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b)) and BeVantai’s legitimate interest in answering those who contact it (Article 6(1)(f)) |
| Managing the contractual relationship with Clients | Client data, WhatsApp connection data | Performance of the contract (Article 6(1)(b)) and compliance with legal obligations, in particular tax obligations (Article 6(1)(c)) |
On WhatsApp, the conversation always starts at the User’s initiative, and the same legal bases apply.
BeVantai does not sell personal data, does not use it for advertising and does not use conversations to train or improve artificial-intelligence models. The Service makes no solely automated decisions that produce legal effects or similarly significantly affect the User.
7. Recipients and sub-processors
Personal data is processed by categories of service providers acting as sub-processors of BeVantai, under contractual instructions and with confidentiality and security obligations, each limited to what its function requires. The current list of those categories, with the function, processing location and transfer mechanism of each, is published on the Sub-processors page, which forms part of this Policy.
In summary, data may be processed by:
- An artificial-intelligence model provider, established in the United States, which generates the replies and the summaries from the conversation’s messages. Where web search is enabled on that Concierge, the question may be used to search the internet.
- Amazon Web Services (AWS), whose infrastructure hosts the application and the database in the Frankfurt region, Germany, within the European Union.
- A speech-recognition service, processing in the European Union, only on Concierges with dictation enabled and only when the User uses it.
- Meta, through the WhatsApp Business Platform, only in WhatsApp conversations, which delivers the messages between the User and the Concierge on the Client’s behalf.
- Technical service providers that keep the Service running: networking and protection against attacks, email delivery and operational alerts to the BeVantai team.
- The Client the conversation is addressed to, which accesses its Users’ conversations in the dashboard and, on WhatsApp, also in the WhatsApp Business app on its number.
We do not share personal data with advertising networks or data brokers. We may disclose personal data where required by law or where necessary to respond to a legitimate request from an authority.
8. International transfers
Personal data is hosted in the European Union. Processing by the language model takes place in the United States, which constitutes an international transfer. In WhatsApp conversations, Meta may likewise process the messages outside the European Union, and so may some technical service providers. Speech recognition for dictation takes place in the European Union and the audio does not leave it.
These transfers rely on the mechanisms provided for in Chapter V of the GDPR: the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission, supplemented by such additional measures as prove necessary.
The adequacy decision in force is the third concluded between the European Union and the United States; the previous ones, Safe Harbour and the Privacy Shield, were invalidated by the Court of Justice of the European Union in 2015 and 2020. Should the current one be invalidated, transfers will rely solely on the standard contractual clauses and on the supplementary measures then required.
9. Retention periods
We keep personal data only for as long as necessary for the purposes for which it was collected:
| Data | Retention period |
|---|---|
| Concierge conversations, including, on WhatsApp, the phone number, the identifier assigned by Meta and the profile name | 24 months from the last message. After that they are deleted automatically. |
| Contact details requested for a later reply by the Client’s team | Kept with the conversation they relate to. |
| WhatsApp messages on Meta’s platform | At most 30 days, by Meta. The copies kept in the User’s WhatsApp and in the Client’s app do not depend on BeVantai. |
| Dictation audio | Not retained; only the resulting text remains in the conversation. |
| User’s IP address | Not retained with the conversation; used momentarily to limit abuse. The technical access logs of the infrastructure and the network, which include the IP address, are kept by those providers for a short period, at most 30 days, for security and troubleshooting. |
| Requests sent through the site’s form | Up to 24 months from receipt. If the request leads to a contract, the data then follow the retention periods for Client data. |
| Intake-form data and dashboard accounts | For as long as the contractual relationship with the Client lasts. |
| Dashboard activity log | 24 months. |
| A Client’s WhatsApp connection data | For as long as the connection is active. Deleted within 30 days of the Client disconnecting it or ending the Service. |
| Invoices and accounting records | For the period required by tax law. |
10. Security
BeVantai adopts technical and organisational measures appropriate to the risk, including: encryption of all traffic in transit; access control, with each Client isolated from the others and access to conversations restricted to the Client they belong to and to the BeVantai staff who need it to run the Service; passwords subject to minimum strength requirements; logging of actions performed in the dashboard; and usage limits that stop abusive access.
11. Data subject rights
Under the GDPR, the data subject has the right to access their personal data, to obtain its rectification or erasure, to restrict or object to processing, to receive the data in a structured, commonly used format, and to withdraw any consent given, without affecting the lawfulness of prior processing.
To exercise any of these rights, write to privacy@bevantai.com. We reply within 30 days at most. If the conversation was with a Client’s Concierge, the request belongs to that Client; the User may nevertheless address it to BeVantai, which forwards it and assists in fulfilling it.
The data subject also has the right to lodge a complaint with the competent supervisory authority, in Portugal the Comissão Nacional de Proteção de Dados (www.cnpd.pt).
12. How to request the deletion of your data
The data subject may at any time request the deletion of a conversation and of the data that accompanies it, including, on WhatsApp, the phone number, the identifier assigned by Meta and the profile name. To do so, write to privacy@bevantai.com and state:
- If the conversation was on WhatsApp: the number or username you wrote from and the accommodation. BeVantai may ask for confirmation that the number or username belongs to the requester.
- If the conversation was in a website chat: the accommodation, the day and a sentence from the conversation. Since the User is not identified, that is how it is located.
- If the requester is a Client: what is to be deleted (the account, the intake form or the WhatsApp connection). The Client may also remove BeVantai’s access in its Meta business account settings; from then on, BeVantai stops receiving and sending messages on that number.
Deletion is completed within 30 days at most, except for data the law requires us to keep, such as invoices, and is confirmed in writing. If the conversation was with a Client’s Concierge, the request is handled together with that Client, which is responsible for the data. Deletion by BeVantai does not remove the copies kept in the User’s WhatsApp or in the Client’s app.
13. Cookies and local storage
The Service uses no advertising cookies and no cross-site tracking technologies.
- In the chat, the User’s browser may store a random conversation identifier and the recent messages, so that the thread survives between pages; on the site, it stores the chosen language; if the User uses dictation, it also stores that the microphone notice has been seen. This data can be removed by clearing the site data in the browser. Microphone permission is managed by the browser itself, where it can be withdrawn at any time.
- In the authenticated areas, the Client dashboard and the intake form, a session cookie is used, strictly necessary to keep the session signed in.
14. Minors
The Service is intended for people contacting an accommodation and is not directed at children. BeVantai does not knowingly collect personal data from anyone under 16.
15. Changes to this Policy
BeVantai may update this Policy to reflect changes in the Service or in applicable law. The version in force is the one published on this page, with the date shown at the top. Material changes are communicated to Clients.
16. Language versions
This Policy is available in Portuguese, English and Spanish. If the versions differ, the Portuguese version prevails.
Questions about this page? info@bevantai.com
See also: Terms and Conditions · Sub-processors