Privacy policy
Last updated 17 October 2026
Restado AI answers the phone and guest messages for holiday-rental management companies (our clients). When you call or message a property managed by one of our clients, you are answered by an AI assistant (called Alex unless the company chose another name) that works for that company. This page explains what happens to your information.
Who is responsible
For guests and the client's staff, the property manager you booked with is the controller of your data;Restado processes it on their behalf and on their instructions. For the people who use the Restado dashboard and for our own business contacts, Restado AI (operating company to be confirmed) is the controller. Contact: privacy@restado.ai.
What we process, and why
- Your booking (name, phone, email, language, dates, property) — received from the property manager's booking system so Alex can recognise you and help with your stay.
- Your call — the audio, a transcript and a short summary, so the team can follow up and the next call can pick up where you left off.
- What you asked for — tickets about issues you reported, follow-up calls you asked for, and preferences you mentioned (for example a late check-in).
- Your messages — when the property manager turns it on, messages you send through the booking platform, by SMS or on WhatsApp, and the replies. Replies are drafted by the AI and sent by a person, or sent automatically for simple questions if the property manager chose that.
- Verification — a PIN sent to you, and the attempts to enter it. Door codes and other access details are only given after you verify; recognising your phone number is never enough, and they are never sent in a message.
- Smart locks — if the property has a connected smart lock, a door code for your stay only, valid from check-in to check-out, kept encrypted and given to you by phone after you verify.
- Staff of our clients — name, phone and availability, so the right person can be called about an issue.
- Dashboard users — email, role, sign-in and two-factor settings, and an audit trail of actions; if you link Telegram, your chat with the team assistant; for the account owner, billing details (card payments are handled by Stripe — we never see the card number).
- Property owners who receive a report link see only totals (calls, issues, response times) for their properties — never a guest's name, number or message.
The legal basis is the performance of your booking and the property manager's legitimate interest in running the stay safely; for dashboard users, our legitimate interest in security and accountability. We do not ask for sensitive (special-category) data. If you mention something sensitive on a call, it follows the transcript's retention below.
AI and automated processing
Alex is an AI and says so. It uses speech recognition, a language model and speech synthesis. After a call, AI also writes the summary and extracts follow-ups. Alex cannot create, change or cancel bookings, issue refunds or take payments — a person at the property manager does that. In an emergency Alex tells you to call the local emergency number first and then calls the on-call team.
How long we keep it
| Data | Kept |
|---|---|
| Call recordings | 90 days by default (the property manager may choose up to 365), then deleted — including the copy held by our telephony provider |
| Transcripts | 90 days by default (up to 365), then anonymised |
| Messages (booking platform, SMS, WhatsApp) | The same period as transcripts, then the text and your number are removed |
| Smart-lock codes | Removed from the lock and from Restado when your stay ends or is cancelled |
| Call summaries | 90 days by default (up to 730), then anonymised |
| Remembered preferences | Up to the property manager's setting, at most 730 days |
| PINs and verification | Until 7 days after departure |
| Your booking details in Restado | 365 days after departure by default (30–730), then your name and contact details are removed |
| Audit log | Kept for accountability; phone numbers in it are hashed after 90 days |
Who else processes it
We use a small number of service providers (sub-processors) for hosting, telephony, messaging, speech, AI and payments. The full list, what each receives and where it is located is on the sub-processors page. The database and file storage are in the European Union; some providers are in the United States, under the EU–US Data Privacy Framework or Standard Contractual Clauses. Our AI providers do not train their models on this data.
Your rights
You can ask for a copy of your data, its correction or its deletion, object to processing, or ask us to restrict it. Because the property manager is the controller of guest data, the quickest route is to ask them; you can also write to us and we will pass it on and help them answer. See your data. You may complain to your data-protection authority.
Errors and cookies
When the software fails, an error report is sent to our error-tracking service without names, phone numbers, email addresses, codes or message text. The dashboard stores only what it needs to keep you signed in — no analytics or advertising cookies (cookies and storage).
Security
Each client's data is separated from every other client's in the application and in the database; credentials are encrypted; access is limited by role and property; administrators can require two-factor sign-in; every access to door codes and every administrative action is logged. The commitments we make to our clients are in the data processing agreement.
Changes
We update this page when what we do changes, and show the date at the top.